Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

angular/dev-infra

              main @ 6a54b1f
            

Fixes

CVEs

CRITICAL

Peak severity

38.7%

Coverage

Highlights

Command Injection: 11 prior fixes. Scrutinize any change in this area.

ng-dev/utils/git/git-client.ts: most-fixed (4 issues). Treat as high-risk during review.

30 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Multiple fixes across different components address shell injection via string concatenation, shell:true, and option injection. The pattern suggests a systemic issue with constructing shell commands from untrusted input.

Auth Bypass: PR merge validation has been repeatedly strengthened (minimum reviews, pending reviews, force-merge scope). The merge strategy fix pins head SHA to prevent merging unreviewed code, indicating a high-value target.

Path Traversal: Path traversal fixes span HTTP server, Bazel rules, and AI file writing, often involving prefix checks and canonicalization. The variety of sinks suggests a common need to validate paths against a trusted root.