Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Unstructured-IO/unstructured

              main @ d68ab0f
            

Fixes

CVEs

CRITICAL

Peak severity

73.3%

Coverage

Highlights

Dependency Vulnerability: 6 prior fixes. Scrutinize any change in this area.

Dockerfile: most-fixed (4 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Dependency Vulnerability: The majority of fixes address known CVEs in transitive and direct dependencies; the attack surface is broad and constantly shifting, requiring continuous upgrades and pining.

Remote Code Execution:

Sandbox Escape / Local File Inclusion: Pypandoc.convert_file was used without sandbox, allowing sandbox escape (ODT) and arbitrary file reads via rst/org include directives (file_conversion). Fixes require explicit ALLOW_PANDOC_NO_SANDBOX env var and sandbox=True respectively.