Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

georgia-tech-db/evadb

              staging @ e5a9190
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Denial of Service: 4 prior fixes. Scrutinize any change in this area.

eva/binder/statement_binder.py: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Deserialization: The codebase adopted PickleSerializer for network messages, which permits arbitrary object injection and immediate remote code execution via unsafe pickle.loads deserialization over the network protocol.

Code Execution: Loading custom User-Defined Functions (UDFs) directly from disk files allows arbitrary Python execution if the loader executes unverified or tampered files without validating their integrity checksums against the system catalog.

Path Traversal: User-controlled file paths and upload destinations bypass security controls if they are not constrained to a safe root directory using a validated path-joining mechanism.