Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

drupal/core-utility

              11.x @ 152c5d9
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Cross-Site Scripting (XSS): 2 prior fixes. Scrutinize any change in this area.

Xss.php: most-fixed (3 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Attackers can bypass filter sanitization via malformed or nested HTML attributes due to loop state initialization bugs in the regex/state-machine parsing logic, leading to arbitrary JavaScript execution in the browser.

Cross-Site Scripting (XSS): Failure to block hazardous attributes capable of hosting nested active content (such as 'srcdoc' in iframe elements) within standard filtered output leads to trivial XSS vectors.