Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

simon-he95/markstream-vue

              main @ 8a4f73d
            

Fixes

CVEs

HIGH

Peak severity

29.6%

Coverage

Highlights

Cross-Site Scripting (XSS): 20 prior fixes. Scrutinize any change in this area.

packages/markdown-parser/src/htmlTags.ts: most-fixed (11 issues). Treat as high-risk during review.

25 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Attackers can bypass URL protocol validation using HTML entities, protocol-relative patterns, or unsafe resource-loading attributes (such as src, poster, and data) leading to javascript: execution. Proper input canonicalization and decoding must precede validation.

Cross-Site Scripting: Parsing interactive Mermaid diagrams into SVGs introduces script injection surfaces via interactive click bindings, foreignObject elements, htmlLabels, and script protocols in attributes. Strict SVG sanitization must be enabled by default.

Cross-Site Scripting (XSS): Raw HTML block parsing and rendering fallback logic lacked robust tag/attribute allowlisting, enabling filter bypasses via control character stripping and tag stack exploitation. Strict allowlists must replace exclusion lists.