Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
freedomofpress/securedrop-client
main @ 0af553b
39
Fixes
1
CVEs
CRITICAL
Peak severity
72.2%
Coverage
Highlights
Path Traversal: 10 prior fixes. Scrutinize any change in this area.
securedrop_client/crypto.py: most-fixed (4 issues). Treat as high-risk during review.
19 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Gzip extraction and filename parsing from untrusted sources are vulnerable to directory traversal, which could allow a compromised server to overwrite local files. This is demonstrated by several historical fixes and highlighted in CVE-2026-35465.
Sandbox Escape: As an Electron-based client, improper configuration of webPreferences and standard Node processes can allow renderer-to-host privilege escalation and unauthorized native execution.
Signature Bypass: Incomplete or fragile verification of GPG command-line stderr outputs can lead to signature or encryption status spoofing (such as the gpg.fail vector), tricking the client into accepting untrusted material.