Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Cockpit-HQ/Cockpit

              develop @ 489c333
            

Fixes

CVEs

CRITICAL

Peak severity

55.2%

Coverage

Highlights

Auth Bypass: 22 prior fixes. Scrutinize any change in this area.

modules/App/Controller/Auth.php: most-fixed (6 issues). Treat as high-risk during review.

43 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Highest frequency (22 fixes) with critical severities; flaws in session establishment, 2FA, active-user checks, and ACL permission lookups allow unauthorized access.

Stored/Reflected XSS: Multiple fixes across PHP views and Vue components show persistent failure to escape user-controlled data (titles, names, emails, API keys) leading to stored and reflected XSS.

Command/Code Injection: Critical command injection via shell command line and a new async code execution helper introduce arbitrary code execution risk.