Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

spencermountain/compromise

              master @ f653c82
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Prototype Pollution: 1 prior fix. Scrutinize any change in this area.

src/methods/tokenization/ngram.js: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Prototype Pollution: Iteration and key assignment during n-gram calculation allowed modification of the global Object prototype when untrusted keys were processed without validation. developers should enforce checks like hasOwnProperty when iterating over keys.

Reflected XSS: Outputting unescaped properties dynamically into HTML templates allowed script injection. Implementing standard HTML escaping mechanisms on dynamic variables avoids context breaking.