This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+11 more
Affected surfaces
Summary
AI summarySanitizer hardening adds repeat‑until‑stable tag stripping to close an at‑rest XSS vulnerability.
Full changelog
[1.107.0] — 2026-07-06
Sanitizer hardening (at-rest XSS defense-in-depth). stripDangerousMarkdown — which neutralizes dangerous HTML in stored CV/JD markdown so any consumer that bypasses the escape-on-render client is still safe — now runs its tag strip to a fixed point (repeat-until-stable) so a removal that reforms a payload (e.g. <scr<script></script>ipt>) is caught, matches script/style/etc. end tags with trailing junk (</script foo>), and strips an unclosed executable opener (<script …> with no closing tag). Behavior for valid markdown is unchanged — it only ever removes more.
server/lib/security.mjs: fixed-point loop (bounded 8 passes) +[^>]*>end-tag patterns + unclosed-opener strip. +3 regression cases intests/cv-xss-bypasses.test.mjs(end-tag variants, single-pass-reveal, unclosed). The authoritative XSS boundary remains output-escaping (UI.md); this strengthens the at-rest guarantee and closes the matching CodeQL findings.
New: none.
Security Fixes
- Sanitizer `stripDangerousMarkdown` now runs a fixed‑point loop (max 8 passes) to catch re‑formed payloads, trailing junk in end tags, and unclosed executable openers, closing the at‑rest XSS CodeQL findings.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Career Ops UI
All releases →Beta — feedback welcome: [email protected]