Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

elastic/kibana

              main @ 5b3abbe
            

358

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 215 prior fixes. Scrutinize any change in this area.

x-pack/plugins/cases: most-fixed (7 issues). Treat as high-risk during review.

100 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Incomplete enforcement of per-agent visibility restrictions (Private, Shared, Public) in the backend allowed unauthorized users to view, edit, or delete private agents.

Prototype Pollution: Inherited attributes from Object.prototype could contaminate execution options and environment variables in spawned child processes, paving a path to arbitrary code execution.

Server-Side Template Injection: Evaluating untrusted user-defined templates using the Nunjucks engine allowed arbitrary server-side template injection and code execution, which required migrating to a sandboxed LiquidJS engine.