Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jgraph/drawio

              dev @ fea5e87
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Cross-Site Scripting: 4 prior fixes. Scrutinize any change in this area.

src/main/webapp/js/sanitizer/purify.min.js: most-fixed (4 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting: Recurring sanitization bypasses in DOMPurify, a critical dependency for rendering untrusted diagram content. Multiple upgrades were needed to address bypasses, indicating a high risk of XSS if the library lags behind.

Cross-Site Scripting: Multiple copies of the DOMPurify bundle are maintained, each requiring independent upgrades. A missed update in any copy leaves an XSS vector open.

Cross-Site Scripting: Another DOMPurify copy, patched separately, reinforcing the need to track and update all bundled sanitizer instances.