As you may know 184.108.40.206 has been been released.
In the release notes, I found that on top of bug fixes, there also was two security features:
- Prevented a potential Cross-Site Request Forgery (CSRF) vulnerability by changing the form key when a customer signs out of the storefront.
- Prevented a potential Cross-Site Scripting (XSS) vulnerability when adding a category.
I found the code change related to the first point in
Mage/Customer/Model/Session however, I can't get my hands on the changes made to apply the second security feature. Anyone could enlighten me here ?