Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

deepset-ai/haystack

              main @ 011fb89
            

Fixes

CVEs

CRITICAL

Peak severity

55.6%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

Workflows: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: The output adapter component bypassed the Jinja2 sandbox by utilizing standard environments instead of restricted execution sandboxes, allowing untrusted templates to execute arbitrary system code. This was addressed by enforcing SandboxedEnvironment as the default and restricting NativeEnvironment to cases with explicit unsafe opt-ins.

Code Execution: Standard Jinja2 template and prompt rendering configurations allowed users to execute raw Python calls within standard environments. Enforcing SandboxedEnvironment across core prompt utilities is required to mitigate this vector.

Prompt Injection: Attackers could inject malicious text that mirrored internal system delimiters, allowing them to break out of system prompt boundaries. The issue was resolved by generating random nonces for sentinel tags per execution environment.