Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

h4ckf0r0day/obscura

              main @ a1e09de
            

Fixes

CVEs

CRITICAL

Peak severity

40.6%

Coverage

Highlights

Denial of Service: 20 prior fixes. Scrutinize any change in this area.

crates/obscura-js/src/ops.rs: most-fixed (6 issues). Treat as high-risk during review.

31 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Multiple fixes address infinite loops and stack overflows from cyclic or deeply nested DOM structures, a recurring and easily triggered availability risk.

SSRF: The IP blocklist (is_forbidden_ip) was expanded multiple times to cover multicast, CGNAT, and special-purpose ranges, indicating an ongoing arms race against internal network access.

Arbitrary File Read: The file:// access gate was added to Page.navigate, but a sibling path (Target.createTarget) initially bypassed it, showing a pattern of incomplete gate coverage across CDP domains.