Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

winglang/wing

              main @ 8fb4c79
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

(.github/workflows/wingsdk-mutation.yml): most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The build pipeline previously utilized 'pull_request_target' triggers, which allowed untrusted pull requests from forks to execute with write permissions or access repository secrets. Switching to 'pull_request' remediates this but requires continued vigilance against pipeline modification.

Sandbox Escape: The local Wing simulator runtime executed inflight functions using a custom JS sandboxing pattern that failed to properly restrict the 'require' statement, allowing simulated code to break containment. Moving to vm2 mitigated the issue, but simulator execution remains a critical surface for local code execution.

Command Injection: Untrusted workflow context elements, specifically the branch head reference from pull requests, were directly evaluated in shell execution templates. This allowed arbitrary command injection inside runner containers. Using environment variables is required to safely pass untrusted contexts.