Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

unashamedgeek/nuclei

              master @ 1010cca
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Sandbox Escape: 3 prior fixes. Scrutinize any change in this area.

v2/internal/runner/processor.go: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Tengo workflow scripts could import arbitrary stdlib modules, enabling code execution and network access. Two fixes progressively restricted the module map, but the guard is only on this processor path.

Sandbox Escape: Chrome headless was launched with --no-sandbox unconditionally, allowing sandbox escape. Fix restricted it to Linux root only, but other browser launch paths may still disable sandbox.

Insecure File Permissions: Debug data files created with 0777 permissions, exposing sensitive data. Fixed to 0644, but other output paths may still use permissive modes.