Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vikejs/vike

              main @ 5f1c114
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Reflected XSS: 2 prior fixes. Scrutinize any change in this area.

packages/vike/node/runtime/html/serializeContext.ts: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Context serialization inside script tags can expose users to XSS if not explicitly escaped. Relying on `@brillout/json-serializer` with `htmlScriptSafe` ensures proper script and URL escaping.

Auth Bypass: A failure to execute configured route guards (`executeGuardHook`) on older or custom routing designs allows bypasses of access controls, meaning all routing workflows must strictly force guard resolution.

Reflected XSS: Using unescaped variables in template literal interpolation leads directly to Reflected XSS. Safe template engines must enforce automatic escaping of variable inputs by default.