From 041cb6ca56377c4c133943b24ce3ea746d8ce6d4 Mon Sep 17 00:00:00 2001
From: Roy Lane <rlane@mitre.org>
Date: Thu, 19 Mar 2026 09:47:35 -0400
Subject: [PATCH 1/4] cveListSearch: temporarily point to development search
 site

---
 src/stores/cveListSearch.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/stores/cveListSearch.js b/src/stores/cveListSearch.js
index bb0c9d403..6c707a36e 100644
--- a/src/stores/cveListSearch.js
+++ b/src/stores/cveListSearch.js
@@ -219,7 +219,7 @@ export const useCveListSearchStore = defineStore('cveListSearch ', {
     },
     async getSearchResults() {
       this.isQueryingSearchService = true;
-      const searchUrl = `${import.meta.env.VITE_API_BASE_URL}${import.meta.env.VITE_LIST_SEARCH_PATH}`;
+      const searchUrl = 'https://dev.search.cve.org/webSearch';
 
       this.resetResults();
 

From 014d4b51fc84c6a3612612f542ebf7407dae6af6 Mon Sep 17 00:00:00 2001
From: Robert Roberge <rroberge@mitre.org>
Date: Wed, 20 May 2026 18:11:13 -0400
Subject: [PATCH 2/4] Update SECURITY.md

Update CVE website Security Policy
---
 SECURITY.md | 28 +++++++++++-----------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index f16eaf924..3baef96a7 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,22 +1,16 @@
 # Security Policy
 
 ## Reporting a Vulnerability
-Please use the <a href="https://cveform.mitre.org/" target="_blank">CVE Program web forms</a> to report security vulnerabilities for the 
-<a href="https://www.cve.org" target="_blank">CVE website</a>. Please include vulnerability details, steps to reproduce (e.g., proof-of-concept code, 
-screenshots) and an assessment of the impact in your report. We appreciate concise and high-quality reports.
-
-## Web Form Submissions
-
-* In the “Select a request type” drop down menu, please select “Other”
-* Enter your email address in the space provided
-* You may enter a PGP key if you prefer to encrypt your correspondence
-* In the “Type of comment” drop down menu, please select “Issue”
-* In the textbox labeled “Please provide your question, issue, comment, etc.” please start the message with the following information: 
-  - First Line: “CVE Website Security Anomaly Report”
-  - Second Line: “Distribution: CVE Website Development Team”
-  - Third Line: "Description: [Free Text description of the anomaly]”
-* Enter the Security code
-* Click “Submit Request”
+Please use the <a href="https://cveform.mitre.org/" target="_blank">CVE Program Web Forms</a> (choose “General Support”) to report security vulnerabilities for the 
+<a href="https://www.cve.org" target="_blank">CVE website</a>.
+
+Please include:
+
+* Vulnerability details
+* Steps to reproduce (e.g., proof-of-concept code, screenshots)
+* An assessment of the impact 
+
+We appreciate concise and high-quality reports.
 
 ## Scope
 
@@ -28,4 +22,4 @@ We will release fixes for verified security vulnerabilities. We expect to publis
 <a href="https://github.com/CVEProject/cve-website/security/advisories" target="_blank">security advisories</a>.
 
 ## Coordination
-We appreciate the opportunity to investigate and develop fixes before public disclosure, following coordinated vulnerability disclosure practices.
\ No newline at end of file
+We appreciate the opportunity to investigate and develop fixes before public disclosure, following coordinated vulnerability disclosure practices.

From 4981e68f3202c9ada23bba1f00a4e687208168a4 Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <piotr@github.copernik.eu>
Date: Thu, 8 Oct 2026 12:54:56 +0200
Subject: [PATCH 3/4] Render HTML and preformatted CVE descriptions

The CVE record page always showed the plain-text `value` of the CNA
description, collapsing its line breaks, lists and indentation.

