Scala 3.8.4 Ships Security Hardening From the OSTIF and Quarkslab Audit, Patching a Scaladoc XSS and a TASTy Parser Infinite Loop
The maintenance release folds in fixes from Scala's first external security audit, which found no critical or major issues but flagged a stored XSS in Scaladoc and an infinite loop in TASTy parsing.
Overview
The Scala team released Scala 3.8.4 on June 5, 2026, a maintenance build whose headline content is a set of fixes drawn from an external security audit of the language’s codebase. According to the Scala Programming Language release notes, the version “includes improvements and fixes for issues discovered during the Scala codebase security audit carried out in collaboration with the Open Source Technology Improvement Fund and Quarkslab.”
The release lands four days after the Scala Center published the first results of that audit on June 1, 2026, and after Quarkslab, the firm that carried out the technical review, posted its own write-up the same day.
What We Know
The audit produced no headline-grade vulnerabilities. The Scala Center wrote that “no critical or major security issues were identified during the audit.” The Quarkslab report quantified the result: “A total of 9 vulnerabilities were identified: 5 of medium severity, 2 of low severity, and 2 informative issues.”
According to Quarkslab, the review “focused on the core components of the Scala ecosystem, including the Scala 3 compiler, its compilation pipeline, generated JVM bytecode, the Scala REPL, the TASTy Inspector, and the Scala documentation generator.” The Scala Center described the broader engagement as “an assessment of the Scala 3 compiler and Scala standard library codebases, and a separate review of Scala’s supply-chain security,” with the supply-chain portion held back for a later publication, per the Scala Center.
Three of the medium-severity findings map directly onto fixes shipped in 3.8.4. Quarkslab identified a “Stored XSS vulnerability in Scaladoc,” the documentation generator, and an “Infinite loop during section loading in dotty.tools.dotc.core.tasty.TastyUnpickler.” The auditors also flagged that “scala.sys.Process.ProcessBuilderImpl AbstractFunction0 may be used as a deserialization gadget.”
The corresponding entries in the Scala 3.8.4 release notes are a hardening of “TASTy parsing to prevent infinite loops on maliciously crafted files (#25676),” a fix for “a stored XSS vulnerability in Scaladoc (#25681),” and improved “error handling in scala.sys.process.Parser.tokenize (#25675).” A fourth entry corrects “TastyPrinter’s JAR-walking logic to include subdirectories (#25678).” On the scala/scala3 GitHub release, those pull requests are titled “Fix infinite loop with bad section ends in TastyHeaderUnpickler,” “Parse HTML properly in Scaladoc,” “Move process parse exceptions to sys.error instead of a custom exception,” and “Fix TastyPrinter’s JAR-walking logic to include subdirectories.”
The audit combined human and automated techniques. Quarkslab wrote that “automated static analysis tools such as Gadget Inspector and Opengrep were used to scan the codebase for potential security issues,” after which “the auditors performed dynamic testing using fuzzing techniques.” The technical work was credited to Sébastien Rolland and Samuel Hangouet of Quarkslab, while the Scala Center’s announcement was written by Darja Jovanovic and Solal Pirelli, per the Scala Center.
Beyond the security work, 3.8.4 adds a developer-facing usability change: per the Scala release notes, “you can now append :help to any compiler setting to see its documentation — not just a fixed subset as before.” The GitHub release lists the same change as “Allow :help syntax for all settings.”
What We Don’t Know
The two primary accounts give slightly different severity tallies for the lower-ranked findings: the Scala Center cites “5 medium severity issues, 1 low severity issue, and 2 informational findings,” while Quarkslab reports “5 of medium severity, 2 of low severity, and 2 informative issues.” Both agree on the five medium-severity count. The Scala Center said its supply-chain findings would be detailed separately, so the full picture of that review is not yet public.
Analysis
The engagement reflects a pattern that has become routine for widely deployed open-source toolchains: a third-party audit funded through intermediaries that specialize in open-source security. The Scala Center noted the work was done “under the Sovereign Tech Fund investment,” with OSTIF acting as the bridge to Quarkslab’s reviewers. For a compiler whose output runs across the JVM ecosystem, the most consequential findings were not in user code but in how the toolchain itself parses untrusted inputs — TASTy binary files and HTML rendered into documentation — exactly the surfaces a maliciously crafted artifact would target.