Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

DataDog/integrations-core

              master @ fac4bc9
            

Fixes

CVEs

CRITICAL

Peak severity

35.5%

Coverage

Highlights

Information Disclosure: 11 prior fixes. Scrutinize any change in this area.

datadog_checks_base: most-fixed (6 issues). Treat as high-risk during review.

23 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Execution of shell commands using dynamic, untrusted configuration parameters like 'seff_path' without validating that the provider is trusted can lead to arbitrary remote code execution.

SQL Injection: Manually escaping and interpolating regex filters and database/object names instead of using query parameter binding exposes database integrations to severe SQL injection vulnerabilities.

Code Injection: Directly interpolating GitHub event context variables inside inline scripts enables attackers to execute arbitrary shell commands or code in runner environments. Passing inputs via environment variables is required.