Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

laminas/laminas-form

              3.25.x @ e12336d
            

Fixes

CVEs

HIGH

Peak severity

54.5%

Coverage

Highlights

CSRF: 4 prior fixes. Scrutinize any change in this area.

src/Element/Csrf.php: most-fixed (3 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Request Forgery (CSRF): Misconfigured option precedence and improper timing of token regeneration or initialization during the form's preparation phase can weaken or bypass CSRF protections. Proper state management of session-based hashes is critical.

Cross-Site Scripting (XSS): Using generic HTML escaping rather than contextual attribute escaping inside view helpers, or failing to validate registered custom attribute prefixes, allows attackers to break out of HTML contexts and inject malicious scripts.

Auth Bypass: Multi-value input elements like Select, MultiCheckbox, and Radio can be exploited to submit arbitrary, unconfigured values if backend validators fail to unpack arrays or do not automatically register restrictive InArray validations.