Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

immerjs/immer

              main @ bf2d154
            

Fixes

CVEs

CRITICAL

Peak severity

20.0%

Coverage

Highlights

Prototype Pollution: 5 prior fixes. Scrutinize any change in this area.

src/proxy.js: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Prototype Pollution: The applyPatches functionality is highly susceptible to prototype pollution via untrusted JSON patches. Attackers have bypassed initial validations by exploiting type confusion (e.g., using array keys) and reserved keywords like __proto__, constructor, and prototype. Developers must ensure rigorous string coercion and keyword checks are enforced.

Prototype Pollution: Proxy property lookups that rely on the 'in' operator are vulnerable to traversing the prototype chain. Replacing 'in' with Object.hasOwnProperty checks prevents attackers from injecting properties through prototype pollution.

Sandbox Escape: Immer relies heavily on JavaScript Proxies to manage state mutations. Missing proxy traps (such as setPrototypeOf restriction) can allow users to break the draft boundaries and escape state containment.