Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ontos-ai/knowhere

              main @ 10e1a1d
            

Fixes

CVEs

HIGH

Peak severity

62.5%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

packages/shared-python/shared/utils/url_security.py: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: Outbound connections are susceptible to Server-Side Request Forgery (SSRF) and DNS rebinding attacks when parsing external document links. Failure to validate and pin resolved IP addresses allows attackers to access internal-only network resources.

Auth Bypass: The application's security gate previously failed open when essential configurations like INTERNAL_API_SECRET were missing, logging a warning rather than raising an exception and blocking access.

Cryptographic Issues: API keys were historically stored in plain-text format within the database, exposing the system to total credential compromise in the event of database access.