Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

neuron-core/neuron-ai

              3.x @ 8a8d095
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

SQL Injection: 5 prior fixes. Scrutinize any change in this area.

src/Tools/Toolkits/MySQL/MySQLSelectTool.php: most-fixed (4 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Insecure direct execution and a weak initial blacklist allowed attackers to read and potentially write files on the underlying filesystem by bypassing SQL string validation, leading to remote compromise. This is tracked under CVE-2025-67509.

SQL Injection: Execution of raw concatenated query strings within database write tools allowed destructive commands to be run via untrusted inputs and prompt injection, posing a severe risk to data integrity. This is tracked under CVE-2025-67510.

SQL Injection: Malformed parameter binding logic in SELECT tool statements allowed attackers to bypass structural parameter definitions, requiring stricter parameter and schema constraint validation.