Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cube-js/cube

              master @ da1d68d
            

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 28 prior fixes. Scrutinize any change in this area.

packages/cubejs-api-gateway/src/gateway.ts: most-fixed (13 issues). Treat as high-risk during review.

29 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The API gateway serves as the primary enforcement point where failures to handle asynchronous checkAuth middleware, global caching of context permissions, or improper evaluation of query member expressions have repeatedly resulted in complete authentication bypasses.

Auth Bypass: Tenant schema transpilation, global SQL API cache structures, and compiler metadata caches have historically leaked definitions across security contexts because compiler identifiers failed to incorporate active tenant visibility hashes or compiler-specific keys.

Remote Code Execution: The gateway parses dynamic member expressions in user-supplied queries, which historically allowed arbitrary JavaScript code execution via Function constructor injection.