claudecodeui

mirror of https://github.com/siteboon/claudecodeui.git synced 2026-06-03 19:15:37 +08:00

Author	SHA1	Message	Date
Simos Mikelatos	945454444a	Merge branch 'main' into fix/plugin-svg-icon-sanitization	2026-06-02 13:24:09 +02:00
Haileyesus	e14a512421	fix: sanitize plugin svg icons	2026-06-02 14:07:41 +03:00
Haile	704ff69b6e	Merge branch 'main' into contribai/fix/security/unsanitized-svg-content-injected-via-dan	2026-06-02 13:22:37 +03:00
tuanaiseo	f705f2555e	fix(security)(components): unsanitized svg content injected via `dangerouslys The plugin icon renderer fetches SVG text from `/api/plugins/.../assets/...` and injects it directly into the DOM using `dangerouslySetInnerHTML` after only checking that the payload starts with `<svg`. This does not remove malicious attributes/elements (e.g., event handlers, scriptable SVG payloads), enabling DOM-based XSS if a plugin asset is malicious or compromised. Affected files: PluginIcon.tsx Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>	2026-04-12 06:17:10 +07:00

Compare commits