Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

esotericsoftware/yamlbeans

              master @ a7212ab
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Deserialization of Untrusted Data: 1 prior fix. Scrutinize any change in this area.

src/com/esotericsoftware/yamlbeans/SafeYamlConfig.java: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Unsafe Deserialization: Default behavior in YamlReader allowed looking up and instantiating arbitrary Java classes defined in YAML tags, leading to remote code execution. Mitigations require explicit configuration flags to disable arbitrary class loading.

Deserialization of Untrusted Data: Processing YAML documents with active anchors or custom class tags allows attackers to perform entity expansion attacks (causing CPU and memory exhaustion) or load unauthorized classes. SafeYamlConfig was introduced to systematically disable these features.