Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

shardeum/validator-gui

              dev @ 870535f
            

Fixes

CVEs

CRITICAL

Peak severity

62.5%

Coverage

Highlights

Denial of Service: 4 prior fixes. Scrutinize any change in this area.

api/auth.ts: most-fixed (9 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Multiple critical command injection fixes demonstrate a recurring pattern of passing user-controlled input to shell execution (exec/execFile) without strict type and value validation. The login flow and node auto-restart setting are prime targets.

Auth Bypass: Three auth bypass fixes reveal that authentication was historically enforced client-side, JWT verification was disabled, and tokens were stored in non-httpOnly cookies. This indicates a weak server-side trust boundary.

Information Disclosure: Repeated cache-control fixes on dynamic JSON and client-side password hashing indicate sensitive data exposure via browser caching and plaintext credential transmission were persistent issues.