Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mathisonian/command-exists

              master @ 742a73d
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Command Injection: 3 prior fixes. Scrutinize any change in this area.

lib/command-exists.js: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: User-supplied command names containing shell metacharacters are executed via child_process helpers on both Windows and Unix platforms, leading to arbitrary system command execution. Historically, these entry points lacked rigid validation and sanitization, allowing attackers to escape the intended command context.