Marius CiepluchandClaude Opus 5.5 ec3d1457fb fix(rules): Node vm is an eval sink; a package name is not a sink token ...

mongo-express CVE-2019-10758 passes the request body to vm.runInNewContext. No
injection sink named that call, so the flow was answered and missed. runInNewContext,
runInContext, runInThisContext and compileFunction are now CWE-95 sinks.

Once the file's questions completed, the fixed pin showed a second defect. Every call
on `require('mongodb-query-parser')` has that package name as its full name. The
bounded-token match treats `-` as a boundary, so the name matched the SQL sink
`query`. In a full name, `-` belongs to a package name, so it no longer separates
tokens.

Exploratory (retune after protocol-v1): mongo-express vulnerable pin now detected at
lib/bson.js:60.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

2026-09-25 11:47:15 +02:00

..

c.toml

feat(propose-adjudicate-prove): overlay adjudicates inventory before prove

2026-09-04 13:57:33 +02:00

java.toml

feat(model-grounded-detection): Java web sinks, and the post-closure-fix ceiling

2026-09-08 17:16:00 +02:00

javascript.toml

fix(rules): Node vm is an eval sink; a package name is not a sink token

2026-09-25 11:47:15 +02:00

php.toml

fix(scan): a hook callback's parameters are the registry's arguments, not the request's

2026-09-24 09:04:42 +02:00

python.toml

feat(model-grounded-detection): 4.1 guard dominance, 4.2 the missing sink facts

2026-09-08 14:45:12 +02:00