Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
lukehutch/fast-classpath-scanner
latest @ a03ed56
5
Fixes
0
CVEs
CRITICAL
Peak severity
75.0%
Coverage
Highlights
Path Traversal: 1 prior fix. Scrutinize any change in this area.
ClassGraphClassLoader.java: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: The logging system was exposed to the Log4Shell (CVE-2021-44228) vulnerability through message lookups when standard log properties were evaluated. This critical risk was addressed by explicitly setting formatMsgNoLookups system properties during class initialization.
XML External Entity (XXE): XML parsing of version manifests without disabling external DTDs and entities allowed potential out-of-band data exfiltration and server-side request forgery (SSRF). The fix explicitly disables general, parameter, and external entities in the DocumentBuilderFactory configuration.
Path Traversal: A Zip Slip vulnerability allowed nested jar entries to escape the temporary extraction directory during scanning via path traversal sequences. Secure path validation of target paths relative to the extraction base directory is required to prevent local file overwrites.