Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apostrophecms/apostrophe

              main @ 68f1312
            

Fixes

CVEs

CRITICAL

Peak severity

17.2%

Coverage

Highlights

Auth Bypass: 42 prior fixes. Scrutinize any change in this area.

modules/@apostrophecms/permission/index.js: most-fixed (7 issues). Treat as high-risk during review.

51 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Consistent vulnerability where specific operations like deleting, archiving, or publishing documents bypassed permissions by mapping to the wrong permission keys or omitting fallback checks entirely.

Cross-Site Scripting (XSS): The sanitize-html core engine suffered multiple critical XSS bypasses involving unescaped raw-text tags (such as xmp, textarea, and option) and zero-padded numeric entities parsed via htmlparser2.

Stored XSS: Allowing unsanitized SVGs with embedded scripting or external xlink:href sources led to stored XSS inside the media library (tracked under CVE-2021-25978).