Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

microsoft/fluentui

              master @ 65db820
            

Fixes

CVEs

HIGH

Peak severity

36.4%

Coverage

Highlights

Cross-Site Scripting (XSS): 5 prior fixes. Scrutinize any change in this area.

CI/CD: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: Evaluating untrusted Vega-Lite chart definitions using eval can lead to arbitrary code execution in the client browser context. A secure parser must be used instead.

Cross-Site Scripting (XSS): Unvalidated URL schemes in chart navigation handlers can execute 'javascript:' URIs, leading to direct client-side execution. Strict scheme checks are required before changing window.location.href.

Auth Bypass: Workflows extracting triggers from artifacts are prone to PR hijacking if they fail to validate the PR identity against the running workflow's head SHA.