Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
facebook/react-native
main @ 1101ef6
58
Fixes
1
CVEs
HIGH
Peak severity
51.4%
Coverage
Highlights
Memory Corruption: 10 prior fixes. Scrutinize any change in this area.
ReactAndroid: most-fixed (3 issues). Treat as high-risk during review.
28 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Safety: Unsafe raw pointers and improper lifetime management of stack-allocated Objective-C blocks in asynchronous TurboModule calls lead to Use-After-Free (UAF) and runtime heap corruption. This requires replacing manual block guards with robust wrapping abstractions like AsyncCallback.
Command Injection: The use of child_process.execSync with unquoted or unescaped arguments during artifact generation exposes the build environment to command injection. Mitigations require avoiding shell execution by migrating to execFileSync.
Memory Corruption: Using unsafe static_cast to downcast generic shadow nodes or props to specialized layout types causes memory corruption when processing non-layoutable child nodes or distinct properties. Type-safe checks (e.g. dynamic_cast or traitCast filtering) are required to validate underlying types before casting.