Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

square/retrofit

              trunk @ 8e83a24
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Path Traversal: 1 prior fix. Scrutinize any change in this area.

retrofit-converters/jaxb: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): Insecure default configuration of XMLInputFactory allowed attackers to resolve external entities and DTDs, enabling remote file disclosure or SSRF via untrusted XML payloads. This vulnerability is tracked under CVE-2018-1000844.

Path Traversal: Insufficient validation of URL path segments allowed malicious directory traversal sequences ('.' or '..') inside @Path parameters to manipulate outbound API request destinations, leading to resource unauthorized access or modification. This is tracked under CVE-2018-1000850.