Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
stenciljs/core
main @ f6d6f8c
5
Fixes
13
CVEs
CRITICAL
Peak severity
75.0%
Coverage
Highlights
CSP Bypass: 1 prior fix. Scrutinize any change in this area.
CI/CD: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Using Node's vm module without secure, isolated contexts can allow arbitrary code execution in the parent process during server-side rendering or build processes.
Cross-Site Scripting (XSS): Using innerHTML during lazy bootstrapping of components can facilitate script injection if inputs are not properly sanitized or converted to textContent.
CSP Bypass: Generating inline scripts during compilation without checking opt-in controls can break downstream application Content Security Policies.