Security context

Highlights

CSS Injection: 1 prior fix. Scrutinize any change in this area.

src/_boot.js: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Command Injection: Child processes spawned by the application previously inherited the entire ambient environment, allowing attackers who could manipulate environment variables (e.g., via malicious configurations or upstream contexts) to execute arbitrary commands using shell-env. This is particularly critical given the application's nature as a terminal emulator.

CSS Injection: Injecting unsanitized theme configuration parameters directly into the document's head element created a vector for CSS injection and potential secondary execution. Output sanitization of theme parameters is required to prevent rendering context escapes.

Reflected XSS: Unescaped network details (such as IP addresses) were directly assigned to innerHTML inside the netstat UI component, introducing cross-site scripting risks if network state data could be spoofed or manipulated.