Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

intellabs/nlp-architect

              master @ 88b3236
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Path Traversal: 2 prior fixes. Scrutinize any change in this area.

server/serve.py: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Deserialization: The server accepted and deserialized raw Python pickle payloads from untrusted request data, presenting a direct pathway to arbitrary remote code execution (RCE).

Prototype Pollution: Inadequate type checking and validation of document parameters in request bodies allowed malformed payloads to pollute internal object structures.

Path Traversal: Dialogue scripts resolved user-supplied filenames directly through file operations without verifying that the resolved paths remained within designated boundaries.