Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

activiti/activiti

              develop @ 1500e3f
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 19 prior fixes. Scrutinize any change in this area.

activiti-api-process-runtime-impl: most-fixed (2 issues). Treat as high-risk during review.

24 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: BPMN Shell Tasks allow execution of arbitrary shell commands. Without strict allowlisting of commands via a CommandExecutorFactory, malicious process definitions can execute unauthorized OS commands.

Remote Code Execution: User-supplied variables payload and output mappings can lead to arbitrary Unified Expression Language (EL) execution if evaluated without structural validation via ProcessVariablesPayloadValidator.

Unsafe Deserialization: Dynamic class loading from arbitrary, user-controlled class name strings via Class.forName bypasses safety checks. Replacing this with an explicit class registry map lookup restricts instantiation to an allowlist.