Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pallets-eco/wtforms

              main @ ae8f4b4
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

src/wtforms/validators.py: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Disabled validator used `raw_data is not None`, which treats an empty list as valid, allowing modification of disabled fields. This is a high-severity authorization control bypass.

Reflected XSS: Label rendering did not escape text, enabling stored/reflected XSS when user-controlled label content is rendered. High severity due to direct script injection in HTML.

CSRF Token Parsing Bypass: Splitting the CSRF token on '##' without a limit could raise ValueError on malformed input, potentially bypassing CSRF protection. High severity because it undermines request forgery defenses.