Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

phingofficial/phing

              main @ 502f7f5
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Command Injection: 3 prior fixes. Scrutinize any change in this area.

classes/phing/tasks/system/ExecTask.php: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Command execution parameters and redirection paths (stderr/stdout) are assembled into shell strings. Lack of escaping on these dynamic paths allows attackers to inject arbitrary shell commands during task execution.

Denial of Service: Reusing loop control variables (such as '$i') in nested loops causes infinite execution loops when processing tokens, exhausting server resources and causing system hangs.