Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
facebook/buck
main @ 9c7c421
16
Fixes
1
CVEs
CRITICAL
Peak severity
40.0%
Coverage
Highlights
Path Traversal: 7 prior fixes. Scrutinize any change in this area.
src/com/facebook/buck/core/artifact/ArtifactImpl.java: most-fixed (2 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Deserialization of Untrusted Data: Deserializing unvalidated build state files using standard Java ObjectInputStream allows remote code execution when malicious cache files are processed. This was publicly tracked as CVE-2018-6331.
Path Traversal: Insufficient checking of relative output paths allows artifacts to write or modify build outputs outside of their designed sandboxed directories, potentially overwriting critical host files.
Remote Code Execution: Use of an outdated, vulnerable log4j2 library exposed the system to remote execution via malicious log payload injection (Log4Shell).