Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cytostack/openwolf
main @ 06ed881
3
Fixes
0
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
post-bash.ts: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Path containment relied on startsWith, which can be bypassed with prefix tricks; fix switched to path.relative with realpath fallback, but other read-tracking paths may still use weak checks.
Command Injection: Multiple execSync calls built command strings via concatenation, allowing injection through interpolated values; fix replaced with execFileSync argument arrays, but any remaining execSync or child_process usage may be vulnerable.
Auth Bypass: Dashboard API and WebSocket endpoints lacked token verification, enabling unauthenticated remote access; fix added loopback binding and per-project token, but other daemon-exposed services may still be unauthenticated.