Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

react/create-react-app

              main @ 6254386
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Command Injection: 3 prior fixes. Scrutinize any change in this area.

packages/react-dev-utils/launchEditor.js: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Insecure handling of editor names on Windows environments allows arbitrary command execution. This component has required multiple fixes to enforce robust filename whitelisting to prevent shell injection via malicious editor execution paths.

Command Injection: Using synchronous shell command execution (execSync) with dynamic string concatenation allowed command injection during port lookup. This was mitigated by migrating to argument-safe execFileSync execution.