Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jaredwray/keyv

              main @ e004467
            

Fixes

CVEs

HIGH

Peak severity

Highlights

SQL Injection: 2 prior fixes. Scrutinize any change in this area.

core/keyv: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: The SQLite driver was susceptible to SQL injection due to dynamic construction of queries instead of parameterized statements. Developers must use parameterized APIs like 'this.db.prepare' for all operations involving dynamic keys.

Data Isolation Breach: A lack of strict namespace scoping in MongoDB CRUD and cleanup queries allowed operations to cross-contaminate or delete data outside of the intended multi-tenant boundaries. All MongoDB aggregation and lookup paths must explicitly scope queries by namespace.

SQL Injection: Database migration scripts dynamically concatenated table identifiers and database names without escaping, creating an SQL injection vector. Schema migration steps must use safe identifier escaping.