Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

getsentry/sentry-javascript

              develop @ b31ef48
            

Fixes

CVEs

HIGH

Peak severity

59.1%

Coverage

Highlights

Information Disclosure: 12 prior fixes. Scrutinize any change in this area.

packages/core/src/utils/request.ts: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Direct inline interpolation of untrusted GitHub event inputs in shell commands allows attackers to execute arbitrary shell payloads. Fixes implemented mapping of context properties to intermediate environment variables.

Information Disclosure: Telemetry collection processes frequently capture and forward sensitive data such as database mutations, authentication cookies, and client IPs unless explicitly gated by configuration rules.

SSRF: Arbitrary HTTP request forwarding occurs when Sentry tunnel endpoints fail to strictly validate the destination DSN hostnames or destination routes against an allowlist.