Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
evidence-dev/evidence
main @ bdf2ce1
5
Fixes
49
CVEs
CRITICAL
Peak severity
Highlights
Denial of Service: 1 prior fix. Scrutinize any change in this area.
package.json: most-fixed (1 issue). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Subdirectory resolution for query outputs using string manipulation rather than relative path calculation allowed arbitrary traversal. Developers should ensure query target directories are strongly restricted to a safe base path.
Denial of Service: Scanning data source directories without file size limits allowed massive source files to exhaust server memory during reads. Developers must enforce size limits before buffer allocations.
Insecure Permissions: Generating parquet files without explicit Unix permissions allowed the default umask to potentially make sensitive analytic assets readable or writable by other local users.