Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vuetifyjs/vuetify

              master @ 9a3ec28
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Cross-Site Scripting (XSS): 4 prior fixes. Scrutinize any change in this area.

packages/vuetify/src/components/VCalendar/mixins/calendar-with-events.ts: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): User-controlled event properties (such as event names) were directly bound to innerHTML, bypassing Vue's virtual DOM protections and allowing execution of arbitrary scripts.

Reflected XSS: Direct manipulation of 'el.innerHTML' within the tooltip directive allows untrusted attributes or dynamic contents to execute scripts inside the user's browser context.

Cross-Site Scripting (XSS): Rendering highlighted list items via raw innerHTML templates instead of safe virtual node trees creates standard injection vectors.