Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

unitech/pm2

              master @ ba62cae
            

Fixes

CVEs

HIGH

Peak severity

53.8%

Coverage

Highlights

Denial of Service: 7 prior fixes. Scrutinize any change in this area.

lib/tools/Config.js: most-fixed (3 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Execution of system commands via child_process.exec using unvalidated environment variables like SUDO_USER allowed arbitrary code execution. Future handlers must use parameterized execution (execFile) and enforce strict format constraints on the environment.

Denial of Service: The configuration parser utilizes highly inefficient regular expressions for splitting string values, causing CPU exhaustion (ReDoS), tracked publicly as CVE-2025-5891.

Prototype Pollution: Deep object assignment using unsanitized keys (e.g., splitKey) allowed attackers to inject properties into the global Object.prototype, compromising application integrity.