Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
deepinsight-ai/deepbi
main @ 8baf98e
3
Fixes
0
CVEs
HIGH
Peak severity
0.0%
Coverage
Highlights
Arbitrary Code Execution: 1 prior fix. Scrutinize any change in this area.
ai/agents/agentchat/python_proxy_agent.py: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Arbitrary Code Execution: Unsafe execution of the python eval() function on arbitrary agent execution logs can lead to full remote code execution if log content is manipulated. This risk is partially addressed by checking for specific substrings like 'echart_name', which remains a fragile control.
Path Traversal: The direct passing of an unsanitized 'page' parameter to flask.render_template in authentication and routing handlers allows attackers to perform local file inclusion or path traversal.
Denial of Service: Excessively large Python execution logs can cause severe resource exhaustion, leading to a denial of service. While a 5000 character limit was introduced, any bypass or uncropped log path may still trigger memory pressure.