Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

explosion/spacy

              master @ e671995
            

Fixes

CVEs

CRITICAL

Peak severity

66.7%

Coverage

Highlights

Memory Corruption: 5 prior fixes. Scrutinize any change in this area.

spacy/tokens.pyx: most-fixed (5 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Memory Corruption: Frequent memory management errors including uninitialized stack variables, improper reallocation bounds checks, and incorrect offset math have repeatedly led to heap corruption and undefined behavior in token vector operations.

Use After Free: Garbage collection lifecycle discrepancies between the Cython C data objects and Python wrappers (such as Token and Doc parent containers) can leave dangling references, leading to severe use-after-free and segmentation faults.

Path Traversal: Handling download paths and remote project archives without proper validation allows path traversal, enabling arbitrary file writes or unsafe package downloads.