Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mjwwit/node-xmlhttprequest

              master @ 175c5ed
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Code Injection: 1 prior fix. Scrutinize any change in this area.

lib/XMLHttpRequest.js: most-fixed (4 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: Unescaped user input passed during synchronous request execution is passed to a spawned Node.js subprocess ('node -e'), leading to arbitrary remote command execution under the context of the running application.

SSRF: Insecure handling of HTTP redirects can permit attackers to pivot to non-web protocols, resulting in local file disclosure or SSRF when redirecting to unexpected local resources.

Improper Certificate Validation: A default-false configuration of the 'rejectUnauthorized' option in TLS handshakes allows Man-in-the-Middle (MitM) attackers to intercept or spoof encrypted communications.