Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

AmirulAndalib/nuclei

              main @ 28b2780
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Sandbox Escape: 3 prior fixes. Scrutinize any change in this area.

v2/internal/runner/processor.go: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Workflow script imports were restricted to a safe module allowlist, but two separate fixes were needed, indicating the initial allowlist was incomplete and the same sink (SetImports) remains a high-risk execution boundary.

Path Traversal: Zip-slip in template extraction allowed writing files outside the template directory via crafted archive names; fixed by canonicalizing and prefix-checking paths, a classic and easily reintroduced flaw.

Local File Access / Path Traversal: Headless FilesInput action could read arbitrary local files via file:// scheme unless explicitly gated behind AllowLocalFileAccess flag; a missing flag check on any sibling action would re-expose local reads.