Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

svg/svgo

              main @ e4cb29b
            

Fixes

CVEs

HIGH

Peak severity

40.0%

Coverage

Highlights

Improper Input Validation / XSS: 3 prior fixes. Scrutinize any change in this area.

plugins/removeScripts.js: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Improper Input Validation / XSS: Multiple bypasses of executable URL detection and attribute sanitization were fixed, indicating this plugin is the primary attack surface for XSS.

Improper Input Validation / XSS: Centralized executable URL detection had a bypass via data: URLs with executable media types, showing the shared helper is a high-value target.

XSS: Case-insensitive URI matching and namespace-aware script detection were added, indicating prior case/namespace bypasses.