Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

agentscope-ai/agentscope-java

              main @ f96cdc7
            

Fixes

CVEs

HIGH

Peak severity

62.5%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

agentscope-core/src/main/java/io/agentscope/core/ReActAgent.java: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Session lookup keyed only by threadId allowed cross-tenant access; fixed by scoping to (userId, threadId).

Security Control Downgrade / Permission Bypass: Legacy state reconstruction silently downgraded permission mode (e.g., BYPASS to DEFAULT), enabling unauthorized privileged actions.

Path Traversal: Upload path not constrained to workspace allowed traversal; fixed via resolveArchivePath validation.