Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
rasahq/rasa_core
master @ 48cb1cf
8
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Denial of Service: 5 prior fixes. Scrutinize any change in this area.
rasa_core/policies/mapping_policy.py: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Inadequate sanitization of user-controlled intent names and message texts during graph creation can allow injection vectors that lead to downstream command execution. Ensure strict regex-based sanitization of all visualized metadata.
Auth Bypass: Misconfigured token checks can expose critical administrative and dialogue management endpoints without proper authentication when JWT configurations are active but token validation is bypassed. Enforce strict, non-conditional verification on all protected endpoints.
Denial of Service: The application is prone to server crashes (TypeError) when mapping actions if the mapped target index is unexpectedly None. Safe indexing checks are required before attempting assignments.