Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
yvgude/lean-ctx
main @ ef71aa6
76
Fixes
0
CVEs
CRITICAL
Peak severity
34.6%
Coverage
Highlights
Auth Bypass: 18 prior fixes. Scrutinize any change in this area.
rust/src/core/pathjail.rs: most-fixed (9 issues). Treat as high-risk during review.
40 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: PathJail directory resolution and symlink handling had multiple vulnerabilities where weak validation, TOCTOU symlink races, and caching issues allowed containment escapes outside the intended project root directory.
Command Injection: The restricted shell allowlist mechanism had multiple bypasses due to command substitutions, subshells, backticks, line separators, and piping to bare interpreters, requiring an upgrade to complete AST-style multi-segment parsing.
Auth Bypass: Third-party addons could execute unauthorized host actions or override global configurations, requiring the introduction of code-signing audit frameworks, install policy gating, and sandboxing.