Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

evidentlyai/evidently

              main @ a4aa4c2
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

src/evidently/ui/managers/auth.py: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Asynchronous permission checks that are not properly awaited resolve to coroutine objects rather than booleans, silently evaluating to truthy values and bypassing access control checks completely. Developers must ensure all async permission validation calls are properly awaited.

Auth Bypass: Misconfigured or incomplete default role-to-permission mappings (such as missing DATASET_READ or dataset write permissions for Editor/Viewer roles) can lead to unauthorized access or operational failures. Centralized role definitions must explicitly declare all required permissions.

Command Injection: Untrusted input parameters injected directly into GitHub Actions 'run:' steps allow arbitrary command execution in the context of the runner. Inputs must be mapped to environment variables instead of being interpolated directly into shell scripts.