Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

dotnet/efcore

              main @ f10bdf7
            

Fixes

CVEs

HIGH

Peak severity

14.3%

Coverage

Highlights

Information Disclosure: 3 prior fixes. Scrutinize any change in this area.

EFCore.Proxies: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Using ExecuteSqlInterpolated can lead to SQL injection if parameter names are appended to the command raw rather than formatted and escaped via the SQL generation helper. This bypasses the parameterization boundary.

SQL Injection: Failing to properly delimit and sanitize database object names, such as sequence names, before executing direct database queries via ExecuteScalar can lead to raw SQL injection.

SQL Injection: Compiler-generated primary constructor parameter names in query filters can contain unexpected characters, causing invalid SQL parameter generation or injections if not alphanumeric-validated.