Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

microsoft/rushstack

              main @ 58f2846
            

Fixes

CVEs

HIGH

Peak severity

40.0%

Coverage

Highlights

Command Injection: 5 prior fixes. Scrutinize any change in this area.

(RushXCommandLine): most-fixed (1 issue). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Running scripts or commands through CLI interfaces via child_process.spawn with deprecated 'shell: true' configurations allows users to bypass argument structures and execute arbitrary shell commands. Avoid implicit shell execution and pass arguments as discrete arrays.

Command Injection: Insufficient validation and parameter quoting of arguments passed to rushx allowed command line parameters to break out of context. Proper implementation of parameter escaping is mandatory when executing user-influenced arguments.

Command Injection: Windows shell execution is notoriously fragile when handling paths with spaces and special shell characters. When spawning commands on Windows, explicit escaping must be implemented to prevent path parsing vulnerabilities.