Garry TanandClaude Fable 5 36c608eb6e security(browse): drop .svg from the load-html extension allowlist ...

SVG is a script-capable format (inline <script>, event handlers, foreign
objects), so allowing it through load-html's HTML allowlist let a local
.svg execute script in the browse session context. The allowlist is now
.html/.htm/.xhtml only; regression test asserts .svg is rejected.

Contributed by @garagon (PR #1153).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-14 20:21:01 -07:00

..

bin

feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226)

2026-03-19 18:20:50 -07:00

scripts

fix(build): escape literal braces in the bun:sqlite stub regex

2026-08-14 20:20:59 -07:00

src

security(browse): drop .svg from the load-html extension allowlist

2026-08-14 20:21:01 -07:00

test

security(browse): drop .svg from the load-html extension allowlist

2026-08-14 20:21:01 -07:00

PLAN-snapshot-dropdown-interactive.md

fix: snapshot -i auto-detects dropdown/popover interactive elements (#845)

2026-04-05 22:57:45 -07:00

SKILL.md

fix(preamble): update_check:false gates the prose, not just the binary

2026-08-14 20:20:55 -07:00

SKILL.md.tmpl

v1.57.8.0 feat: browse js/eval --out render-to-file (canonical Chromium for offline rendering) (#1929)

2026-06-09 21:02:30 -07:00