Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sbt/ivy

              2.3.x-sbt @ 77cc781
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Path Traversal: 1 prior fix. Scrutinize any change in this area.

IvyPatternHelper: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): Default configurations of SAXParserFactory allowed external entity resolution and DOCTYPE declarations. This can lead to arbitrary local file read, server-side request forgery (SSRF), or denial of service when processing untrusted XML metadata. Developers should ensure all XML parser instances explicitly disable external DTDs and general entities.

Path Traversal: Module coordinates containing path traversal sequences could break out of the designated cache or repository directory roots when resolving files. This allows arbitrary file writes or reads within the host file system. Strict path canonicalization and prefix validation must be applied to all resolved paths prior to any filesystem operations.