Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zilliztech/claude-context

              master @ 627eb2b
            

Fixes

CVEs

MEDIUM

Peak severity

50.0%

Coverage

Highlights

Denial of Service: 1 prior fix. Scrutinize any change in this area.

packages/mcp/src/handlers.ts: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Unsanitized search results, previews, and context strings were directly rendered via innerHTML, allowing malicious content to execute scripts in the webview context.

Denial of Service: Hardcoded metadata placeholders (0/0 rows) during database snapshot loading caused an infinite force-reindex loop, consuming CPU and freezing services.