🟡 [MEDIUM] CB-015: Error Messages Leak Internal State #24

New issue

Open

opened 2026-02-20 08:50:04 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:04 +00:00

Security Finding from Audit

Parent issue: #1

Severity

MEDIUM 🟡

CVSS Score

N/A

CWE

CWE-209 (Information Exposure Through Error Message)

Location

Multiple files

Description

Error messages throughout the codebase use f"Error: {e}" patterns that expose internal paths, stack traces, library versions, and configuration details to the LLM (and potentially back to the user).

Example in agent.py line 215: return f"Error: {e}" returns the LLM error (which may contain API responses) directly to the user.

Recommendation

Return generic error messages to users. Log detailed errors internally with a correlation ID.

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-015

## Security Finding from Audit > Parent issue: #1 ### Severity **MEDIUM** 🟡 ### CVSS Score N/A ### CWE CWE-209 (Information Exposure Through Error Message) ### Location `Multiple files` --- ### Description Error messages throughout the codebase use `f"Error: {e}"` patterns that expose internal paths, stack traces, library versions, and configuration details to the LLM (and potentially back to the user). Example in `agent.py` line 215: `return f"Error: {e}"` returns the LLM error (which may contain API responses) directly to the user. --- ### Recommendation Return generic error messages to users. Log detailed errors internally with a correlation ID. --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-015*