Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

xberg-io/kreuzberg

              main @ 2cc3163
            

Fixes

CVEs

HIGH

Peak severity

36.1%

Coverage

Highlights

Denial of Service: 33 prior fixes. Scrutinize any change in this area.

crates/kreuzberg-ffi: most-fixed (5 issues). Treat as high-risk during review.

20 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The DOCX extractor previously utilized weak string-based path matching for archive extraction and image lookup, allowing files to be written outside the target directory. Secure development requires component-based path traversal validation instead of raw string manipulation.

Denial of Service: Processing complex, compressed, or recursive document types (like ZIP, HWPX, and EPUB files) without explicit resource limit checks has historically led to decompression bomb (zip bomb) attacks and out-of-memory errors. General utility parsers must enforce strict budget validations.

SSRF: Parsing untrusted SVG structures permitted remote image resolution, exposing the application to SSRF vectors. Mitigating this required replacing the default SVG href resolver with a secure no-op placeholder and stripping sensitive tags/scripts.