Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

neuml/txtai

              master @ 13b1a0f
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

src/python/txtai/api/application.py: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Dynamic SQL parsing during column and bracket expression resolution allowed injection because of unescaped quotes. Developers must ensure all user-influenced query parameters are properly escaped or parameterized.

Path Traversal: CVE-2025-10854 highlights a critical vulnerability where untrusted, compressed tar files representing embedding indices could exploit symbolic links to achieve arbitrary file writes. Strict validation of symbolic links is required when extraction occurs.

Auth Bypass: Missing API authentication dependencies could allow unauthorized requests to endpoints. Centralized FastAPI lifespan and token authorization middleware must be enforced across all API startup paths.