Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
typestack/class-validator
develop @ 2e1a5c2
4
Fixes
0
CVEs
HIGH
Peak severity
75.0%
Coverage
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
ValidationExecutor: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Validation can be entirely bypassed if validator options are undefined because 'forbidUnknownValues' historically defaulted to false, allowing unmapped or plain objects to pass through validation undetected.
Signature Verification Bypass: Using 'instanceof Array' for type-checking is unreliable across different execution realms (such as iframes or VM contexts), which can allow arrays to bypass array-specific validation constraints.
Input Validation: The '@IsOptional' decorator permitted empty strings to bypass further property validation, creating potential validation gaps for required fields.