Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

iflytek/astron-agent

              main @ aaef2a2
            

Fixes

CVEs

CRITICAL

Peak severity

55.6%

Coverage

Highlights

Code Execution / Sandbox Escape: 2 prior fixes. Scrutinize any change in this area.

console/backend/commons: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass / Information Disclosure: Internal service boundaries lacked proper credential validation, allowing unauthorized cross-service access and information disclosure.

Code Execution / Sandbox Escape: Client-controlled sandbox credentials and missing internal API key allowed unsafe local code execution via debug/run endpoints.

Multiple (XSS, Auth Bypass, Sandbox Escape, SSRF): Broad multi-boundary failure: protocol sanitization, artifact upload auth, sandbox credential auth, and S3 policy isolation were all insufficient.