# Risk map — microsoft/rushstack

> Canonical page: https://codevetter.com/unpack/rushstack/risk-map

# Risk map — microsoft/rushstack

Scanned commit 1e18b16f029299f53a966878aff2ce187dd65a51 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include generated-output deletion, request-derived filesystem access, installed-code execution, browser launch/install behavior, and daemon ownership. Native and hosted execution share orchestration code but differ in lifecycle capabilities. The reviewed sources also reveal dependency coupling that merits focused regression checks when changed.
- Documenter accepts an arbitrary --output-folder and MarkdownDocumenter.generateFiles calls ensureEmptyFolder on it before writing pages; a wrongly selected output path therefore has a concrete deletion blast radius. — [apps/api-documenter/src/cli/BaseAction.ts#L44-51](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/api-documenter/src/cli/BaseAction.ts#L44-L51) [apps/api-documenter/src/cli/BaseAction.ts#L63-64](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/api-documenter/src/cli/BaseAction.ts#L63-L64) [apps/api-documenter/src/documenters/MarkdownDocumenter.ts#L112-115](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/api-documenter/src/documenters/MarkdownDocumenter.ts#L112-L115) [apps/api-documenter/src/documenters/MarkdownDocumenter.ts#L1305-1307](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/api-documenter/src/documenters/MarkdownDocumenter.ts#L1305-L1307)
- Explorer installs unrestricted cors() and calls app.listen(PORT) without a host argument; its registered graph and file-reading routes contain no authentication checks in the inspected parser. — [apps/lockfile-explorer/src/cli/explorer/ExplorerCommandLineParser.ts#L118-120](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/lockfile-explorer/src/cli/explorer/ExplorerCommandLineParser.ts#L118-L120) [apps/lockfile-explorer/src/cli/explorer/ExplorerCommandLineParser.ts#L165-195](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/lockfile-explorer/src/cli/explorer/ExplorerCommandLineParser.ts#L165-L195) [apps/lockfile-explorer/src/cli/explorer/ExplorerCommandLineParser.ts#L255-258](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/lockfile-explorer/src/cli/explorer/ExplorerCommandLineParser.ts#L255-L258)
- Hypothesis: Explorer’s package-json/package-spec endpoints may permit reads outside projectRoot through traversal because they interpolate request.body.projectPath without a containment check in these handlers; exploitability was not tested. (inferred) — [apps/lockfile-explorer/src/cli/explorer/ExplorerCommandLineParser.ts#L175-194](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/lockfile-explorer/src/cli/explorer/ExplorerCommandLineParser.ts#L175-L194) [apps/lockfile-explorer/src/cli/explorer/ExplorerCommandLineParser.ts#L221-228](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/lockfile-explorer/src/cli/explorer/ExplorerCommandLineParser.ts#L221-L228)
- Explorer’s pnpmfile worker uses require(resolvedPath) and invokes hooks.readPackage; Documenter similarly requires resolved plugin entrypoints. Both execute workspace/installed JavaScript rather than merely parsing configuration. — [apps/lockfile-explorer/src/graph/pnpmfileRunnerWorkerThread.ts#L36-45](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/lockfile-explorer/src/graph/pnpmfileRunnerWorkerThread.ts#L36-L45) [apps/lockfile-explorer/src/graph/pnpmfileRunnerWorkerThread.ts#L67-89](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/lockfile-explorer/src/graph/pnpmfileRunnerWorkerThread.ts#L67-L89) [apps/api-documenter/src/plugin/PluginLoader.ts#L28-39](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/api-documenter/src/plugin/PluginLoader.ts#L28-L39)
- Daemon startup protects its POSIX runtime boundary by creating mode-0700 directories, verifying ownership and non-symlink identity, and checking socket-path length before binding; listener ownership is checked before socket/lockfile publication. — [libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts#L10-18](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts#L10-L18) [libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts#L25-58](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/libraries/rush-daemon-transport/src/DaemonRuntimeDir.ts#L25-L58) [libraries/rush-daemon-transport/src/DaemonListener.ts#L48-67](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/libraries/rush-daemon-transport/src/DaemonListener.ts#L48-L67)
- Browser tunneling filters launch options through a per-user allowlist but also installs/imports handshake-selected Playwright versions; inspected handshake validation checks the version’s type, action, and browser name without semantic-version validation in that function. — [apps/playwright-browser-tunnel/src/LaunchOptionsValidator.ts#L146-188](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/playwright-browser-tunnel/src/LaunchOptionsValidator.ts#L146-L188) [apps/playwright-browser-tunnel/src/PlaywrightBrowserTunnel.ts#L229-249](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/playwright-browser-tunnel/src/PlaywrightBrowserTunnel.ts#L229-L249) [apps/playwright-browser-tunnel/src/PlaywrightBrowserTunnel.ts#L350-351](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/playwright-browser-tunnel/src/PlaywrightBrowserTunnel.ts#L350-L351) [apps/playwright-browser-tunnel/src/PlaywrightBrowserTunnel.ts#L412-445](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/apps/playwright-browser-tunnel/src/PlaywrightBrowserTunnel.ts#L412-L445)
- Webpack localization replaces GetChunkFilenameRuntimeModule.prototype.generate to capture chunk identity and relies on assetPath callback conventions; hypothesis: Webpack runtime changes or interactions with other prototype wrappers can affect this integration. (inferred) — [webpack/webpack5-localization-plugin/src/LocalizationPlugin.ts#L173-195](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/webpack/webpack5-localization-plugin/src/LocalizationPlugin.ts#L173-L195) [webpack/webpack5-localization-plugin/src/LocalizationPlugin.ts#L225-244](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/webpack/webpack5-localization-plugin/src/LocalizationPlugin.ts#L225-L244)
- Native phased-command output closure stops new operations but lets started operations finish because native commands do not own their process groups; hosted-engine graph options separately enable termination support and alter runner closure. — [libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts#L1120-1125](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts#L1120-L1125) [libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts#L1278-1282](https://github.com/microsoft/rushstack/blob/1e18b16f029299f53a966878aff2ce187dd65a51/libraries/rush-lib/src/cli/scriptActions/PhasedScriptAction.ts#L1278-L1282)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)