Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

winezer0/nuclei

              dev @ f6abdcf
            

Fixes

CVEs

CRITICAL

Peak severity

43.8%

Coverage

Highlights

Sandbox Escape: 5 prior fixes. Scrutinize any change in this area.

pkg/catalog/loader/loader.go: most-fixed (4 issues). Treat as high-risk during review.

27 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Execution: Multiple fixes address unsigned or unverified code templates executing arbitrary code, including cache poisoning and DAST path bypasses. This is the highest-risk area due to direct RCE potential.

: Critical fix centralizes signature extraction and requires signature at end of template, preventing crafted templates from passing verification and executing malicious code.

: Tengo script imports were initially set to all modules, allowing arbitrary module access and command execution. Fixed with a safe allowlist, but this is a high-risk surface for workflow execution.