Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ckeditor/ckeditor4-releases

              master @ d270c2c
            

Fixes

CVEs

HIGH

Peak severity

80.0%

Coverage

Highlights

Reflected XSS: 4 prior fixes. Scrutinize any change in this area.

ckeditor.js: most-fixed (3 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Repeatedly fixed (3 times) for reflected XSS, indicating a hard-to-fully-fix issue in the GeSHi integration that accepts untrusted code snippet input.

Reflected XSS: Core HTML comment parsing allowed malformed comment injection leading to XSS, a fundamental parser weakness.

Reflected XSS: XSS via pasting crafted HTML into source mode and switching to WYSIWYG or previewing, involving multiple components (HTML processor, WebSpellChecker).