Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

iib0011/omni-tools

              main @ 89a50e3
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

XML Injection: 2 prior fixes. Scrutinize any change in this area.

src/components/result/ToolDiffResult.tsx: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

DOM-based XSS: Rendering user-controlled diff content via dangerouslySetInnerHTML without sanitization allows script execution in the user's browser context.

XML Injection: Cell values are inserted directly into XML element content without escaping, allowing injection of markup or special characters that corrupt the XML structure.

XML Injection: JSON keys are used to form XML tag names without sanitization, and deep nesting can cause resource exhaustion; both issues stem from untrusted input shaping XML structure.