Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
wkentaro/gdown
main @ a59d00d
7
Fixes
1
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Path Traversal: 5 prior fixes. Scrutinize any change in this area.
gdown/download.py: most-fixed (4 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Filename resolution from remote sources (URLs and Content-Disposition headers) is a persistent attack vector. Ineffective handling of null bytes, relative paths ('..'), and OS-specific path separators can allow remote files to overwrite arbitrary locations outside the intended download directory.
Path Traversal: Extracted archive members can contain path traversal sequences (Zip Slip / Tar Slip), allowing an attacker supplying a crafted archive to overwrite arbitrary local files, potentially leading to remote code execution.
Path Traversal: Google Drive folder structures downloaded recursively can contain traversal sequences in folder names, allowing files to be written outside the designated target folder structure.