Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
vercel/workflow
main @ 56322af
33
Fixes
0
CVEs
CRITICAL
Peak severity
23.1%
Coverage
Highlights
Denial of Service: 5 prior fixes. Scrutinize any change in this area.
(package.json): most-fixed (4 issues). Treat as high-risk during review.
20 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape / Untrusted Code Execution: Multiple fixes show guest-controlled code (getters, proxies, custom serializers, patched prototypes) executing on the host during serialization, leading to full escapes; hardened intrinsics and host-side serde reduce this but variant paths remain.
Insecure Deserialization: Class resolution fell back to globalThis, enabling cross-context leakage and host code execution; this is a classic variant of the sandbox escape theme.
Denial of Service: Multiple fixes address memory leaks, runaway loops, oversized sparse arrays, and NUL/surrogate safety in the QuickJS VM, indicating a persistent DoS surface in serialization/deserialization.