Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

marko-js/marko

              main @ e142eb1
            

Fixes

CVEs

HIGH

Peak severity

42.9%

Coverage

Highlights

Cross-Site Scripting (XSS): 3 prior fixes. Scrutinize any change in this area.

@marko/runtime-tags: most-fixed (1 issue). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Prototype Pollution: Attackers can exploit SSR deserialization processes to pollute the prototype chain by transmitting payload objects containing literal '__proto__' keys. If serializer properties are not converted to computed keys during generation, malicious payload state can hijack core object properties on the client or server.

Reflected XSS: Dynamic placeholders inside script, style, and HTML comment blocks are vulnerable to context escapes. Case-variant tags (e.g., closing tags using mixed casing) or unescaped comment markers can allow malicious inputs to break out of their containment contexts and execute arbitrary code.

Cross-Site Scripting (XSS): Failing to escape grave accents (backticks) and other literal interpolation syntax within compilation template outputs allows unescaped attacker-controlled values to break out of generated JavaScript template string contexts.