Atuin Automated Vulnerability Discovery Engine

An application may be able to break out of its sandbox due to insufficient validation of symlinks (symbolic links, which are files that point to another file or directory).

An unauthenticated attacker can cause a denial-of-service condition by repeatedly initiating or canceling root token generation or rekey operations. This action occupies the single in-progress operation slot, which prevents legitimate operators from completing these specific workflows.

The Downloader integration does not completely validate file paths when combining them, which creates a directory traversal issue. This allows unauthorized access to files outside the intended directory.