Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
rectorphp/rector
main @ 7a96a27
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Command Injection: 1 prior fix. Scrutinize any change in this area.
Dockerfile: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: The `--config` option was concatenated directly into shell commands executing parallel processes. Attackers could manipulate config paths to execute arbitrary shell commands if the inputs are not properly sanitized with escapeshellarg.
Sandbox Escape: When running Rector in shared or public demo environments, inadequate isolation allows arbitrary PHP execution to access the underlying filesystem or spawn system processes. Mitigating this requires strict PHP INI containment such as open_basedir restrictions and disabling dangerous functions.