Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

fb55/htmlparser2

              master @ 36afdf6
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Cross-Site Scripting (XSS): 3 prior fixes. Scrutinize any change in this area.

src/Tokenizer.ts: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Inconsistent parsing of HTML comment boundaries (e.g., `--!>`) and tags ending with `/>` allows attackers to bypass sanitizers and inject executable scripts.

Cross-Site Scripting (XSS): Failure to treat RCDATA and raw-text elements like <textarea> as special tags leads to parsing nested tags as active HTML elements instead of literal plain text.

Reflected XSS: Incorrect entity decoding inside raw-text elements (such as <script> or <style>) allows entities to be parsed as executable HTML controls when they transition out of sequence.