Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

masterminds/html5-php

              master @ fd5018f
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Cross-Site Scripting (XSS): 3 prior fixes. Scrutinize any change in this area.

src/HTML5/Parser/Tokenizer.php: most-fixed (3 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Inconsistent tokenization of the comment end bang state (`--!>`) can allow attackers to craft payloads that are treated as comments by this parser but executed as raw markup by web browsers, resulting in mXSS.

XSS: Allowing duplicate attributes to overwrite previously parsed values enables attackers to bypass downstream HTML sanitizers that only inspect the first attribute instance.

Cross-Site Scripting (XSS): Incorrect handling of unconsumed characters during entity parsing with missing semicolons can lead to discrepancies in attribute or element parsing, allowing bypasses.