Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
scala/scala3
main @ 83306a8
9
Fixes
0
CVEs
HIGH
Peak severity
57.1%
Coverage
Highlights
Deserialization of Untrusted Data: 3 prior fixes. Scrutinize any change in this area.
library/src/scala/runtime/LambdaDeserializer.scala: most-fixed (2 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Deserialization of Untrusted Data: The runtime Lambda deserialization mechanism is highly sensitive, with past vulnerabilities allowing arbitrary class member lookups and private method invocation through manipulated SerializedLambda payloads.
Deserialization of Untrusted Data: Lazily-evaluated collections can trigger the execution of arbitrary, potentially malicious code when their tail state is evaluated during the deserialization stream read.
Deserialization of Untrusted Data: Improperly designed call-by-name arguments in process builders can instantiate active, sensitive I/O streams during the object reconstruction process.