Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

modeltc/lightllm

              main @ e70fab4
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Denial of Service: 2 prior fixes. Scrutinize any change in this area.

lightllm/server/api_anthropic.py: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: PDF parsing invokes external tools (pdftotext, pdftoppm, pdfinfo) without adequate resource controls, allowing large or complex documents to exhaust CPU/memory.

Denial of Service: Image loading via PIL.Image.open can accept truncated/corrupted files that crash downstream server components; eager decoding on background threads mitigates but does not eliminate risk of resource abuse.

Remote Code Execution: Published CVE-2026-26220 shows unsafe deserialization (CWE-502) in unauthenticated WebSocket endpoints, enabling arbitrary code execution. This is a distinct, high-impact risk not yet addressed in the fixed_issues.