Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

azure/azure-sdk-for-js

              main @ 0a8e122
            

Fixes

CVEs

CRITICAL

Peak severity

41.2%

Coverage

Highlights

Denial of Service: 20 prior fixes. Scrutinize any change in this area.

@typespec/ts-http-runtime: most-fixed (4 issues). Treat as high-risk during review.

25 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: String interpolation into shell commands executed via child_process.exec allows arbitrary command injection. Safe patterns require childProcess.execFile or strict regex validation of inputs.

Auth Bypass: Miscalculations or lack of canonicalization of endpoints and multi-tenant parameters can trigger incorrect token acquisition or target incorrect domains altogether.

Information Disclosure: Telemetry clients following unvalidated 307/308 redirects can leak sensitive Active Directory (AAD) bearer tokens to untrusted third-party domains.