Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nelmio/nelmioapidocbundle

              5.x @ d6c6f0f
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Prototype Pollution: 2 prior fixes. Scrutinize any change in this area.

public/swagger-ui/swagger-ui-bundle.js: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Prototype Pollution: Deep object merging and configuration parsing within ReDoc are susceptible to prototype pollution, which can lead to application instability or client-side execution control if malicious OpenAPI specifications are rendered.

Reflected XSS: Improper validation and sanitization of relative OpenAPI JSON paths allowed attackers to inject malicious payloads into the Swagger UI asset, leading to Reflected Cross-Site Scripting.

Open Redirect: Vulnerabilities in URL parsing and cookie serialization in Swagger UI permitted open redirects and potentially arbitrary script execution if unvalidated URLs were supplied to the layout engine.