Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

xberg-io/xberg

              main @ dfbd9b4
            

Fixes

CVEs

HIGH

Peak severity

71.4%

Coverage

Highlights

Path Traversal: 5 prior fixes. Scrutinize any change in this area.

crates/kreuzberg/src/extractors/docx.rs: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Memory Corruption: Incompatible FFI callback signatures between managed languages and the underlying Rust C-ABI can corrupt registers or the stack, leading to remote code execution or process crashes. Developers must strictly match signatures and layout structures across language boundaries.

Path Traversal: Document format parsers (DOCX, PPTX) and archive extraction routines are susceptible to path traversal via malicious filenames. String-based checks are historically bypassable; strict path component canonicalization and prefix verification are required.

XML External Entity (XXE): Parsing XML content inside EPUB files without sanitizing or disabling DOCTYPE declarations enables XXE attacks, which can leak local files or execute SSRF attacks. Input must be pre-processed or the parser explicitly configured to block external entities.