Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
Skyscanner/backpack-android
main @ fdbf9c7
2
Fixes
0
CVEs
HIGH
Peak severity
100.0%
Coverage
Highlights
Command Injection: 1 prior fix. Scrutinize any change in this area.
gulpfile.js: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: The project relied on an outdated version of shelljs, which can lead to command injection vulnerabilities if untrusted input is processed during script execution. Upgrading and pinning secure versions of terminal utility wrappers is critical to avoid build-time system compromise.
XML External Entity (XXE): Using insecure versions of the xmldom parser inside development and build tasks like gulpfile.js exposes the build pipeline to XML External Entity (XXE) attacks, which could facilitate local file disclosure or server-side request forgery during build execution.