Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pivotal/robolectric
master @ 8ab3cf1
3
Fixes
0
CVEs
MEDIUM
Peak severity
33.3%
Coverage
Highlights
Insecure Temporary File: 1 prior fix. Scrutinize any change in this area.
.github/workflows: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: The extraction of JAR or ZIP entries without path validation allowed arbitrary file writes outside the intended target directory (Zip Slip), potentially leading to code execution.
Insecure Temporary File: Extracting native libraries to a predictable and shared local temporary path (/tmp/robolectric-libs/) created a local hijacking or privilege escalation risk if other local users pre-created or manipulated files in that location.
Privilege Escalation: Over-privileged GitHub Actions workflow tokens could be exploited by malicious pull requests to modify the repository or access secrets.