Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jazzband/django-pipeline
master @ d404c47
2
Fixes
0
CVEs
CRITICAL
Peak severity
100.0%
Coverage
Highlights
Command Injection: 1 prior fix. Scrutinize any change in this area.
pipeline/compilers/__init__.py: most-fixed (2 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: The compiler historically invoked subprocess.Popen with shell=True and string interpolation, allowing malicious file names or config values to inject shell commands. This is the highest-severity risk and must never regress.
Insecure Permissions: Compiled output files were moved via shutil.move without explicit permissions, potentially exposing sensitive assets to unauthorized reads. The fix enforced 0644 permissions, but any new output path must replicate this.