Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

alibaba/jetcache

              master @ 15a89c8
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Deserialization of Untrusted Data: 1 prior fix. Scrutinize any change in this area.

.github/workflows/maven.yml: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: The caching core utilizes Java's native ObjectInputStream and Kryo for deserialization. Without strict allowlisting or denylisting mechanisms, processing untrusted cache payloads can result in arbitrary code execution via deserialization gadgets.

Privilege Escalation: Default permissions assigned to the GITHUB_TOKEN in workflow files can grant excessive write privileges to build runners. This creates an escalation path where compromised dependencies or pull requests could modify the repository contents.