Security context

Highlights

CSV Injection: 3 prior fixes. Scrutinize any change in this area.

src/export.ts: most-fixed (3 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Command Injection: The project executed shell commands using untrusted inputs (such as branch names) inside Git interactions. While patched by moving from execSync to execFileSync, any future addition of shell execution paths introduces high risk of arbitrary command execution if input validation is bypassed.

Prototype Pollution: The session parser summarized attacker-influenced metadata using plain JavaScript objects, exposing the system to prototype pollution. The fixes utilized null-prototype objects, but any new parser maps or object-assignment structures must carefully avoid standard object prototypes.

Path Traversal: Relative path patterns could traverse directory boundaries when writing and reading cached entries. Although mitigated using hex-encoded format validation, file-handling operations in caching and credential subsystems remain prime targets for traversal attacks.