Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

opencv/cvat

              develop @ 400f7b5
            

117

Fixes

CVEs

CRITICAL

Peak severity

36.7%

Coverage

Highlights

Auth Bypass: 39 prior fixes. Scrutinize any change in this area.

cvat/requirements/base.txt: most-fixed (37 issues). Treat as high-risk during review.

89 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The most frequently fixed vulnerability class, with numerous fixes addressing missing permission checks, incorrect scope mappings, and flawed OPA policy logic across multiple resource types (projects, tasks, jobs, quality reports, lambda requests, webhooks).

Dependency Vulnerability: A large number of fixes are version bumps for known vulnerable dependencies, especially Django, Pillow, and other Python packages, as well as base images. This indicates a historical pattern of running outdated dependencies with known CVEs.

Path Traversal: Multiple path traversal and unauthorized file write vulnerabilities were fixed in file-serving, cloud storage, and data import/export paths, often due to insufficient path validation or user-controlled storage parameters.