Use Reflect.apply instead of .call() in Promise handlers
fix: use Reflect.apply instead of .call() in Promise handlers (#549)
Use Reflect.apply instead of .call() in Promise handlers4b009c-fix-use-reflect-apply-instead-of-call-cve-2026-22709fixuse reflect apply instead call promise
Committed by patriksimek
commit message
fix: use Reflect.apply instead of .call() in Promise handlers (#549)
Replace unsafe `.call()` usage with `Reflect.apply` in globalPromise.prototype.then and globalPromise.prototype.catch to prevent potential interception via Function.prototype.call override.Editor assessment
This commit patches CVE-2026-22709. 'fix: use Reflect.apply instead of .call() in Promise handlers' is a precise, imperative subject, and the body supplies the why in one sentence: .call() on globalPromise.prototype.then and .catch could be intercepted through a Function.prototype.call override. That is enough for a small, surgical change, and the fix type is correct. What it lacks is a scope—bridge or promise would orient the reader—and any mention of a regression test or the #549 discussion beyond the subject reference. No advisory footer is present. Good, publishable example of explaining a security-relevant refactor without padding.