Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cocoindex-io/cocoindex

              main @ 4fc5be6
            

Fixes

CVEs

CRITICAL

Peak severity

46.2%

Coverage

Highlights

Denial of Service: 5 prior fixes. Scrutinize any change in this area.

python/cocoindex/connectors/postgres/_target.py: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Insecure interpolation of database schema, table, and column names allows untrusted configuration or metadata to execute arbitrary database queries. This is mirrored in the CVE-2026-28438 advisory for alternative target connectors.

Insecure Deserialization: Use of untrusted python pickle deserialization allows remote code execution if serialized payloads are manipulated. Safe unpicklers with restricted class allowlists must be uniformly applied.

Injection: Lack of strict regex-based input validation in Valkey key generation and index definitions permits injection into the search DSL and database key collisions.