Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zyddnys/manga-image-translator

              main @ d5a3eee
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Insecure Deserialization: 3 prior fixes. Scrutinize any change in this area.

manga_translator/inpainting/ldm/modules/midas/midas/base_model.py: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Deserialization: Unsafe deserialization using raw pickle loads on public execution endpoints allows attackers to execute arbitrary code remotely. The fix restricted this with an allowlist.

Insecure Deserialization: Processing untrusted server-sent response data using unsafe pickle.loads allowed for arbitrary code execution in the context of the running application.

Insecure Deserialization: Loading untrusted machine learning weights via PyTorch allowed arbitrary code execution. The fix restricted deserialization by enabling weights_only mode.