Go to issue

Labels Milestones New Issue

0 Open 16 Closed

Label

Show archived labels Use alt + click/enter to exclude labels

All labels No label

?

?

?

??

??

??

????

????

????

????

Agent??

IPC??

LLM???

Milestone

All milestones No milestones

Project

All projects No project

Author

All users

Assignee

Assigned to nobody Assigned to anybody

metona thzxx

Sort

Newest Oldest Most recently updated Least recently updated Most commented Least commented Nearest due date Farthest due date

0 Open 16 Closed

Label

Clear labels

?

?

?

??

??

??

????

????

????

????

Agent??

IPC??

LLM???

Milestone

No milestone

Projects

Clear projects

Assignee

Clear assignees

metona

thzxx

[P1/高] BrowserWindowManager evaluate 执行任意 JS 无沙箱隔离 ???????????

#46

by thzxx was closed 2026-07-22 09:43:28 +08:00

1

[P1/高] FileEditorTool regex 模式存在 ReDoS 风险，可被恶意输入攻击 ???????????

#45

by thzxx was closed 2026-07-22 09:43:27 +08:00

1

[P1/高] ConfirmationDialog autoExecute 选项未做二次确认，误点击导致永久自动执行 ???????????

#40

by thzxx was closed 2026-07-22 09:43:20 +08:00

1

[P1/高] WindowManager sandbox: false 削弱渲染进程隔离 ???????????

#37

by thzxx was closed 2026-07-22 09:43:16 +08:00

1

[P1/高] CodeSearchTool ripgrep pattern 未转义，可注入命令行选项 ???????????

#22

by thzxx was closed 2026-07-22 09:42:56 +08:00

1

[P1/高] DeleteFileTool TOCTOU 竞态，存在检查与删除之间可被替换 ???????????

#20

by thzxx was closed 2026-07-22 09:42:53 +08:00

1

[P1/高] GitDiffTool pathspec 未校验工作空间内，可读取任意仓库差异 ???????????

#19

by thzxx was closed 2026-07-22 09:42:52 +08:00

1

[P1/高] PromptInjectionDefender 未检测 Unicode 同形字符与零宽字符 ???????Agent??

#16

by thzxx was closed 2026-07-22 09:42:48 +08:00

1

[P1/高] PromptInjectionDefender 单词边界缺失，关键词易被绕过 ???????Agent??

#15

by thzxx was closed 2026-07-22 09:42:47 +08:00

1

[P1/高] PolicyEngine JSON.stringify 后正则匹配易被绕过 ???????????

#14

by thzxx was closed 2026-07-22 09:42:45 +08:00

1

[P1/高] Sandbox scanCode 漏掉 require('fs') 和动态 import，可绕过沙箱 ???????????

#13

by thzxx was closed 2026-07-22 09:42:44 +08:00

1

[P0/严重] HttpRequestTool 未防御 SSRF，可访问内网与云元数据服务 ????????????

#10

by thzxx was closed 2026-07-22 09:24:46 +08:00

1

[P0/严重] RunCommandTool env 透传 process.env，子进程可读取所有 API keys ????????????

#9

by thzxx was closed 2026-07-22 09:24:44 +08:00

1

[P0/严重] RunCommandTool 仍使用 exec 而非 execFile，违反硬性约束 ????????????

#8

by thzxx was closed 2026-07-22 09:14:54 +08:00

1

[P0/严重] preload.ts contextBridge 失败时降级到 globalThis 赋值削弱渲染进程隔离 ????????IPC??

#7

by thzxx was closed 2026-07-22 09:14:52 +08:00

1

[P0/严重] MCPManager stdio 子进程命令注入风险 ????????????

#6

by thzxx was closed 2026-07-22 09:14:51 +08:00

1