Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kurtmckee/feedparser

              main @ 19de310
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Cross-Site Scripting (XSS): 14 prior fixes. Scrutinize any change in this area.

feedparser/feedparser.py: most-fixed (12 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): The HTML parser has repeatedly suffered from sanitization bypasses, notably where nested SVG or MathML elements prematurely reset state flags, or where elements not matching SVG namespaces completely skipped sanitization. This allowed attackers to inject arbitrary executable HTML/JS tags.

XML External Entity (XXE): Parsing untrusted feeds without disabling external general entities allowed attackers to perform XXE injection. Furthermore, regex-based sanitization heuristics designed to strip DOCTYPE or ENTITY definitions were bypassed unless strictly anchored and focused on the document's header.

Cross-Site Scripting (XSS): Attackers bypassed sanitization by embedding javascript: and other dangerous URI schemes in relative and absolute URIs (such as xml:base and href attributes) because the sanitizer did not properly restrict resolved links to a safe scheme allowlist.