Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

plotly/dash

              dev @ d7c99ec
            

Fixes

CVEs

HIGH

Peak severity

83.3%

Coverage

Highlights

CSRF: 2 prior fixes. Scrutinize any change in this area.

dash-renderer: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Client-side navigation vectors allow arbitrary script execution when handling malicious user input or incorrectly decoded HTML entities in URLs. Developers must ensure strict validation and sanitization of navigation properties before triggering location updates.

Arbitrary Component Modification: If the client-provided callback output specification is executed on the server without validation against the server-defined callback layout, attackers can manipulate component states arbitrarily. Strict matching between requested outputs and registered definitions is mandatory.

CSRF: Cross-Site Request Forgery (CSRF) on key update endpoints can allow attackers to perform state modification on behalf of users. Mitigations require mandatory SeaSurf CSRF tokens globally and restricting credential inclusion on cross-origin requests.