Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

SeleniumHQ/selenium

              trunk @ 5d90b1d
            

Fixes

CVEs

CRITICAL

Peak severity

44.1%

Coverage

Highlights

Authentication Bypass: 7 prior fixes. Scrutinize any change in this area.

rb/selenium-webdriver.gemspec: most-fixed (5 issues). Treat as high-risk during review.

37 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authentication Bypass: Multiple fixes across grid components address missing or weak registration secret enforcement, including a non-constant-time comparison and a missing secret in Hub. This is the highest-volume recurring risk, indicating a systemic gap in secret propagation and validation.

Path Traversal: Multiple fixes address zip-slip and tar/pkg traversal in different languages and components, indicating a recurring failure to sanitize archive entry names before writing files.

Arbitrary Code Execution: Multiple dependency upgrades were needed to fix code execution vulnerabilities in documentation generation and JavaScript engines, indicating a need for continuous dependency scanning and updates.