Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pallets/werkzeug

              main @ 1b00618
            

Fixes

CVEs

CRITICAL

Peak severity

55.6%

Coverage

Highlights

Path Traversal: 4 prior fixes. Scrutinize any change in this area.

src/werkzeug/debug/__init__.py: most-fixed (4 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: The interactive developer console (evalex) and PIN-based debugger endpoints are highly sensitive; improper validation of HTTP Host headers allowed remote attackers to bypass local-access assumptions and execute arbitrary Python code.

Path Traversal: The `safe_join` utility has suffered from multiple implementation gaps on Windows platforms, where special device names (e.g., CON, PRN), trailing spaces, alternate extensions, and forward slashes on older Python versions bypassed prefix-based boundary checks.

Denial of Service: Bypasses in resource allocation limits permitted attackers to cause high memory usage by splitting large non-file form fields into multiple tiny chunks, circumventing normal memory size checks.