Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wix/detox

              master @ d80a574
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Code Injection: 2 prior fixes. Scrutinize any change in this area.

detox/src/ipc/SessionState.js: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: The use of global eval to revive serialized function properties within SessionState posed a major code injection vector. While mitigated using vm.runInContext, handling untrusted deserialized functions in IPC payloads remains a highly sensitive operation.

Command Injection: Unescaped adb device serial parameters passed directly to shell execution commands allowed attackers to execute arbitrary system commands via adbCmd utilities.

Remote Code Execution: The project relied on the vulnerable child-process-promise package (susceptible to CVE-2024-21538), which exposed execution wrappers to remote code execution risks.