Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
remotion-dev/remotion
main @ aa8cf57
22
Fixes
2
CVEs
CRITICAL
Peak severity
33.3%
Coverage
Highlights
Path Traversal: 6 prior fixes. Scrutinize any change in this area.
dependency: most-fixed (2 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Asset paths written to disk via fs.writeFileSync/createWriteStream were vulnerable to directory traversal; fix added canonicalization and prefix check, but sibling loaders may lack it.
Path Traversal: Studio write endpoints lacked symlink checks and extension allowlist, enabling arbitrary file writes; hardening added multiple guards that may not be replicated in all routes.
Path Traversal: Site name validation was insufficient to prevent path traversal when deploying to S3; anchored regex and dot-segment rejection were added, but the cloudrun twin was fixed separately.