Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

microsoft/AdaptiveCards

              main @ 8b62e1d
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Dependency Vulnerability: 2 prior fixes. Scrutinize any change in this area.

source/dotnet/Samples/ImageRendererServer/Controllers/RenderController.cs: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The image renderer fetches remote images based on card content; without domain validation it can be abused to probe internal services. The fix added URIValidate.InDomain allowlist.

Dependency Vulnerability: The swiper peer dependency had a known high-severity vulnerability (CVE-2026-27212); the fix updated to ^12.1.2. This affects the Node.js rendering stack.

Dependency Vulnerability: Transitive dependency on Newtonsoft.Json.Schema introduced a medium-severity risk; the fix pinned Newtonsoft.Json to a non-vulnerable version across both UWP visualizer projects.