Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

eventual-inc/daft

              main @ 62cb100
            

Fixes

CVEs

CRITICAL

Peak severity

85.7%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

.github/workflows: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Remote Code Execution: The system exposed an unauthenticated query preview endpoint that deserialized arbitrary Python objects from IPC streams via RecordBatch::from_ipc_stream, permitting remote code execution. developers must avoid insecure deserialization of untrusted IPC inputs.

Auth Bypass: Using the pull_request_target trigger on untrusted pull requests from forks allowed potentially unauthorized actors to gain access to write permissions and repository secrets.

Information Disclosure: Sensitive credentials, API keys, and configurations were exposed as plain-text during standard debugging and display serialization (Debug and Display traits), requiring obfuscation containers.