Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
block/goose
main @ c82c431
67
Fixes
0
CVEs
CRITICAL
Peak severity
24.2%
Coverage
Highlights
Auth Bypass: 17 prior fixes. Scrutinize any change in this area.
crates/goose-cli/src/cli.rs: most-fixed (3 issues). Treat as high-risk during review.
29 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The server components historically permitted unauthenticated access. Ensuring robust token validation across both header and query paths is crucial to securing the Agent Client Protocol router.
Privilege Escalation: Extensions deserializing configurations could inject dangerous environment variables like LD_PRELOAD or PATH to hijack process execution. Strict filtering of environment keys must be enforced.
Path Traversal: Session managers and storage backends are vulnerable to path traversal if they fail to canonicalize paths and verify directory prefixes, risking arbitrary file read/write.