Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

uptrace/bun

              master @ 21dd551
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

SQL Injection: 2 prior fixes. Scrutinize any change in this area.

driver/pgdriver/format.go: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SQL Injection: Improper spacing when appending negative numbers following a minus operator could allow attackers to generate accidental SQL comments, leading to query truncation and SQL injection. This is tracked under CVE-2024-34359.

SQL Injection: Failing to enforce standard_conforming_strings and UTF8 client encoding during initialization allows attackers to leverage multibyte character sets and backslash escapes to bypass SQL sanitizers.