Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tencent/hippy

              main @ d7ca456
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Code Injection: 1 prior fix. Scrutinize any change in this area.

GitHub: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: Using inline interpolation of untrusted issue metadata within automated scripts (such as actions/github-script) allowed arbitrary code execution. Future workflows must strictly use environment variables to handle untrusted user inputs.

RCE: Self-hosted runners and privileged workflows were exposed to unauthorized RCE via untrusted PR changes triggering build scripts. Strict validation and validation allowlists on incoming files are required before running automated commands like './gradlew'.

Memory Corruption: A use-after-free vulnerability existed in the bridge between JavaScript and Objective-C where callbacks used unsafe pointers. Correct retention and destruction patterns (e.g., CFBridgingRetain/CFRelease) must be strictly enforced on bridged Objective-C objects.