Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
clickhouse/clickhouse-java
main @ e9a3e25
2
Fixes
1
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Privilege Escalation: 1 prior fix. Scrutinize any change in this area.
.github/workflows/claude-issue-triage.yml: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Privilege Escalation: Untrusted issue content processed by LLM-based triage logic could lead to prompt injection, compromising the workflow execution. If the workflow runs with a write-privileged token, attackers can escalate privileges to modify the repository. Splitting the workflow into dedicated, minimum-privilege jobs is necessary to contain this threat.
SQL Injection: Query cancellation routines constructed SQL commands using unsafe string interpolation for cluster identifiers. Failing to escape these identifiers using the appropriate database-specific quotes (such as backticks) allows attackers controlling connection parameters to execute arbitrary SQL commands.