Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gcoinstash-cmd/nuclei
dev @ 34866ef
20
Fixes
0
CVEs
HIGH
Peak severity
73.7%
Coverage
Highlights
Path Traversal: 3 prior fixes. Scrutinize any change in this area.
pkg/catalog/loader/loader.go: most-fixed (2 issues). Treat as high-risk during review.
17 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Multiple fixes restrict Tengo script imports to an allowlist, but the same stdlib module map is used in workflow processing, and the allowlist may be bypassed by alternate import paths or when the sandbox flag is not set.
Path Traversal: Template extraction uses os.OpenFile and os.MkdirAll without canonical path checks, allowing zip-slip to write files outside the template directory. The fix adds path validation, but sibling extraction paths (e.g., in loaders) may still lack the same checks.
Signature Verification Bypass: Signature verification was bypassed by cache poisoning and by not requiring signatures for javascript templates. The fixes bind verification to content digest and require signatures, but other template types (e.g., workflow or self-contained) may not enforce the same signature requirement.