Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sbt/zinc

              develop @ 844d073
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Remote Code Execution: 1 prior fix. Scrutinize any change in this area.

Dependencies.scala: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: The project was vulnerable to the Log4Shell vulnerability (CVE-2021-44228) via its log4j-core dependency, which could allow remote code execution through manipulated log messages. Developers must ensure that logging components are continuously monitored and kept up-to-date.

Cross-Site Scripting (XSS): Zinc versions v0.1.9 through v0.3.1 are vulnerable to stored cross-site scripting (CVE-2022-32172) via unsanitized input within the delete template functionality. This allows authenticated attackers to execute arbitrary JavaScript.

Cross-Site Scripting (XSS): Zinc versions v0.1.9 through v0.3.1 contain a stored cross-site scripting vulnerability (CVE-2022-32171) triggered by unsanitized user ID input during user deletion, allowing authenticated script execution.