Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

terser/html-minifier-terser

              master @ 777b065
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Cross-Site Scripting (XSS): 3 prior fixes. Scrutinize any change in this area.

src/htmlminifier.js: most-fixed (5 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Aggressive optimization rules that remove or strip attribute quotes (e.g., when trailing slashes are present) can allow malicious payloads to break out of attribute boundaries. Developers must ensure validation logic in these utilities remains robust against arbitrary user-controlled input.

Cross-Site Scripting (XSS): Improper escaping of nested quotes and event handlers during the parsing and output serialization phases permits arbitrary HTML/JS injection. Standardized, context-aware encoding sinks must be consistently applied across both the parser and the main minifier.

Prototype Pollution: User-controlled class or attribute names parsed during tokenization can overwrite or pollute the base object prototype if the storage mechanism does not isolate keys (e.g., by prefixing or using null-prototype objects).