Search results

String#unescapeHTML() decodes entities after stripping tags, reintroducing markup

Status: Open.

#371 In prototypejs/prototype;

· knogineer opened on May 26, 2026

String#escapeHTML() does not encode quotes, allowing XSS in attribute context

Status: Open.

#370 In prototypejs/prototype;

· knogineer opened on May 26, 2026

OWASP dependency-check (Retire.js) flags every fork of 1.7.3 for CVE-2020-27511, even patched ones — request a tagged 1.7.4 / version bump

Status: Open.

#368 In prototypejs/prototype;

· danshome opened on May 13, 2026

Future and present of Prototype.js

Discussion

Status: Open.

#363 In prototypejs/prototype;

· Sublime1 opened on Nov 7, 2023

Prototype is no longer compatible with Vue.js

Status: Open.

#362 In prototypejs/prototype;

· Sublime1 opened on Nov 2, 2023

$F throws an error when missing element

Status: Open.

#360 In prototypejs/prototype;

· kstubs opened on Apr 27, 2023

Array.from doesn't work with some iterables

Status: Open.

#359 In prototypejs/prototype;

· ecolui opened on Apr 25, 2023

Element.replace() swaps element and textNode if used inside a table

Status: Open.

#357 In prototypejs/prototype;

· Chris78 opened on Feb 2, 2023

CVE-2020-27511

Status: Open.

#355 In prototypejs/prototype;

· matteodelta opened on Jan 14, 2022

Typescript declarations?

Status: Open.

#354 In prototypejs/prototype;

· jblotus opened on Aug 31, 2021

Warning: Potential Security Risk Ahead https://api.prototypejs.org/

Status: Open.

#352 In prototypejs/prototype;

· kressly opened on Jun 1, 2021

Global.Node has the potential of being overwritten.

Status: Open.

#343 In prototypejs/prototype;

· jwestbrook opened on Jul 31, 2018