Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
qualcomm/nexa-sdk
main @ b229880
3
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Information Disclosure: 2 prior fixes. Scrutinize any change in this area.
.github/workflows/_build-sdk.yml: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: Private signing key files (ggml-htp-v1.pfx) were historically committed to the repository. If compromised, these keys could allow attackers to sign malicious payloads that appear legitimate. Future signing flows must strictly ingest keys via repository secrets.
Path Traversal: The Rust model manager accepted model and file names containing NUL bytes or relative directory traversal elements (e.g., '../') directly into file open calls. This could allow an attacker to read or manipulate files outside the intended directories.
Information Disclosure: During client download operations, follow-up HTTP requests to redirected external hosts carried over sensitive Authorization headers, exposing authorization tokens to third-party endpoints.