Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pig-mesh/pig

              master @ 7c5de6b
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 30 prior fixes. Scrutinize any change in this area.

pigx-common-security: most-fixed (8 issues). Treat as high-risk during review.

34 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: The application permitted execution of arbitrary Java code via unsafe reflection in Quartz scheduled tasks. This is tracked under CVE-2025-63690 where parameterless constructors could be leveraged (e.g., via ELProcessor) to gain full remote system control. The mitigation requires strict job safety validation of invoked classes.

Auth Bypass: Missing permission verification on core administrative endpoints, specifically the token pagination query interface (/api/admin/sys-token/page), allowed authenticated users to bypass access controls, leak active tokens, and escalate privileges. This is tracked under CVE-2025-63691.

SQL Injection: Flawed sorting column input validation and logical inversions in SqlFilterArgumentResolver allowed attackers to pass malicious keywords (such as 'extractvalue' and 'concat') inside ordering statements (asc/desc), resulting in SQL Injection.