Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mangstadt/ez-vcard

              master @ 2396882
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

XXE: 2 prior fixes. Scrutinize any change in this area.

ezvcard/io/xml/XCardDocument.java: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XXE: XML transformer created without disabling external DTD/schema/stylesheets allows XXE during serialization, potentially leaking local files or causing SSRF.

XXE: DocumentBuilderFactory used for parsing without disabling external entities, DOCTYPE, or XInclude permits XXE when reading untrusted XCard XML.