Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

microsoft/monaco-editor

              main @ d8c9ff0
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Cross-Site Scripting: 1 prior fix. Scrutinize any change in this area.

monaco-lsp-client: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Arbitrary JavaScript execution was possible via postMessage communication, requiring a sandboxed iframe with a null origin to prevent malicious parent environments from executing arbitrary code via eval.

Cross-Site Scripting: Markdown content received from Language Server Protocol (LSP) servers was erroneously treated as trusted, exposing the editor to client-side script execution during rendering.