Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cvhub520/x-anylabeling

              main @ d0f6761
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Code Execution: 1 prior fix. Scrutinize any change in this area.

anylabeling/services/auto_labeling/model.py: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Execution: The use of the native python eval() function to parse input from the linking text field allowed arbitrary python code execution. This was mitigated by migrating to ast.literal_eval().

Insecure Communication: The application bypassed TLS certificate verification during model downloads by using an unverified SSL context wrapper, exposing users to potential active man-in-the-middle (MITM) attacks.

Security Misconfiguration: A global SSL verification bypass was previously applied, which weakened the transport security of all HTTPS requests made by the application. This was constrained to limit the scope of the bypass.