Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

microsoft/edit

              main @ 428ef55
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Denial of Service: 1 prior fix. Scrutinize any change in this area.

src/sys/windows.rs: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Injection: The text user interface component previously failed to sanitize newline characters from pasted clipboard content when running in single-line mode. This allowed multiline input injection into terminal fields, potentially leading to command or logical flow bypasses. Developers must enforce strict single-line sanitization rules on all terminal-based text input channels.

Denial of Service: A resource leak occurred during virtual memory cleanup on Windows platforms because the size parameter passed to VirtualFree was not set to 0 when using the MEM_RELEASE flag. This violates the Windows API contract and results in memory leaks that can lead to Denial of Service. Future system-level memory management code must adhere strictly to platform-specific API cleanup requirements.