Daily updates from Odoo
Wednesday, January 21, 2026
1 change · master
Security fixes and vulnerability patches
This update enhances the security of our website by proactively preventing potential cross-site scripting (XSS) attacks. Previously, new cart HTML was vulnerable to tampering just before it was displayed. Now, the HTML is checked and sanitized immediately upon retrieval, ensuring a safer user experience.
Original PR description
Previously, new cart HTML was marked up at the last possible moment, right before insertion into the page. This is inherently insecure, as there is no reliable way to ensure it hasn't been tampered with. To reduce the risk of XSS attacks, the "markup-ing" of the updated HTML is now performed at the moment it is fetched from the server. This ensures that the new element is escaped back to a regular string if it is tampered with in any way before being inserted into the page. task-5082207 See also: - https://github.com/odoo/odoo/pull/234965