Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: 85500b6acb1b47f7eb16caa36e9a35b039ba145f https://github.com/xwiki/xwiki-platform/commit/85500b6acb1b47f7eb16caa36e9a3... Author: Marius Dumitru Florea <[email protected]> Date: 2026-10-08 (Thu, 08 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-war/src/main/webapp/resources/js/xwiki/prototypeJSPatches.js Log Message: ----------- XWIKI-24358: CVE-2020-27511 for library prototype.js * Prevent Prototype.js from adding String#stripTags() and String#unescapeHTML() to the String prototype, since they are vulnerable to ReDoS. Code that needs them can still provide a safe implementation. * Pass a predicate to preventAssignment() instead of a forbidden value provider, and don't leave an undefined own property behind when there was no previous value. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications