Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

microsoft/markitdown

              main @ e144e0a
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Command Injection: 1 prior fix. Scrutinize any change in this area.

packages/markitdown/src/markitdown/converters/_exiftool.py: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Parsing metadata of untrusted images or audio files with an outdated system installation of ExifTool allows remote attackers to execute arbitrary commands via CVE-2021-22204. Developers must enforce minimum version checks on external binary dependencies before invoking subprocesses.

Path Traversal: Extracting zipped documents (such as Office files) without checking resolved target paths can allow malicious ZIP entries to write files outside the intended extraction directory. This can lead to arbitrary file write and potential code execution.