Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

dependency-check/dependencycheck

              main @ 8119dd0
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Deserialization of Untrusted Data: 1 prior fix. Scrutinize any change in this area.

.github/workflows/coverity.yml: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: Deserializing untrusted data via ObjectInputStream without proper class verification can lead to arbitrary code execution in build environments. Restricting object resolution to an explicit allowlist is critical for Maven Mojo integrations.

XML External Entity (XXE): Parsing dependency suppression, POM, or hint XML files without disabling external entity and schema resolution exposes the engine to XXE and external network/file lookups. Developers must ensure parser factories disable external DTDs.

Privilege Escalation: GitHub Actions workflows running with overly permissive default tokens can be exploited to gain write access to the repository. Restricting token permissions to 'contents: read' mitigates target escalation paths.