Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ensdomains/ens-metadata-service

              master @ 83b3bf6
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

SSRF: 2 prior fixes. Scrutinize any change in this area.

src/avatar.ts: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: User-controlled URLs fetched directly via abortableFetch/fetch without filtering; fix added ssrf-req-filter but redirect handling may be missing on these paths.

SSRF: Central fetch helper lacked SSRF protection; fix added filter with redirect handling, but any new caller bypassing this helper remains exposed.

XSS: SVG/HTML injected into srcdoc/buffer without sandboxing; fix added iframe sandbox and mimetype allowlist, but template sub-loaders may skip one check.