Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

microcosm-cc/bluemonday

              main @ aba082a
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Cross-Site Scripting (XSS): 11 prior fixes. Scrutinize any change in this area.

sanitize.go: most-fixed (18 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting: Bypasses in element and tag-name normalization allow structured markup (like select/option or mixed-case script tags) to skip sanitization logic entirely, leading to arbitrary script injection. This is highlighted by CVE-2021-42576 and CVE-2021-29272.

Cross-Site Scripting (XSS): Flaws in nested state tracking, element-depth counting, and closing-tag state clearance allow attackers to prematurely terminate the parser's skipped-content state or generate unbalanced tags, rendering raw payloads to the output buffer.

Cross-Site Scripting (XSS): Improperly sanitized, unescaped, or raw attribute values (such as 'href' or 'data-' properties) written to the output buffer allow attackers to escape attribute contexts and inject malicious payloads.