Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jquery/jquery-ui
main @ 08b7044
4
Fixes
9
CVEs
HIGH
Peak severity
0.0%
Coverage
Highlights
DOM-based XSS: 1 prior fix. Scrutinize any change in this area.
tests/runner/createTestServer.js: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
DOM-based XSS: The Tabs widget previously performed insecure selector sanitization on URL fragments and element IDs, allowing attackers to execute malicious scripts in the context of the document. Modern mitigation requires using strict, native APIs like CSS.escape instead of custom regular expressions to isolate dynamic query selectors.
Prototype Pollution: The core widget factory was vulnerable to Prototype Pollution because it did not reject special properties like '__proto__' or 'constructor' during initialization and extension. Attackers could exploit this to inject properties into the global Object.prototype, potentially compromising application logic and downstream components.
Reflected XSS: The Checkboxradio widget re-evaluated previously escaped text labels as raw HTML during refresh cycles, leading to XSS (CVE-2022-31160). Developers must ensure that DOM updates preserve the text content representation rather than accidentally deserializing text into executable markup.