Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

newrelic/newrelic-cli

              main @ 3966a2e
            

Fixes

CVEs

HIGH

Peak severity

62.5%

Coverage

Highlights

Information Disclosure: 2 prior fixes. Scrutinize any change in this area.

internal/install/execution/go_task_recipe_executor.go: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The recipe variable provider retrieves installation assets using URLs that could be manipulated. Inadequate validation can allow arbitrary host resolution or S3 bucket path traversal, leading to server-side request forgery or malicious file retrieval.

Command Injection: Execution of system migration commands without rigorous parameter validation permits command and flag injection via untrusted migration resource identifiers.

Information Disclosure: Interactive terminal prompts that fail to mask secret inputs can expose credentials and API keys to local observers or terminal scrollback logs.