Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

holoviz/panel

              main @ b4ddd08
            

Fixes

CVEs

HIGH

Peak severity

28.6%

Coverage

Highlights

Denial of Service: 3 prior fixes. Scrutinize any change in this area.

panel/auth.py: most-fixed (4 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting: Insecure handling of dynamic error messages during template rendering allowed execution of arbitrary script in the user's browser session. Developers must ensure HTML sanitizers are consistently applied to all user-controlled variables.

Cross-Site Scripting: Insecure replacement operations on JavaScript-style format strings allowed template injection when converting Python scripts to HTML. Proper output escaping must be enforced in conversion engines.

Denial of Service: Binary image parsers were susceptible to infinite loops and index-out-of-bounds crashes when handling malformed headers. Robust bounds checks and structure validation are vital before decoding raw files.