Skip to content

vulnscan-ai 0.4.2

Choose a tag to compare

View all tags
@btdt1983 btdt1983 released this 06 Jul 17:45
v0.4.2
7aa5c35

Structured file writes — config/drop-in fixes apply in-process again

Closes the gap the 0.4.1 no-shell hardening opened. A fix that creates or replaces a file (e.g. a systemd hardening drop-in) now carries the file path + content, and the transactional engine writes it safely without a shell — snapshot → write → validate → reload — with rollback that removes a created file or restores an overwritten one. Previously such a fix was honestly blocked and only worked via --export-script.

  • New write_files remediation field; the model is prompted to use it instead of a shell redirect. Sanitised (absolute path only) and stripped from package-CVE findings.
  • Write targets are screened (no /etc/shadow, /etc/passwd, /dev|/proc|/sys|/boot, directories).
  • fix --export-script/--export-ansible render the writes too (bash heredoc / Ansible copy-with-content); the exported rollback now removes a created file, matching the in-process engine.

+11 tests (227), integration suite green, bandit clean.

Upgrade

sudo dnf upgrade --refresh vulnscan-ai
Assets 5
Loading