Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

languagetool-org/languagetool

              master @ 2965bc6
            

Fixes

CVEs

HIGH

Peak severity

30.8%

Coverage

Highlights

Denial of Service: 17 prior fixes. Scrutinize any change in this area.

languagetool-core: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: 17 fixes across tokenizers and rules, including stack overflows, index-out-of-bounds, ReDoS, and resource leaks, indicate pervasive input-length and bounds validation gaps.

Auth Bypass: Multiple fixes to JWT token verification, referrer allowlist, and trusted-source checks indicate logic errors that could grant premium or remote-rule access to unauthorized users.

XML External Entity (XXE): Two separate SAXParser instances were patched to disable external DTDs, indicating a systemic risk in XML rule loading that could allow file disclosure or SSRF.