Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Countly/countly-server

              master @ 41250a3
            

214

Fixes

CVEs

CRITICAL

Peak severity

44.7%

Coverage

Highlights

Auth Bypass: 64 prior fixes. Scrutinize any change in this area.

api/utils/requestProcessor.js: most-fixed (17 issues). Treat as high-risk during review.

171 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple critical and high-severity fixes in the core request processing and authorization layer, including token permission escalation, missing existence checks, and endpoint restriction bypasses. These are the most security-sensitive components handling all API requests.

NoSQL Injection: Recurring acceptance of user-supplied MongoDB operators ($where, $expr, $function, $accumulator) across many endpoints, leading to code execution/DoS and data disclosure. Multiple fixes added stripUnsafeMongoOperators or parseUserQuery validation, but the pattern repeats across components.

Stored XSS: Widespread unescaped HTML rendering via v-html, innerHTML, and template interpolation of user-controlled data. Fixes range from HTML sanitization to replacing v-html with escaped interpolation, but the pattern recurs across many frontend components.