Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

react/metro

              main @ 77d6054
            

Fixes

CVEs

CRITICAL

Peak severity

44.4%

Coverage

Highlights

Path Traversal: 4 prior fixes. Scrutinize any change in this area.

packages/metro/src/Assets.js: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Serving assets without validating requested paths against Metro's file map or restricting file extensions allows directory traversal, exposing sensitive files.

Command Injection: The Metro Development Server was vulnerable to unauthenticated remote command execution via exposed endpoints, allowing complete compromise of the developer environment.

Insecure Temporary File: Using shared system temporary directories with predictable names allows local cache poisoning or hijack. Appending UIDs or supporting configurable local project paths mitigates this.