Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hunterhacker/jdom

              master @ c6065f6
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

XML External Entity (XXE): 2 prior fixes. Scrutinize any change in this area.

core/src/java/org/jdom2/input/SAXBuilder.java: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): User-configured features designed to disable external entities were applied too early in the parser lifecycle and subsequently overridden by default JDOM settings during initialization.

XML External Entity (XXE): JDOM failed to properly synchronize the external entity expansion flag with the actual underlying SAX parser features, meaning developer attempts to disable external entities via setFeature did not correctly propagate.