Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vuejs/core

              main @ 325eb1d
            

Fixes

CVEs

CRITICAL

Peak severity

20.0%

Coverage

Highlights

Cross-Site Scripting (XSS): 2 prior fixes. Scrutinize any change in this area.

.github/workflows: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Server-side rendering of classes and attribute strings can bypass standard client-side escaping mechanisms. If inputs are not explicitly and heavily encoded, malicious values can lead to direct XSS inside template rendering.

Prototype Pollution: Using plain object literals or non-null prototypes for key-value maps can allow malicious properties to traverse into the prototype chain, causing remote code execution or application crashes during option merging.

Sandbox Escape: Directly writing properties instead of using explicit attribute updates (like setAttribute) can prevent the browser from properly parsing the 'sandbox' attribute of dynamic iframes, disabling critical restriction policies.