Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

extensityai/symbolicai

              main @ da28e25
            

Fixes

CVEs

HIGH

Peak severity

40.0%

Coverage

Highlights

SSRF: 3 prior fixes. Scrutinize any change in this area.

symai/backend/engines/index/engine_qdrant.py: most-fixed (3 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The indexing engine repeatedly suffered from SSRF and DNS rebinding vulnerabilities during remote file downloads. Multiple fixes were required to correctly implement DNS pinning, validate URL canonicalization, and reject connections to private IP ranges.

Remote Code Execution: Instantiating local Hugging Face SentenceTransformer models with the trust_remote_code option enabled allowed arbitrary remote code execution. This configuration error was patched across multiple occurrences to prevent loading malicious remote model code.

Path Traversal: Inadequate verification of file paths during document translation allowed directory traversal, risking arbitrary file read access outside of the intended container root directory.