Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mockoon/mockoon
main @ df02ba3
13
Fixes
1
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Denial of Service: 8 prior fixes. Scrutinize any change in this area.
packages/commons-server/src/libs/server/server.ts: most-fixed (10 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Insecure Electron WebPreferences configurations previously allowed direct nodeIntegration without context isolation, enabling arbitrary code execution on the host machine via the renderer process. Developers must preserve contextBridge isolations.
Denial of Service: Infinite callback loops triggered by requests mimicking cyclic callback chains can cause mock servers to crash. These loops required the introduction of recursive depth tracking and limiting mechanisms.
Path Traversal: Loose prefix checking during file resolution and template rendering allowed attackers to escape base mock environment directories. Guard validations must canonicalize paths to prevent local file inclusion.