Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

swc-project/swc

              main @ 0be5872
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

Privilege Escalation: 2 prior fixes. Scrutinize any change in this area.

Actions: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: Using unvalidated deserialization (`rkyv::from_bytes_unchecked`) allowed raw, untrusted AST bytes to trigger arbitrary code execution and memory safety violations during SWC plugin communications. Ensure safe, checked deserialization is consistently enforced.

Deserialization of Untrusted Data: Untrusted AST nodes deserialized with rkyv without bytecheck validation can trigger out-of-bounds memory corruption or arbitrary memory access under malicious inputs. Fully enabling validation features is critical to block these attacks.

Privilege Escalation: Misconfigured GitHub Actions workflows using high-privilege triggers like `pull_request_target` or `workflow_run` without strict privilege separation could allow external contributors to access secrets or compromise repository environments.