Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/maven

              master @ fbd0963
            

Fixes

CVEs

HIGH

Peak severity

30.0%

Coverage

Highlights

Path Traversal: 3 prior fixes. Scrutinize any change in this area.

maven-wrapper/src/main/java/org/apache/maven/wrapper/Installer.java: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Three separate fixes (two in wrapper Installer, one in model validator) all address the same Zip Slip sink with identical normalization fix, indicating a systemic gap in archive extraction validation across different components.

Expression Injection: Two fixes restrict interpolation sources and reject arbitrary expressions in repository URLs, but the model builder fix is medium severity while the validator fix is high, suggesting incomplete coverage of interpolation paths.

Information Disclosure: Two fixes moved password decryption to the transport layer to prevent plaintext exposure in the settings model, but the refactoring may leave sibling paths (e.g., other settings consumers) still decrypting eagerly.