Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
aheckmann/mpath
master @ 2c9a79b
4
Fixes
2
CVEs
HIGH
Peak severity
Highlights
Prototype Pollution: 4 prior fixes. Scrutinize any change in this area.
lib/index.js: most-fixed (4 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Prototype Pollution: Attackers can bypass blocklists (such as __proto__) by passing structured array inputs or non-string/non-number path segments, allowing them to traverse and pollute the global Object.prototype via get, set, has, or unset methods.
Prototype Pollution: Direct access and modification of restricted properties like 'constructor', 'prototype', and '__proto__' through assignment or deletion operations allows arbitrary property injection across all object instances.