Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

usebruno/bruno

              main @ 7765320
            

Fixes

CVEs

CRITICAL

Peak severity

41.2%

Coverage

Highlights

Sandbox Escape: 9 prior fixes. Scrutinize any change in this area.

packages/bruno-electron/src/index.js: most-fixed (5 issues). Treat as high-risk during review.

19 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: The scripting engine historically suffered from frequent sandbox escapes arising from vulnerable dependencies like vm2, function marshalling leaks, and improper context isolation. Secure defaults now mandate QuickJS and Node VM environments with strict process sanitization.

Path Traversal: IPC file operations (`writeFile`, `writeFileSync`) failed to validate that paths stayed within collection boundaries, permitting arbitrary local file writes via crafted file or collection names. This requires robust canonicalization and prefix checks.

Remote Code Execution: Unvalidated use of Electron's `shell.openExternal` permitted arbitrary protocol execution, allowing malicious local URI schemes or binary executions. Restricting actions to an explicit scheme allowlist (http/https) is required.