Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mock-server/mockserver-monorepo

              master @ 0608c01
            

Fixes

CVEs

CRITICAL

Peak severity

48.7%

Coverage

Highlights

Denial of Service: 24 prior fixes. Scrutinize any change in this area.

mockserver-core: most-fixed (25 issues). Treat as high-risk during review.

32 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: The template engines (JavaScript and Velocity) historically allowed arbitrary Java class loading and execution. Ensuring restricted environments, setting ClassFilters, and configuring SecureUberspector are critical to prevent template injection from escalating to full RCE.

Auth Bypass: Insecure trust manager configurations historically bypassed mutual TLS (mTLS) verification entirely when no custom CA chain was set, reverting to trusting all client certificates. Strict conditional validation of certificate chains is required to secure the administrative control plane.

Privilege Escalation: CI/CD build pipelines and container runtimes historically exposed the host's AWS IMDS metadata service and Docker sockets to untrusted pull requests. Complete segregation of release queues and restricting IAM token capabilities are necessary to avoid build pipeline takeover.