Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

rainbow-me/rainbowkit

              main @ 03360ee
            

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

dependencies: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: The project is highly susceptible to critical upstream framework vulnerabilities in its core dependencies (React and Next.js) which can result in Remote Code Execution if left unpatched. Developers must continuously monitor and update transitive and direct framework dependencies.

Reflected XSS: Unsafe handling of wallet assets (such as Coolmode icon URLs) allowed malicious payload strings to escape into innerHTML. Relying on unsafe DOM insertion APIs can allow compromised external web3 provider profiles to execute arbitrary scripts in the application context.

Denial of Service: Upstream Next.js vulnerabilities (such as CVE-2025-55184 and CVE-2025-55183) present risks of service disruption or denial of service within the web application layer.