Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ruvnet/ruvector
main @ 85d2314
63
Fixes
0
CVEs
CRITICAL
Peak severity
10.3%
Coverage
Highlights
Denial of Service: 37 prior fixes. Scrutinize any change in this area.
crates/ruvector-postgres/src/index/hnsw_am.rs: most-fixed (5 issues). Treat as high-risk during review.
39 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
SQL Injection: The tenancy isolation mechanism constructed SQL statements using direct string formatting (format!), risking total tenant data leakage. Developers must enforce strict identifier quoting via quote_identifier and parameter placeholders.
OS Command Injection: The Model Context Protocol worker creation system invoked child_process.execSync with unsanitized parameters, allowing arbitrary shell command execution. Untrusted inputs must never be directly interpolated into shell executors.
Memory Safety: Direct slice creation from raw pointers (core::slice::from_raw_parts) based on unvalidated page data allowed out-of-bounds reads and segment faults. Explicit page-boundary checks are required before parsing any raw memory segments.