Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

oracle/graal

              master @ 3b8de8d
            

Fixes

CVEs

HIGH

Peak severity

15.8%

Coverage

Highlights

Sandbox Escape: 11 prior fixes. Scrutinize any change in this area.

wasm: most-fixed (5 issues). Treat as high-risk during review.

36 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: The polyglot framework must defend against guest environments accessing host capabilities. Faulty host access policy validations or missing restrictions on untrusted collections can allow untrusted code to run outside the sandbox.

Memory Corruption: WebAssembly abstract evaluation and stack operations are highly susceptible to memory corruption if block return lengths, continuation stack pointers, or table existence validations are calculated incorrectly.

Type Confusion: Low-level MethodHandle compiler intrinsics are prone to type confusion if type consistency validations are missing, which can bypass Java's strong typing guarantees at the VM level.