Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

dev0x41/nuclei

              dev @ 764f5a9
            

Fixes

CVEs

HIGH

Peak severity

42.9%

Coverage

Highlights

Path Traversal: 6 prior fixes. Scrutinize any change in this area.

pkg/catalog/loader/loader.go: most-fixed (3 issues). Treat as high-risk during review.

25 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Multiple fixes target the JavaScript and Tengo scripting sandbox, indicating a high-risk area where escape could lead to arbitrary code execution. Issues include privileged module cache reuse, eval usage, unrestricted imports, and browser sandbox disabling.

Path Traversal: Six fixes address path traversal across file loading, payload generation, template updates, and headless file actions. The root cause is often insecure lexical prefix checks or missing canonicalization, allowing sibling paths or file:// protocol to bypass restrictions.

Signature Bypass: Multiple fixes enforce or correct template signature verification. Vulnerabilities included cache poisoning with stale metadata, accepting signatures anywhere in content, and executing unsigned JavaScript/code templates. This is a critical trust boundary.