Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

droolsjbpm/drools

              main @ e3829a6
            

Fixes

CVEs

CRITICAL

Peak severity

24.2%

Coverage

Highlights

Dependency Vulnerability: 32 prior fixes. Scrutinize any change in this area.

kogito-build/kogito-dependencies-bom/pom.xml: most-fixed (14 issues). Treat as high-risk during review.

69 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: Multiple critical fixes wrap MVEL evaluation and accumulator wiring in security-aware wrappers (SafeEnabled, SafeEvalExpression, SafeAccumulator, MVELSafeHelper) when a security policy is enabled. The risk is that any rule/process expression path not routed through these wrappers executes arbitrary Java.

XXE: XXE fixes disable external DTD/entity/schema/stylesheets across many XML parsing and transformation paths. Inconsistent application across components (drools-core, jbpm-flow-builder, jitexecutor, optaplanner) leaves risk of a sibling parser still permitting external entities.

Auth Bypass: Authorization bypasses in jBPM task and process services were fixed by adding user verification, restricting resume to READY tasks, enforcing policies on the found work item, role-based filtering, and async-context security handling. Missing checks on sibling task/process operations remain a risk.