Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
yeachan-heo/oh-my-claudecode
main @ 542b7a4
89
Fixes
0
CVEs
CRITICAL
Peak severity
14.3%
Coverage
Highlights
Path Traversal: 25 prior fixes. Scrutinize any change in this area.
src/hooks/permission-handler/index.ts: most-fixed (6 issues). Treat as high-risk during review.
61 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: String interpolation inside shell command executions allowed arbitrary command injection during git teleport and fetch commands. Safe remediation requires replacing child_process.execSync with child_process.execFileSync using argument arrays.
Path Traversal: Relative path checks using path.relative were vulnerable to drive-escape bypasses on Windows where absolute paths were returned instead of relative parent sequences. Strict isAbsolute checks must enforce folder boundaries.
Sandbox Escape: The Python REPL evaluation environment was subject to sandbox escapes via dotted imports and builtins access. Fixes involved custom import hooks and restricting the __import__ built-in namespace.