Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
xonsh/xonsh
main @ b0048b9
11
Fixes
0
CVEs
HIGH
Peak severity
30.0%
Coverage
Highlights
Denial of Service: 5 prior fixes. Scrutinize any change in this area.
xonsh/execer.py: most-fixed (4 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: The parsing engine in xonsh/execer.py is repeatedly vulnerable to CPU exhaustion and infinite loops when processing syntactically abnormal sequences, such as unescaped trailing backslashes, unclosed symbols, or malformed prefix characters. Robust loop-termination conditions and syntax error interrupts must be enforced.
Command Injection: Unsafe shell execution patterns in utility scripts and shell integrations allow arbitrary command injection if paths or user inputs are not properly sanitized before being passed to subprocess shells. Adequate wrapper-level escaping is mandatory.
Code Execution: Historically, using insecure deserialization mechanisms like pickle to load command caches allowed local attackers to execute arbitrary code. Migration to non-executable formats like JSON must be maintained across all state files.