Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

adobecom/milo

              stage @ fe6158c
            

Fixes

CVEs

HIGH

Peak severity

37.5%

Coverage

Highlights

Reflected XSS: 5 prior fixes. Scrutinize any change in this area.

libs/features/personalization/preview.js: most-fixed (3 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Repeatedly patched for unescaped user-controlled values (country cookie, userCountry, href) inserted into HTML, indicating a recurring gap in output encoding on this panel.

DOM XSS: Central sanitizer hardened twice for dangerous URL schemes and script/attribute stripping, but remains a high-value target for bypass via obfuscation or incomplete attribute allowlists.

Auth Bypass: Two fixes for the same sink (startJob with unfiltered urls) show a repeated failure to enforce per-URL authorization before publishing, a critical integrity control.