Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

aio-libs/aiobotocore

              main @ c92e345
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

Code Injection: 1 prior fix. Scrutinize any change in this area.

.github/botocore-sync-prompt.md: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Prompt Injection: AI agent processing GitHub issue comments is vulnerable to injected instructions; fix filters by author_association but other comment fields or API endpoints may still be trusted.

Code Injection: Inline template expansion of github.ref_name into shell commands allows injection via crafted tag names; fix moves to env var but other workflow expressions may remain inline.

Improper Certificate Validation: aiohttp TCPConnector did not respect client SSL verification setting, accepting invalid certs; fix passes verify_ssl but other connector creation sites may miss this.