- If the English description has a `text/html` supporting media entry,
  it is decoded (when base64-encoded), sanitized with DOMPurify using a
  strict allowlist of formatting, list, table and link elements, and
  rendered as HTML. Links open in a new tab with
  `rel="noopener noreferrer nofollow"`.
- Otherwise the plain-text description is rendered in a monospace font
  with `white-space: pre-wrap`, so line breaks, indentation and ASCII
  diagrams are preserved while long lines still wrap.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 package-lock.json                             | 17 +++++++
 package.json                                  |  1 +
 src/components/AdpVulnerabilityEnrichment.vue | 14 ++++--
 src/models/container.ts                       | 27 +++++++++--
 src/utils/htmlUtils.ts                        | 46 +++++++++++++++++++
 5 files changed, 98 insertions(+), 7 deletions(-)
 create mode 100644 src/utils/htmlUtils.ts

diff --git a/package-lock.json b/package-lock.json
index 6cc6d021a..fd2f13a5a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -19,6 +19,7 @@
         "axios": "^1.13.2",
         "buefy": "^3.0.3",
         "bulma": "^1.0.4",
+        "dompurify": "^3.4.16",
         "leaflet": "^1.9.4",
         "lodash": "^4.17.21",
         "pinia": "^3.0.4",
@@ -1907,6 +1908,13 @@
         "undici-types": "~7.18.0"
       }
     },
+    "node_modules/@types/trusted-types": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
+      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/@typescript-eslint/eslint-plugin": {
       "version": "8.70.1",
       "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.70.1.tgz",
@@ -2982,6 +2990,15 @@
         "node": ">=8"
       }
     },
+    "node_modules/dompurify": {
+      "version": "3.4.16",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz",
+      "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==",
+      "license": "(MPL-2.0 OR Apache-2.0)",
+      "optionalDependencies": {
+        "@types/trusted-types": "^2.0.7"
+      }
+    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
diff --git a/package.json b/package.json
index d2802173e..83e720f43 100644
--- a/package.json
+++ b/package.json
@@ -26,6 +26,7 @@
     "axios": "^1.13.2",
     "buefy": "^3.0.3",
     "bulma": "^1.0.4",
+    "dompurify": "^3.4.16",
     "leaflet": "^1.9.4",
     "lodash": "^4.17.21",
     "pinia": "^3.0.4",
diff --git a/src/components/AdpVulnerabilityEnrichment.vue b/src/components/AdpVulnerabilityEnrichment.vue
index cc7221ba6..d7d672a07 100644
--- a/src/components/AdpVulnerabilityEnrichment.vue
+++ b/src/components/AdpVulnerabilityEnrichment.vue
@@ -125,9 +125,11 @@
           v-if="(container.isCna || container.isCveProgram)
             && container.englishDescription.length">
           <h4 class="title is-size-5">Description</h4>
-          <p class="content cve-x-scroll">
-              {{container.englishDescription}}
-          </p>
+          <div v-if="container.englishDescriptionHtml.length"
+            class="content cve-x-scroll"
+            v-html="container.englishDescriptionHtml">
+          </div>
+          <p v-else class="content cve-x-scroll cve-plain-description is-family-monospace">{{ container.englishDescription }}</p>
         </div>
         <div v-if="!container.isCveProgram">
           <div id="cve-cwes" v-if="container.cwes.length > 0" class="mt-5">
@@ -250,6 +252,12 @@ function togglePanel() {
 <style scoped lang="scss">
   @use 'cveRecord' as *;
 
+  // Plain-text descriptions keep the CNA's line breaks and indentation,
+  // but long lines still wrap.
+  .cve-plain-description {
+    white-space: pre-wrap;
+  }
+
   .cve-accordion-header {
     background-color: $theme-color-primary-darker !important;
     cursor: pointer;
diff --git a/src/models/container.ts b/src/models/container.ts
index 460b35420..fdf7e1e99 100644
--- a/src/models/container.ts
+++ b/src/models/container.ts
@@ -6,6 +6,7 @@
 
 import {Product} from "./product"
 import type {ProductData} from "./product"
+import {decodeBase64, sanitizeHtml} from "../utils/htmlUtils"
 
 export interface ContainerData {
   providerMetadata: ProviderMetaData;
@@ -523,13 +524,31 @@ export class Container {
 
   get englishDescription() {
 
-    for (const description of this.descriptions) {
+    return this.englishDescriptionObject?.value ?? '';
+  }
+
+  get englishDescriptionHtml() {
+
+    // Returns the sanitized "text/html" supporting media of the English description,
+    // or an empty string if the CNA did not provide one.
+
+    const media = this.englishDescriptionObject?.supportingMedia
+      ?.find(m => m.type.split(';')[0].trim().toLowerCase() === 'text/html');
 
