Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
vercel/eve
main @ 3012ae0
17
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Auth Bypass: 7 prior fixes. Scrutinize any change in this area.
packages/eve/src/execution/web-fetch/request.ts: most-fixed (2 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Forwarded principal identity was accepted without verifying the forwarder is trusted, allowing unauthorized identity assertion. The fix added a trustedForwarders predicate, but sibling paths (e.g., remote-agent-dispatch) may still propagate identity without this gate.
SSRF: web_fetch allowed arbitrary URLs, including internal destinations, and followed redirects without rechecking SSRF safety. Two fixes addressed this: one restricting to HTTPS/public destinations and blocking redirects, another rechecking each redirect. The redirect-following path remains a high-risk variant.
Credential Theft / SSRF: Remote client fetch sent ambient Vercel credentials without verifying the destination origin, and followed redirects, risking credential leakage to attacker-controlled hosts. The fix added origin verification and disabled redirects, but other fetch paths may still send credentials without these checks.