Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
facebook/react-native
main @ dfab628
44
Fixes
1
CVEs
HIGH
Peak severity
45.5%
Coverage
Highlights
Memory Safety: 9 prior fixes. Scrutinize any change in this area.
.circleci/config.yml: most-fixed (2 issues). Treat as high-risk during review.
19 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Safety: Use-after-free and data-race conditions frequently emerge from asynchronous callbacks capturing raw, deallocated pointers of destroyed delegates or native structures (e.g. SchedulerDelegate, ShadowNodeFamily, or CallbackWrapper).
Command Injection: Development and codegen scripts historically invoked child_process.execSync with unescaped shell parameters, creating high-severity command injection risks unless parameterized APIs like execFileSync are strictly enforced.
Insecure Defaults: Cross-origin XMLHttpRequests automatically attached user cookies by default. Forcing withCredentials to false as the default behavior is required to prevent unintended cross-origin credential exposure.