Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

testng-team/testng

              master @ 93f4cff
            

Fixes

CVEs

HIGH

Peak severity

57.1%

Coverage

Highlights

Supply Chain: 2 prior fixes. Scrutinize any change in this area.

src/main/resources/org/testng/header: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): Suite XML parsing previously allowed external entity resolution, enabling file disclosure or SSRF. Fix added schema validation and disabled external entities, but sibling parsers or alternate XML load paths may still lack these guards.

Deserialization of Untrusted Data: snakeyaml 2.0 upgrade and explicit LoaderOptions were required to fix CVE-2022-1471 (arbitrary code execution). Any other YAML parsing path (e.g., test data files) may still use default Constructor settings.

Path Traversal: Zip Slip was fixed via path canonicalization and prefix check before Files.copy. Other archive extraction utilities (e.g., for test resources or dependencies) may not enforce the same containment.