Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

microsoft/typescript

              main @ 7816ae6
            

Fixes

CVEs

HIGH

Peak severity

56.0%

Coverage

Highlights

Denial of Service: 24 prior fixes. Scrutinize any change in this area.

Compiler: most-fixed (7 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Arbitrary Code Execution: Insecure handling of local workspace plugins allowed untrusted project code to execute arbitrary payloads in the editor environment. The fix introduced the `allowLocalPluginLoads` flag to isolate plugin loading.

Arbitrary Code Execution: An insecure endpoint 'loadTypesMap' allowed remote configuration loading, which could lead to arbitrary code execution; it was mitigated by completely removing the vulnerable endpoint.

Denial of Service: Regular expression execution using backtracking patterns on complex, user-controlled paths caused polynomial-time worst-case execution (ReDoS), which was fixed by shifting to manual string scanners.