Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

huggingface/huggingface_hub

              main @ 1e41293
            

Fixes

CVEs

HIGH

Peak severity

40.0%

Coverage

Highlights

Command Injection: 3 prior fixes. Scrutinize any change in this area.

.github/workflows/release.yml: most-fixed (3 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Untrusted release inputs and step outputs were directly interpolated into inline bash blocks, allowing adversaries to execute arbitrary commands within the GitHub Actions runner context. This risk is mitigated by mapping inputs strictly to environment variables rather than inlining expressions.

Path Traversal: The checkpoint loading mechanism was vulnerable to path traversal attacks on Windows operating systems due to insufficient handling of backslash characters, drive-absolute paths, and UNC formats during path resolution. Standardizing paths via PureWindowsPath and canonicalizing prefixes prevents unauthorized local file access.

Auth Bypass: A race condition (TOCTOU) in the style-bot automated workflow allowed arbitrary code execution or unauthorized pushes. Hardening requires pinning actions to immutable commit SHAs and validating that PR head SHAs have not drifted between checkout and execution.