Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
modelscope/funasr
main @ 2662e5c
10
Fixes
0
CVEs
CRITICAL
Peak severity
33.3%
Coverage
Highlights
Denial of Service: 7 prior fixes. Scrutinize any change in this area.
funasr/bin/_server_app.py: most-fixed (1 issue). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Code Injection: The training entry point utilized the unsafe python 'eval' built-in to parse user-supplied parameters and training metrics, allowing arbitrary shell command execution under the privilege context of the running process.
Memory Safety: An integer type mismatch during ONNX runtime mutable data retrieval caused direct heap corruption, while copying operations suffered from double-free liabilities and persistent memory leaks in C++ code.
Denial of Service: Unsigned integer underflow occurred when processing input waveforms smaller than the expected frame sample size, yielding an out-of-bounds memory read and crashing the execution daemon.