Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mybatis/mybatis-3

              master @ 954d1c8
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Deserialization of Untrusted Data: 2 prior fixes. Scrutinize any change in this area.

org.apache.ibatis.executor.loader.AbstractSerialStateHolder: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization of Untrusted Data: The project has suffered from critical deserialization flaws where untrusted object streams are parsed during lazy loading state restoration. Despite introducing a look-ahead ObjectInputStream, the mechanism relies on a denylist of dangerous gadget classes which remains prone to bypasses as new gadget chains are discovered.

SQL Injection: Dynamic SQL string substitution using `${}` expressions allows unchecked values to be concatenated directly into executable SQL statements via OGNL evaluation. This is mitigated only by an optional, opt-in regular expression filter rather than structurally parameterized inputs.

Path Traversal: VFS directory scanning is susceptible to Zip Slip attacks during JAR entry extraction if the application fails to validate that entry canonical paths reside within the target destination directory.