-      if (description.lang.toLowerCase().startsWith('en'))
-        return description.value;
+    if (!media?.value)
+      return '';
+
+    try {
+      return sanitizeHtml(media.base64 ? decodeBase64(media.value) : media.value);
+    } catch {
+      return '';
     }
+  }
+
+  get englishDescriptionObject(): Description | undefined {
 
-    return '';
+    return this.descriptions.find(
+      description => description.lang.toLowerCase().startsWith('en'));
   }
 
   get isAdp() {
diff --git a/src/utils/htmlUtils.ts b/src/utils/htmlUtils.ts
new file mode 100644
index 000000000..70859a6a2
--- /dev/null
+++ b/src/utils/htmlUtils.ts
@@ -0,0 +1,46 @@
+import DOMPurify from 'dompurify';
+
+// Elements allowed in HTML supplied by CNAs.
+//
+// Only text formatting, lists, tables and links are kept.
+// Anything that could load external resources, run scripts,
+// submit data or restyle the page is removed.
+
+const ALLOWED_TAGS = [
+  'a', 'abbr', 'b', 'blockquote', 'br', 'caption', 'cite', 'code', 'dd',
+  'del', 'dfn', 'div', 'dl', 'dt', 'em', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+  'hr', 'i', 'ins', 'kbd', 'li', 'mark', 'ol', 'p', 'pre', 'q', 's', 'samp',
+  'small', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'tfoot',
+  'th', 'thead', 'tr', 'tt', 'u', 'ul', 'var'
+];
+
+const ALLOWED_ATTR = ['href', 'title', 'colspan', 'rowspan', 'start', 'type'];
+
+DOMPurify.addHook('afterSanitizeAttributes', (node) => {
+
+  // Links supplied by third parties always open in a new tab
+  // and must not give the target page access to this window
+  // or pass referrer information.
+
+  if (node.tagName === 'A' && node.hasAttribute('href')) {
+    node.setAttribute('target', '_blank');
+    node.setAttribute('rel', 'noopener noreferrer nofollow');
+  }
+});
+
+export function sanitizeHtml(html: string): string {
+
+  return DOMPurify.sanitize(html, {
+    ALLOWED_TAGS,
+    ALLOWED_ATTR,
+    ALLOW_DATA_ATTR: false,
+  });
+}
+
+export function decodeBase64(value: string): string {
+
+  // Decodes a base64-encoded UTF-8 string.
+
+  const bytes = Uint8Array.from(atob(value), c => c.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}

From 732a400525e3a8a66fa9462219508097b9411b48 Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <piotr@github.copernik.eu>
Date: Fri, 9 Oct 2026 08:02:35 +0200
Subject: [PATCH 4/4] Type the DOMPurify configuration

Move the sanitizer options into a constant typed with DOMPurify's
`Config`, so misspelled option names are caught at compile time.

Assisted-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/utils/htmlUtils.ts | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/utils/htmlUtils.ts b/src/utils/htmlUtils.ts
index 70859a6a2..5e43770a4 100644
--- a/src/utils/htmlUtils.ts
+++ b/src/utils/htmlUtils.ts
@@ -1,4 +1,4 @@
-import DOMPurify from 'dompurify';
+import DOMPurify, { type Config } from 'dompurify';
 
 // Elements allowed in HTML supplied by CNAs.
 //
@@ -16,6 +16,12 @@ const ALLOWED_TAGS = [
 
 const ALLOWED_ATTR = ['href', 'title', 'colspan', 'rowspan', 'start', 'type'];
 
+const SANITIZE_CONFIG: Config = {
+  ALLOWED_TAGS,
+  ALLOWED_ATTR,
+  ALLOW_DATA_ATTR: false,
+};
+
 DOMPurify.addHook('afterSanitizeAttributes', (node) => {
 
   // Links supplied by third parties always open in a new tab
@@ -30,11 +36,7 @@ DOMPurify.addHook('afterSanitizeAttributes', (node) => {
 
 export function sanitizeHtml(html: string): string {
 
-  return DOMPurify.sanitize(html, {
-    ALLOWED_TAGS,
-    ALLOWED_ATTR,
-    ALLOW_DATA_ATTR: false,
-  });
+  return DOMPurify.sanitize(html, SANITIZE_CONFIG);
 }
 
 export function decodeBase64(value: string): string {