Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nvidia-ai-blueprints/video-search-and-summarization

              main @ 0199036
            

Fixes

CVEs

CRITICAL

Peak severity

64.3%

Coverage

Highlights

Information Disclosure: 5 prior fixes. Scrutinize any change in this area.

.github/workflows/skills-eval.yml: most-fixed (2 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multi-paradigm agents executing tools like Bash, Edit, or Write can be subverted via prompt injection to run arbitrary local commands. Transitioning to read-only tool restrictions is vital to maintaining execution integrity.

Command Injection: Unsanitized inputs and environment variables containing newline characters can be used to smuggle flags or inject command sequences into internal shell execution pathways like subprocess.check_output.

Path Traversal: Resolving paths without proper canonicalization and explicit prefix boundary validation allows attackers to traverse directories and access restricted configuration files or sensitive volumes.