Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sbt/zinc

              develop @ c837684
            

Fixes

CVEs

CRITICAL

Peak severity

75.0%

Coverage

Highlights

Sandbox Escape: 2 prior fixes. Scrutinize any change in this area.

internal/zinc-classpath/src/main/scala/sbt/internal/inc/classpath/ClassLoaders.scala: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: ClasspathFilter and includeLoader logic have been patched twice for sandbox escapes; each fix addressed a distinct bypass (jrt: protocol acceptance and classloader recursion), indicating the classpath trust boundary is fragile and likely has more variant bypasses.

Remote Code Execution: Log4Shell (CVE-2021-44228) was fixed by upgrading log4j-core from 2.11.2 to 2.15.0; this is a critical RCE vector that must never regress.

Dependency Vulnerability: The util dependency was upgraded from 1.6.0 to 1.6.1 to address a vulnerable log4j version; this shows transitive dependency risks are a recurring theme and must be continuously monitored.