Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

safishamsi/graphify

              v8 @ f9ded63
            

Fixes

CVEs

HIGH

Peak severity

52.0%

Coverage

Highlights

Denial of Service: 7 prior fixes. Scrutinize any change in this area.

graphify/export.py: most-fixed (4 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The application makes outbound requests to fetch resources (like audio downloads and LLM configurations) and has repeatedly required fixes to block private IP ranges, cloud-metadata addresses, and DNS-rebinding/TOCTOU bypasses.

Denial of Service: Parsing untrusted files such as .slnx, .csproj, and .lpk without safeguards previously exposed the system to billion-laughs XXE attacks and resource exhaustion.

Path Traversal: The Model Context Protocol (MCP) server environment was vulnerable to arbitrary file read operations outside of the designated workspace due to inadequate canonicalization and suffix checks.