Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
rails/execjs
master @ 7cd751f
4
Fixes
0
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Sandbox Escape: 2 prior fixes. Scrutinize any change in this area.
lib/execjs/external_runtime.rb: most-fixed (2 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Untrusted JavaScript executed in the Node.js runner can gain access to Node.js system APIs (like the global `process` object), allowing arbitrary system command execution. Defenses require deleting and shadowing global objects from the runner's execution context.
Command Injection: Passing runtimes or arguments as shell-escaped strings to `IO.popen` can lead to arbitrary shell injection. ExecJS mitigated this by switching to passing arguments as structured arrays to avoid shell parsing.
Insecure Temporary File: Standard Ruby `Tempfile.open` can be vulnerable to local race conditions and symlink attacks. Safe execution of external scripts requires creating temporary files with restrictive file permissions (0600) and using the `File::EXCL` flag.