Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

AgentFlocks/flocks

              main @ f665b19
            

Fixes

CVEs

CRITICAL

Peak severity

44.1%

Coverage

Highlights

Denial of Service: 36 prior fixes. Scrutinize any change in this area.

flocks/server/routes/session.py: most-fixed (7 issues). Treat as high-risk during review.

41 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Arbitrary Code Execution: Command injection vulnerabilities exist due to outdated dependencies on LiteLLM, particularly in connection testing and MCP stdio handlers, resolved via CVE-2026-42271 patches.

Auth Bypass: Local loopback trust and session cookie validation flaws allow reverse-proxy or loopback spoofing to bypass core authorization middleware.

Path Traversal: Inadequate canonicalization of user-provided paths enables path traversal and arbitrary local file reads outside the designated workspace directory.