Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

omnifaces/omnifaces

              5.x @ 7506182
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

XML External Entity (XXE): 2 prior fixes. Scrutinize any change in this area.

src/main/java/org/omnifaces/util/Xml.java: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): Insecure default configurations of DocumentBuilderFactory allowed XML External Entity (XXE) injection. Protecting this component required both disabling inline DOCTYPE declarations and enabling secure processing features to prevent local file disclosure and SSRF.

Auth Bypass: Improper handling of blank or empty role attributes allowed the AuthorizeTagHandler to inadvertently render restricted content rather than denying access. Authorization guards must explicitly check and fail closed when encountering empty attributes.

Expression Language (EL) Injection: As documented in CVE-2026-41883, the evaluation of EL expressions in resource names combined with wildcard CDN mapping can lead to server-side template injection (SSTI) and remote code execution.