Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/incubator-kie-drools

              main @ e3829a6
            

Fixes

CVEs

CRITICAL

Peak severity

15.6%

Coverage

Highlights

Dependency Vulnerability: 40 prior fixes. Scrutinize any change in this area.

kogito-build/kogito-dependencies-bom/pom.xml: most-fixed (16 issues). Treat as high-risk during review.

64 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: MVEL.eval/executeExpression on untrusted rule or test scenario data allows arbitrary Java code execution. Multiple fixes wrap expressions in MVELSafeHelper/SafeEvaluator, but any new MVEL entry point (e.g., new rule attribute, workflow expression) risks bypassing the policy.

XXE / XML External Entity: Multiple XML parsing paths (BPMN, kmodule, scenario, optaplanner) were vulnerable to external entity resolution. Each fix disables external DTD/entity features, but new XML processing code may miss these settings, especially in sub-loaders or alternate formats.

Dependency Vulnerability: 40+ fixes address CVEs in transitive dependencies (Jackson, Netty, Quarkus, logback, commons-compress, snakeyaml, etc.). The risk is incomplete version alignment across the many BOMs and modules, leaving some paths on vulnerable versions.