Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

postmanlabs/postman-runtime

              develop @ 9c2d10d
            

Fixes

CVEs

HIGH

Peak severity

63.0%

Coverage

Highlights

Auth Bypass: 14 prior fixes. Scrutinize any change in this area.

lib/runner/extensions/event.command.js: most-fixed (8 issues). Treat as high-risk during review.

16 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The most frequently patched class; flaws span signature computation (body hash, header casing, empty params), parameter overwrite logic, state isolation, and reference handling across request flows.

Sandbox Escape / Event Hijacking: Multiple fixes address sandbox boundary integrity: event listeners were not scoped to execution IDs, and the VM allowed dynamic global tracking and eval. These are critical for isolating user scripts.

Information Disclosure: Sensitive data leakage via cookie jar sharing between iterations, unmasked secrets in scripts, and over-broad template data exposure in the visualiser.