Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jetbrains/kotlin
master @ 22994d2
12
Fixes
7
CVEs
HIGH
Peak severity
41.7%
Coverage
Highlights
Path Traversal: 3 prior fixes. Scrutinize any change in this area.
libraries/stdlib/jdk7/src/kotlin/io/path/PathRecursiveFunctions.kt: most-fixed (2 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Recursive path operations such as directory traversal and relative-path resolution can escape the target parent directory, potentially resulting in arbitrary file deletion or write access outside intended boundaries.
Deserialization of Untrusted Data: Unrestricted Java deserialization of KAPT incremental caches using ObjectInputStream allows remote code execution if an attacker can manipulate the cache files on disk or inject a malicious payload.
Memory Corruption: Integer subtraction bounds checks in string conversions and array copying in the C++ runtime could overflow, leading to out-of-bounds memory access and memory corruption.