All issues

eos clean: build_dir from eos.yaml reaches system() past a denylist that omits the backtick

#172

· Kartikey1306 opened

on Sep 18, 2026

compute_cache_key() writes past its buffer: snprintf's return value is used as the next offset

#170

· Kartikey1306 opened

on Sep 18, 2026

Every workflow runs actions pinned to Node 20 majors; GitHub removes Node 20 from runners on 2026-09-23

#168

· Kartikey1306 opened

on Sep 17, 2026

Secure boot dereferences NULL paths before validation

#167

· srpatcha opened

on Sep 15, 2026

backends: five install lines end in `|| true`, so an install that copied nothing reports EOS_OK

#166

· Kartikey1306 opened

on Sep 15, 2026

OTA: eos_ota_download() and eos_ota_install() run attacker-controlled strings through system()

#164

· Kartikey1306 opened

on Sep 15, 2026

eos_pkg: the .eapp signature covers the binary only; capabilities, version and names are unsigned

#162

· Kartikey1306 opened

on Sep 14, 2026

eos_pkg: package_id and name go raw from the .eapp header into the install path (traversal, unterminated read, shell reach)

#161

· Kartikey1306 opened

on Sep 14, 2026

test_linux_security_paths: a failed mkdtemp() silently removes a security assertion from the run

#159

· Kartikey1306 opened

on Sep 14, 2026

GDB stub advertises a packet size its buffer cannot hold, and ends the session on the first refused packet

#157

· Kartikey1306 opened

on Sep 14, 2026

Build backends hand configuration values to system() unchecked, and run a truncated command

#155

· Kartikey1306 opened

on Sep 14, 2026

Linked issue policy grades closed and merged pull requests

#153

· Kartikey1306 opened

on Sep 14, 2026