Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
primefaces/primereact
master @ 164f1ae
3
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Reverse Tabnabbing: 2 prior fixes. Scrutinize any change in this area.
components/lib/api/Locale.js: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Prototype Pollution: The locale management API permitted arbitrary property merging which could lead to prototype pollution via keys like __proto__ or prototype, risking denial of service or remote code execution depending on application context.
Reverse Tabnabbing: External links targeting _blank without rel="noopener noreferrer" allowed destination pages to access the window.opener object, creating a phishing or redirection risk.
Reverse Tabnabbing: External links within the main App wrapper were vulnerable to reverse tabnabbing, similar to the showcase pages, indicating a lack of standardized secure link components at the time.