Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/groovy

              master @ 8a98ac1
            

Fixes

CVEs

CRITICAL

Peak severity

45.5%

Coverage

Highlights

Privilege Escalation: 6 prior fixes. Scrutinize any change in this area.

src/main/groovy/lang/GroovyCodeSource.java: most-fixed (2 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: Insecure serialization handling within MethodClosure allowed remote attackers to execute arbitrary code via crafted serialized objects, as tracked by CVE-2015-3253 and CVE-2016-6814. Developers must ensure that serialization paths explicitly validate or restrict class loading.

Privilege Escalation: Instantiating ClassLoader instances (including GroovyClassLoader, TemplateGroovyClassLoader, and InnerLoader) outside of AccessController.doPrivileged blocks causes security exceptions or unauthorized privilege escalation under a Java SecurityManager.

XML External Entity (XXE): Insecure defaults in XML parsers and factories made the application vulnerable to XXE injections and XML bombs. Safe defaults disabling DOCTYPES and enabling secure processing must be consistently applied across all factory instances.