Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

embabel/embabel-agent

              main @ c1a2087
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Path Traversal: 2 prior fixes. Scrutinize any change in this area.

embabel-agent-api/src/main/kotlin/com/embabel/agent/tools/file/FileWriteTools.kt: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Skill-script input file resolution was not confined to a root, allowing path traversal to read arbitrary host files. The fix introduces root confinement via resolveAndValidateFile, but sibling script execution paths may still lack this check.

Path Traversal: Zip extraction allowed entries to escape the target directory (Zip Slip). The fix adds canonicalization and prefix checking, but other archive-extraction or file-write utilities may not enforce the same validation.