Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apconw/aix-db

              master @ 9d2e15e
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Denial of Service: 1 prior fix. Scrutinize any change in this area.

aix-db-cli/lib/auth.js: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Unvalidated SQL query execution allows attackers to run unauthorized database commands. The system was hardened to validate SQL AST structures to ensure read-only single SELECT statements, but associated CVEs like CVE-2026-4530 highlight that SQL manipulation remains a key risk vector.

Broken Access Control: Unauthenticated clients are able to execute arbitrary SELECT queries and retrieve database data due to missing authentication checks on the /llm/process_llm_out endpoint.

Denial of Service: The local CLI login callback lacked request body size limits, making the system vulnerable to memory exhaustion. The fix implemented a 10KB size limit and explicit connection destruction.