Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

react-native-community/cli

              main @ 9013a48
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Command Injection: 1 prior fix. Scrutinize any change in this area.

packages/cli-server-api/src/openURLMiddleware.ts: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Insufficent sanitization of user-supplied URLs allowed attackers to execute arbitrary code or commands when passing URLs to the system browser opener. Developers must apply strict sanitization on all middleware parameters before execution.

Command Injection: Allowing non-standard protocol schemes to be processed by the open utility enabled local file execution or command execution. Strict protocol validation is required to restrict actions to benign web schemes.

Insecure Defaults: Hardcoding a public registry URL instead of querying the user's environment configuration risks exposing internal package lookups to external networks. Always resolve registries against the user-defined npm registry.