Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

bruto001/nuclei

              master @ 1010cca
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Command Injection: 2 prior fixes. Scrutinize any change in this area.

v2/internal/runner/processor.go: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Workflow scripts can import all stdlib modules including os/exec, enabling arbitrary command execution. Patched twice, indicating incomplete mitigation.

Path Traversal: Zip-slip during template extraction allows writing files outside the template directory via malicious archive entries.

Sandbox Escape: Chrome launched with --no-sandbox flag on non-root users or platforms, allowing sandbox escape.