Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
chinabugotech/hutool
v5-master @ a0bd223
31
Fixes
16
CVEs
CRITICAL
Peak severity
42.3%
Coverage
Highlights
Path Traversal: 7 prior fixes. Scrutinize any change in this area.
hutool-core: most-fixed (7 issues). Treat as high-risk during review.
22 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Repeated directory traversal (Zip Slip) bypasses occurred in 'FileUtil.checkSlip' and path verification helpers due to improper path normalization and canonicalization before calling startsWith. This allows attackers to write files outside of the intended target directory during extraction.
Auth Bypass: The JWT verification logic was susceptible to signature verification bypasses when encountering the 'none' algorithm or due to incorrect conversion formats between DER and raw ECDSA signatures.
Deserialization of Untrusted Data: Unsafe deserialization sinks, such as XMLDecoder and ObjectInputStream, allowed remote code execution when parsing untrusted serialized objects or XML files, resolved by establishing explicit class allowlists or deprecating unsafe entry points.