Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

fge/json-schema-validator

              master @ d265c6b
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

org.eel.kitchen.jsonschema.validator.JsonValidatorCache: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: A logic flaw in cache-lookup handling caused zero-sized value nodes to be treated as empty schemas, resulting in a validation bypass where arbitrary inputs were always evaluated as valid. Ensure the validator cache accurately distinguishes between empty schemas and raw value nodes.

SSRF: Unrestricted schema loading permitted non-HTTP URI schemes (such as file://) to be processed, allowing attackers to perform local file disclosure or trigger alternative protocol handlers. Strict protocol allowlists must gate all schema loading pathways.

Server-Side Request Forgery: Validating IP addresses by directly passing input to resolution-capable APIs can trigger silent DNS lookups and target internal services. Inputs must be strictly validated against regex patterns before invoking resolution-capable APIs.