Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kismetwireless/kismet
master @ cfe4270
32
Fixes
0
CVEs
CRITICAL
Peak severity
86.4%
Coverage
Highlights
Auth Bypass: 8 prior fixes. Scrutinize any change in this area.
capture_framework.c: most-fixed (4 issues). Treat as high-risk during review.
20 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple distinct bypass paths were patched: empty-password checks, unauthenticated session creation via external processes, response-queueing challenge bypass, and a broad default-require-login migration. Each fix only closed one variant, so the session/auth surface remains a high-value target for new bypasses.
Use-After-Free: Four separate fixes all zero-initialize the same lwsci struct, indicating a recurring lifetime/initialization bug in WebSocket client connection handling. Any new code path that creates a capture framework WebSocket client without zeroing this struct is at risk.
Reflected XSS / Stored XSS: Multiple sanitization fixes in jQuery/UI code show that server JSON responses are routinely inserted into the DOM without encoding. The recurring pattern of sanitizeObject calls suggests many endpoints still return unsanitized data.