Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

testcontainers/testcontainers-java

              main @ deb78e1
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Command Injection: 1 prior fix. Scrutinize any change in this area.

.github/workflows/combine-prs.yml: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Deserialization: The parsing of Docker Compose files previously relied on an unsafe YAML loader (SnakeYAML), which permitted arbitrary type instantiation during deserialization. This represents a severe remote code execution vector if developers load untrusted compose configurations.

Credential Leak: A loose substring match on registry hostnames caused registry authentication credentials to be inadvertently transmitted to unauthorized external registries. Proper suffix or exact domain match validation is mandatory to safeguard registry tokens.

Command Injection: Using direct expression interpolation within run blocks of GitHub Actions workflows allowed untrusted input to execute arbitrary shell commands. Utilizing environment variables for step outputs is vital to prevent pipeline hijacking.