Skip to content

Warden weekly sweep #495

Description

@github-actions

Warden Scheduled Scan Results

Run: 2026-08-10T06:40:41.308Z
Commit: e6ef59b

Summary

Severity Count
High 1
Medium 3

Findings

scripts/bundle-axe.sh

  • PL7-3LA Predictable temporary directory enables symlink attack (L12) · high
    The temporary download path is constructed with a predictable PID suffix under /tmp, allowing a local attacker to redirect extraction into an arbitrary directory via a symlink race.

scripts/probe-xcode-mcpbridge.ts

  • NBL-KWJ MCP transport leaks if listTools or request throws (L57-L81) · medium
    If client.listTools or client.request rejects, the call to client.close() is skipped and the xcrun mcpbridge child process may remain alive until the parent exits.

scripts/release.sh

  • T8B-BR9 bump_version crashes on tags with leading-zero version components (L47-L62) · medium
    Bash arithmetic expansion treats leading zeros as octal, so parsed version components like 08 cause value too great for base errors and abort the script.

src/benchmarks/claude-ui/mcp-config.ts

  • N98-3Q3 Session default paths can escape working directory via relative path traversal (L47) · medium
    Relative paths containing ../ sequences are resolved with path.resolve without validation that the result stays within the working directory, allowing path escape despite the function's isolation intent.

Generated by Warden

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions