Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/burr

              main @ a6bda44
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Arbitrary Code Execution: 1 prior fix. Scrutinize any change in this area.

burr.integrations.serde.pydantic: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Arbitrary Code Execution: Deserializing untrusted state payload allowed arbitrary Python modules to be imported and executed via dynamic import sinks. This was patched by introducing a strict, configurable module allowlist. Developers must ensure that any new serialization frameworks or modifications to existing Pydantic integrations do not bypass this allowlist.