Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

C4illin/ConvertX

              main @ f444d84
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Security Misconfiguration: 4 prior fixes. Scrutinize any change in this area.

.github/workflows/bump-version.yml: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Arbitrary file write via convertTo parameter; fixed by rejecting path traversal characters, but other conversion paths may still be vulnerable.

Path Traversal: Arbitrary file write via unsanitized uploaded filenames; fix sanitizes names, but other upload endpoints or sub-loaders may miss this.

Path Traversal: Arbitrary file read via unsanitized filename; fix sanitizes before Bun.file, but download or history paths may still be exposed.