Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
immutable-js/immutable-js
main @ 50bf39e
2
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Prototype Pollution: 2 prior fixes. Scrutinize any change in this area.
src/functional/set.ts: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Prototype Pollution: Deep setting and copying utilities can be abused to inject properties into the global Object prototype if keys like `__proto__` or `constructor` are not properly ignored or rejected during path traversal and shallow copying.
Prototype Pollution: Core conversion and merge operations (`merge`, `toJS`, `toObject`) that translate complex nested structures back into native JavaScript objects are vulnerable to prototype pollution when raw, unvalidated keys are assigned directly to destination objects.