Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

bobthecow/psysh

              main @ 357f8cd
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Access Control Bypass: 1 prior fix. Scrutinize any change in this area.

bin/psysh: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Arbitrary Code Execution: Loading project-local configs, binaries, or Composer autoloads without user consent allows arbitrary code execution from untrusted project directories. This is the highest-impact risk as it compromises the entire shell session.

Access Control Bypass: Reflection-based bypass of private constructors enables unauthorized object creation, breaking access control and potentially leading to further exploitation.

Command Injection: Unescaped file paths passed to proc_open allow command injection, enabling arbitrary OS command execution on the host.