Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

e2b-dev/infra

              main @ 33a2656
            

Fixes

CVEs

CRITICAL

Peak severity

43.2%

Coverage

Highlights

Auth Bypass: 31 prior fixes. Scrutinize any change in this area.

packages/orchestrator/internal/sandbox/network.go: most-fixed (4 issues). Treat as high-risk during review.

63 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes across handlers (instances, sandbox_kill, template_delete, apikey) show a recurring failure to enforce team ownership or admin scopes on mutating endpoints, allowing cross-tenant access.

Sandbox Escape: Several fixes to iptables rule placement and content (INPUT/FORWARD chains, private/link-local blocking) indicate persistent gaps in network isolation that could allow a sandbox to reach the host or internal networks.

Path Traversal: File upload and download endpoints in envd have repeatedly lacked proper path sanitization, allowing arbitrary file read/write outside the sandbox.