Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sveltia/sveltia-cms

              main @ d9bc9e1
            

Fixes

CVEs

HIGH

Peak severity

27.3%

Coverage

Highlights

Cross-Site Scripting (XSS): 2 prior fixes. Scrutinize any change in this area.

src/lib/components/assets/details/asset-details-overlay.svelte: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): HTML sanitization bypasses in rendered Markdown and rich-text blocks allow malicious actors to execute arbitrary scripts via embedded iframes or entity-encoded HTML tags. Ensure all Markdown outputs undergo comprehensive parsing and sanitization.

Cross-Origin Resource Sharing (CORS): Using wildcard targets ('*') in postMessage communications during the git provider OAuth process allowed untrusted origins to intercept sensitive authentication tokens. Broad wildcards must be strictly replaced with specific origin validations.

Credential Leakage: Sensitive authentication tokens and deployment headers could be leaked over unencrypted transport channels (HTTP) when triggering webhooks or fetching tokens. Enforcing secure contexts protects credentials from on-path interception.