Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
opensearch-project/opensearch-dashboards
main @ 79531d6
190
Fixes
0
CVEs
CRITICAL
Peak severity
43.5%
Coverage
Highlights
Auth Bypass: 49 prior fixes. Scrutinize any change in this area.
package.json: most-fixed (20 issues). Treat as high-risk during review.
77 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inadequate workspace validation checks during read, find, and fetch operations inside saved objects client wrappers allowed cross-workspace data access and privilege escalation. Sibling endpoints and empty arrays in filters bypass access controls.
SSRF: Connecting to custom data sources or utilizing proxy handler APIs without strict host allowlist validation exposes internal network ranges (such as metadata endpoints) to Server-Side Request Forgery (SSRF).
Prototype Pollution: Unsafe object traversal, recursive array manipulation in visualizers, and raw Lodash usage consistently allow prototype pollution, which can be leveraged for Denial of Service or downstream Remote Code Execution (RCE).