Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

flosch/pongo2

              master @ c0f8257
            

Fixes

CVEs

HIGH

Peak severity

25.0%

Coverage

Highlights

Reflected XSS: 2 prior fixes. Scrutinize any change in this area.

filters_builtin.go: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: The {% cycle %} tag failed to respect the autoescape context during rendering, writing unescaped user-controlled values directly to the output writer. Developers must ensure that all custom tag renderers explicitly check and apply HTML escaping based on the active autoescape state.

Reflected XSS: The json_script filter suffered from an XSS vulnerability due to insufficient escaping of the element ID attribute, allowing attackers to inject malicious HTML attributes or break out of the script tag context.

Cross-Site Scripting (XSS): A failure to restore the autoescape context via defer statements when execution errors occurred could result in subsequent template evaluations executing with autoescape unexpectedly disabled, exposing downstream contexts to XSS.