Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

googleapis/java-pubsub

              main @ ba2b8a3
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Command Injection: 1 prior fix. Scrutinize any change in this area.

.github/workflows/hermetic_library_generation.yaml: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Untrusted branch names and pull request parameters were evaluated directly inside shell scripts, allowing arbitrary bash commands to be run within the context of the GitHub Actions runner. This could lead to repository secret exfiltration or compromised build artifacts.