Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

php-embed/embed

              master @ d2e5d01
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Reflected XSS: 3 prior fixes. Scrutinize any change in this area.

src/Http/CurlDispatcher.php: most-fixed (3 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: User-provided invalid URLs are embedded directly into Exception messages, presenting a Reflected XSS risk if the exception text is rendered back to the user without sufficient output encoding.

Broken Cryptography: Insecure handling of TLS connections, such as reliance on stale root certificates and disabled or flawed peer validation, exposes outbound connections to Man-in-the-Middle (MitM) attacks.

HTTP Response Splitting: Insufficient validation of dynamic headers and multiline responses parsed by the cURL dispatcher allows attackers to inject malicious headers and split the HTTP response.