Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

analogjs/analog

              beta @ eac4529
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Stored XSS: 2 prior fixes. Scrutinize any change in this area.

packages/platform/src/lib/content/marked/marked-setup.service.ts: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Stored XSS: Mermaid code block content is directly interpolated into HTML without escaping, allowing stored XSS when rendered.

Stored XSS: Code block text and language names are interpolated into HTML without proper escaping or sanitization, enabling stored XSS via crafted content.