Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

dwisiswant0/nuclei

              dev @ 193ac2f
            

Fixes

CVEs

CRITICAL

Peak severity

43.5%

Coverage

Highlights

Path Traversal: 8 prior fixes. Scrutinize any change in this area.

v2/pkg/protocols/common/generators/validate.go: most-fixed (3 issues). Treat as high-risk during review.

20 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Multiple fixes in the same payload-path validation file indicate a persistent weakness in resolving template-relative paths; each fix addressed a different traversal vector (relative resolution, cross-OS handling, folderutil confinement), suggesting incomplete path-containment logic that attackers can re-trigger on other generators or OSes.

Sandbox Escape: The JS require() sandbox escape allowed arbitrary local file reads bypassing the allow-local-file-access flag, indicating that the sandbox's file-access gate was not enforced on the require path. This is a recurring class with fixes in multiple JS-related components, signaling a need for centralized, per-execution containment.

Cryptographic Signature Verification Bypass: Signature verification bypasses were fixed by normalizing content and requiring strict signature placement, but the loading path also introduced a caching/trust bypass. These indicate that the verification trust boundary is fragile and can be undermined from multiple angles (content normalization, extraction, cached results).