Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
dart-lang/sdk
main @ 197f002
152
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Memory Corruption: 24 prior fixes. Scrutinize any change in this area.
runtime/vm: most-fixed (11 issues). Treat as high-risk during review.
101 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Cross-Site Scripting (XSS): Recursive tree sanitization, browser-specific SVG element parsing (like foreignObject), and DOM Clobbering of sibling or attribute node links repeatedly bypassed the built-in TreeSanitizer. This allowed malicious HTML injections to execute script payloads under strict DOM execution paths.
Auth Bypass: The lack of rigid Host/Origin headers and token verification allowed unauthorized local or cross-origin entities to connect directly to administrative services (VM Service, DDS, and DTD) and execute arbitrary code or retrieve sensitive local files.
Memory Corruption: Compiler range analysis failures (such as incorrect Uint32 to Int32 narrowing or wrap-around calculations) led to unsound optimizations like the hoisting or complete elimination of crucial bounds checks (LICM), which resulted in arbitrary out-of-bounds heap reads and writes.