Add will-attach-webview, update mammoth, other security updates - #2880

Merged

bengotow merged 8 commits into

security/webview-html-injection-hardening

Sep 18, 2026

Commits on Sep 18, 2026

Harden <webview> guests with a will-attach-webview handler

bengotow
and
claude
committed
de7fc2a
Escape the search value before writing it as innerHTML

bengotow
and
claude
committed
e1d853a
Bump mammoth to 1.12.3 to fix DOCX prototype pollution

bengotow
and
claude
committed
ffcda77
Strip data-* attributes from sanitized email HTML

bengotow
and
claude
committed
4944707
Re-sanitize uneditable block HTML at the render boundary

bengotow
and
claude
committed
70e884b
Pass a null-prototype env to spawned child processes

bengotow
and
claude
committed
17896c0
Memoize UneditableNode HTML sanitization

bengotow
and
claude
committed
8c21082
Reword security comments to state the invariant, not the exploit

bengotow
and
claude
committed
1c96677