Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

xiaomimimo/mimo-code

              main @ c019520
            

Fixes

CVEs

HIGH

Peak severity

44.4%

Coverage

Highlights

SSRF: 5 prior fixes. Scrutinize any change in this area.

packages/opencode/src/tool/webfetch.ts: most-fixed (3 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The fetching mechanism is highly susceptible to SSRF redirect bypasses. Ensuring that both the initial and post-redirect URLs undergo rigorous check validation is critical to preventing malicious host querying.

Path Traversal: Weak directory containment validations allowed traversal. Sub-components must enforce canonicalized prefix checks on directory bounds to prevent actors from accessing parent filesystem directories like /var.

SSRF: Vulnerabilities in IP address validation permitted SSRF bypasses via complex IPv6 mappings or DNS resolve failures. Fail-closed DNS parsing and robust IPv4-mapped IPv6 normalization are required.