Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ionic-team/ionic-framework

              main @ 1b18846
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Cross-Site Scripting (XSS): 3 prior fixes. Scrutinize any change in this area.

core/src/utils/sanitization/index.ts: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting: Bypasses in the central HTML sanitizer can lead to widespread XSS across all UI elements rendering user input. Attackers exploit DOM Clobbering, 'javascript:' URI schemes, and inline event handlers to execute arbitrary script.

Cross-Site Scripting (XSS): Direct assignment of untrusted component properties to innerHTML templates bypasses standard frameworks protections, rendering the core component pipeline vulnerable.

Prototype Pollution: An unconstrained key-merging mechanism in the bundled Swiper utility's extend function allows attackers to inject properties onto the global Object prototype, compromising application behavior.