Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

google/adk-java

              main @ fed5344
            

Fixes

CVEs

HIGH

Peak severity

62.5%

Coverage

Highlights

CORS Misconfiguration: 2 prior fixes. Scrutinize any change in this area.

AdkWebCorsProperties.java: most-fixed (1 issue). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: Unlabelled peer payloads could be reinterpreted as executable code or function calls, enabling remote code execution via A2A protocol.

Code Injection: Reflective loading of arbitrary fields could trigger unintended static initializers; type confinement is required to prevent arbitrary code execution.

Auth Bypass / IDOR: Missing ownership checks allowed cross-user session access and deletion; enforcement on get/delete is critical.