Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

damianszczepanik/cucumber-reporting

              master @ 97edc26
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Reflected XSS: 2 prior fixes. Scrutinize any change in this area.

jquery.min.js: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): User-supplied report embeddings can execute arbitrary JavaScript in the context of the report viewer if rendered raw. The fix isolates this content using a sandboxed iframe with the srcdoc attribute, but any alternate template paths bypassing this sandbox present a critical risk.

Reflected XSS: Older versions of jQuery bundled within the reporting resources contain known HTML-parsing vulnerabilities (such as CVE-2020-11022 and CVE-2020-11023) that can be abused to execute client-side scripts.