Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

xpipe-io/xpipe

              master @ aa00541
            

Fixes

CVEs

HIGH

Peak severity

28.6%

Coverage

Highlights

Command Injection: 4 prior fixes. Scrutinize any change in this area.

app/src/main/java/io/xpipe/app/util/SecretManager.java: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: String-interpolated raw shell commands used for file permission adjustments allowed shell injection. This was resolved by adopting the parameterized CommandBuilder API.

Command Injection: Compression and extraction actions concatenated raw strings directly into execution arguments, introducing command injection vulnerabilities during browser navigation and archiving tasks.

Auth Bypass: Lack of strict verification of session identifiers allowed unauthenticated or unauthorized access to sensitive remote control and local command execution features via SSE/HTTP transports.