Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

carbon-design-system/carbon-components-svelte

              master @ 32a412a
            

Fixes

CVEs

MEDIUM

Peak severity

100.0%

Coverage

Highlights

Cross-Origin Relation Leakage: 1 prior fix. Scrutinize any change in this area.

docs/src/components/Preview.svelte: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: An infinite loop can occur when evaluating interactive items in the OverflowMenu component if all items are disabled, resulting in browser tab freezing. Developers should ensure loop boundary conditions always terminate regardless of child component state.

Sandbox Escape: Unrestricted iframe elements in preview components can allow execution of untrusted scripts or form submissions that escape the intended context. Sandboxing attributes must be strictly declared on any rendering component.

Cross-Origin Relation Leakage: Failing to set 'noopener noreferrer' when anchor tags use target="_blank" exposes users to reverse tab-nabbing attacks where a destination site can manipulate the originating tab's window.opener context.