Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ipfs/js-ipfs

              master @ bf1bc8b
            

Fixes

CVEs

HIGH

Peak severity

75.0%

Coverage

Highlights

CORS Misconfiguration: 2 prior fixes. Scrutinize any change in this area.

packages/ipfs-cli/src/commands/get.js: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CORS Misconfiguration: Misconfigured CORS origins on the HTTP RPC API server could allow arbitrary websites to access sensitive node commands, necessitating safe default-deny policies for cross-origin requests.

CSRF: Exposing HTTP endpoints to non-POST methods or weak origin validation allows cross-site request forgery attacks that can remotely control the IPFS daemon.

Path Traversal: During `ipfs get` execution, processing malicious IPFS DAG structures without strict canonical path checks can overwrite arbitrary host files.