Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
standard-things/esm
master @ 2d02f6d
24
Fixes
0
CVEs
HIGH
Peak severity
25.0%
Coverage
Highlights
Sandbox Escape: 15 prior fixes. Scrutinize any change in this area.
src/export-proxy.js: most-fixed (4 issues). Treat as high-risk during review.
20 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Exported proxies are vulnerable to sandbox breakout if native methods are lookup-cached insecurely, if toString properties leak raw functions, or if built-in methods are called with incompatible receivers. Isolating these pathways using WeakMaps and fallback receivers is critical.
Sandbox Escape: Unsafe resolution of dependencies via native Node.js loaders can permit sandbox escapes if untrusted code forces the loading of arbitrary or unprotected modules. Reversing this requires shifting to safe loader wrappers.
Prototype Pollution: Internal proxy handler objects can be manipulated by untrusted code, leading to prototype pollution or unauthorized property overrides. Freezing handlers and locking custom inspection symbols is required.