Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jbossas/jboss-threads

              main @ 04261f3
            

Fixes

CVEs

HIGH

Peak severity

40.0%

Coverage

Highlights

Privilege Escalation: 4 prior fixes. Scrutinize any change in this area.

src/main/java/org/jboss/threads/EnhancedQueueExecutor.java: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Privilege Escalation: Allowing arbitrary, caller-supplied AccessControlContext or Class parameters to construct execution contexts allows untrusted code to run tasks with highly elevated security privileges.

Privilege Escalation: Unsafe constructors accepting an external AccessControlContext can expose arbitrary context control; context must instead be captured implicitly from the caller's immediate security domain.

Privilege Escalation: Failing to securely capture the AccessControlContext during queue executor instantiation allows executing tasks to implicitly inherit or run with inappropriate active privileges.