Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

bjarneo/cliamp

              main @ de1dc4c
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Cache Poisoning: 1 prior fix. Scrutinize any change in this area.

cmd/setup.go: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: SSH command construction from URL host allowed injection of options via '-' or '=' characters, enabling arbitrary command execution.

SSRF: Plugin-supplied URLs were dialed without restriction, allowing access to internal/cloud metadata endpoints.

Path Traversal: User-controlled playlist names in filepath.Join could escape base directory, leading to arbitrary file access.