Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

primefaces/primeng

              master @ 8c0ce70
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Reflected XSS: 3 prior fixes. Scrutinize any change in this area.

components/dropdown/dropdown.ts: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: HTML label rendering in the Menu component bypassed security checks, allowing arbitrary script execution unless sanitization is properly applied.

Reflected XSS: The Message component rendered raw input via innerHTML without sanitization, necessitating a default-true 'escape' property to prevent exploitation.

Cross-Site Scripting (XSS): Binding dropdown labels directly to [innerHTML] exposed users to XSS, requiring a transition to safe Angular template interpolation.