Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

google/nsjail

              master @ f100fd9
            

Fixes

CVEs

HIGH

Peak severity

63.6%

Coverage

Highlights

SSRF: 3 prior fixes. Scrutinize any change in this area.

mnt_newapi.cc: most-fixed (2 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Multiple SSRF vulnerabilities in the nstun component allow forwarding traffic to loopback, multicast, or unspecified addresses, bypassing security rules. Fixes added address blocklists and allowlists, but the pattern indicates ongoing risk in network forwarding paths.

Path Traversal: Path traversal vulnerabilities in mount destination handling allow escape from the sandbox via symlink following and unsanitized paths. Fixes added O_NOFOLLOW and component validation, but the complexity of the mount API suggests residual risk.

Sandbox Escape: Sandbox escapes due to seccomp policy misconfiguration or incomplete installation. Fixes include combining policy strings, opening policy files per child, enabling architecture validation, and tightening default policies. The recurring nature indicates a need for robust policy management.