Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pylint-dev/pylint

              main @ b44f86a
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

Command Injection: 1 prior fix. Scrutinize any change in this area.

.github/workflows/*.yml: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Attacker-influenced values were interpolated directly into shell commands (git pull, pip install, towncrier check), allowing arbitrary command execution in CI.

Credential Leak: actions/checkout with default persist-credentials:true could write GITHUB_TOKEN into .git/config, risking token exfiltration from the repository.

ReDoS: Two regex patterns in pyreverse allowed catastrophic backtracking, enabling denial-of-service via crafted input.