Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jetbrains/intellij-community

              master @ f1094b7
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

platform/platform-impl/src/com/intellij/ide/plugins/marketplace/PluginSignatureChecker.kt: most-fixed (4 issues). Treat as high-risk during review.

36 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): Insecurely configured DocumentBuilderFactory instances across general XML parsing utilities and external annotation processors frequently introduced XXE, exposing the IDE to arbitrary local file disclosure.

Auth Bypass: Plugin signature checks were susceptible to bypass via lack of CRL revocation validation, simple string prefix comparisons of download hosts, and missing CA validation steps.

Command Injection: Interactive web elements and markdown previews allowed execution of arbitrary commands through unvalidated link protocols or unhashed terminal command suggestions.