Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

google/osv-scalibr

              main @ 87a1418
            

Fixes

CVEs

HIGH

Peak severity

37.0%

Coverage

Highlights

Denial of Service: 9 prior fixes. Scrutinize any change in this area.

artifact/image/layerscanning/image/image.go: most-fixed (4 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Recurring arbitrary file write/read via archive entries and symlinks escaping extraction root; multiple independent fixes in different components indicate the pattern was missed repeatedly.

Denial of Service: Multiple decompression bombs, large archives, and missing size limits across many extractors; also hangs from locked databases and missing cancellation checks.

Supply Chain Compromise: Repository URL placeholder injection and missing malicious package detections allow dependency confusion or compromised dependencies to go undetected.