Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jax-ml/jax

              main @ 47c32de
            

Fixes

CVEs

HIGH

Peak severity

42.9%

Coverage

Highlights

Command Injection: 4 prior fixes. Scrutinize any change in this area.

jaxlib: most-fixed (3 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Use After Free: Parallel compilations and rehashing within the global flat_hash_map of the GPU kernel compiler cache invalidated active pointer references, leading to use-after-free conditions. Subsequent fixes required moving to heap-allocated structures and structured insertions to stabilize memory lifetimes.

Memory Corruption: Integer overflows in pointer and dimension calculations within batched GPU linear algebra and RNN kernels led to memory wraps, causing severe out-of-bounds corruption during copy operations.

Command Injection: Insecure direct expansion of untrusted runner context variables inside shell scripts enabled command injection. These issues were resolved by passing parameters strictly as environment variables rather than using inline template interpolation.