Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
filosottile/age
main @ 706dfc1
2
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Cryptographic Issues: 1 prior fix. Scrutinize any change in this area.
age.go: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Maliciously crafted plugin names can bypass path boundaries to execute arbitrary local binaries via system command execution. This requires strict character and path separator validation on any plugin identifier before executing external commands.
Cryptographic Issues: Inadequate ciphertext length validation allows multi-key partitioning oracle attacks against ChaCha20Poly1305, potentially leaking information about the file key. Enforcing expected recipient key sizes during decryption is critical to maintaining cryptographic guarantees.