Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
x-stream/xstream
master @ a0f1637
14
Fixes
37
CVEs
CRITICAL
Peak severity
33.3%
Coverage
Highlights
Auth Bypass: 4 prior fixes. Scrutinize any change in this area.
xstream: most-fixed (3 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: Attackers can bypass type controls by wrapping malicious payloads inside dynamic proxies using java.beans.EventHandler and ProcessBuilder, allowing arbitrary system command execution.
Deserialization of Untrusted Data: Type permissions and security constraints can be bypassed when deserializing nested member types, allowing blocked classes to load if they are processed as child members.
Auth Bypass: A logic error in permission evaluation order allowed permission overrides because newly added custom type permissions were not correctly prepended to maintain LIFO evaluation.