Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wonderwhy-er/desktopcommandermcp

              main @ 9cd9cb4
            

Fixes

CVEs

HIGH

Peak severity

26.7%

Coverage

Highlights

Path Traversal: 7 prior fixes. Scrutinize any change in this area.

src/tools/filesystem.ts: most-fixed (6 issues). Treat as high-risk during review.

16 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Command execution logic failed to safely isolate arguments and block sub-commands, enabling shell command substitution and base command blocklist bypasses. This risk is actively associated with CVE-2025-11490 and CVE-2025-11491.

Path Traversal: Symlink-following and partial-path string matching ('startsWith') in path-allowed checks historically allowed directory restriction escapes. Safe resolution requires both path canonicalization and proper separator suffixing (CWE-59 / CVE-2025-11489).

Command Injection: Using unsafe shell invocation functions (like child_process.exec) on path arguments led to command execution vulnerabilities on Windows, necessitating base64-encoded PowerShell wrappers.