Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
neo4j-labs/llm-graph-builder
main @ 4a412f4
6
Fixes
0
CVEs
HIGH
Peak severity
20.0%
Coverage
Highlights
Path Traversal: 2 prior fixes. Scrutinize any change in this area.
backend/score.py: most-fixed (2 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Insecure handling of user-supplied filenames in directory paths allowed attackers to write or access files outside the intended uploads directory using relative traversal sequences. This required adding explicit path canonicalization and prefix-matching checks.
Auth Bypass: A logic flaw in enterprise privilege checking allowed accounts lacking read privileges to mistakenly acquire write access, bypassing standard access control mechanisms. Developers must ensure privilege checks explicitly deny unauthorized operations rather than failing open.
Injection: Dynamic Cypher queries constructed with unvalidated input were susceptible to injection attacks, requiring the Neo4j database driver to be explicitly configured with driver-level sanitization.