Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

getpelican/pelican

              main @ 3c69dc6
            

Fixes

CVEs

MEDIUM

Peak severity

33.3%

Coverage

Highlights

Cross-Site Scripting: 1 prior fix. Scrutinize any change in this area.

pelican/themes: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting: Unsanitized configuration variables like SITENAME rendered in theme templates can allow arbitrary HTML or script injection if configuration inputs are source-controlled or parsed from external plugins.

Denial of Service: Processing malformed or oversized HTML entities or numeric character references can trigger unhandled ValueError or OverflowError exceptions during integer conversion, crashing the generator build process.

Man-in-the-Middle: Hardcoded plaintext HTTP links for external scripts, styles, or assets in default themes allow network-level attackers to hijack and inject malicious code into the generated site.