Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

electric-sql/electric

              main @ 7139c53
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Denial of Service: 24 prior fixes. Scrutinize any change in this area.

packages/sync-service/lib/electric/plug/serve_shape_plug.ex: most-fixed (4 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Insecure handling of user-supplied `order_by` parameters allowed injection into PostgreSQL query construction. The mitigation requires strict AST validation, safe node type allowlists, and deparsing instead of direct interpolation. This is also tracked via CVE-2026-40906.

Auth Bypass: Flaws in parsing client-supplied where-clauses and un-scoped tables allowed default-allow fall-throughs and logical bypasses of table boundaries. Fixes introduce strict nested parentheses checks and default-deny structures.

Sandbox Escape: The agents runtime had vulnerabilities where operations could escape the intended agent workspace using symlink traversal. The fix demands canonicalization and prefix checks.