Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
google/osv-scanner
main @ 78bc246
11
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Command Injection: 5 prior fixes. Scrutinize any change in this area.
go.mod: most-fixed (2 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Multiple fixes target the same sink family (fmt.Fprintf, PrintText) where untrusted package names, versions, paths, and image names are interpolated into GitHub Actions workflow commands. Sanitization of CR/LF and workflow-command metacharacters was added piecemeal across different output functions, indicating a systemic gap in a centralized output-safety layer.
Path Traversal: Two distinct path traversal vulnerabilities were fixed: one in the local database cache where untrusted ecosystem names could escape the cache directory via file operations, and another in zip extraction where malicious jar entries could write outside the target directory (zip-slip). Both require prefix/root confinement of file operations.
Dependency Vulnerability: Two high-severity dependency vulnerabilities were fixed by upgrading github.com/moby/buildkit and golang.org/x/crypto. The project relies on a broad dependency tree for container image scanning and cryptographic operations, making regular dependency updates critical.