Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pydata/xarray
main @ 8ea7c88
4
Fixes
0
CVEs
HIGH
Peak severity
75.0%
Coverage
Highlights
Command Injection: 2 prior fixes. Scrutinize any change in this area.
.github/workflows/benchmarks-last-release.yml: most-fixed (1 issue). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Untrusted PR head label is interpolated directly into an echo command in a GitHub Actions workflow, enabling script injection via crafted labels.
Command Injection: Multiple workflow steps interpolate untrusted tag/label values into shell commands and use unpinned action versions, increasing supply-chain and injection risk.
Expression Injection: The evaluator previously used pandas.eval which allows dangerous expressions; now uses AST validation but must ensure all evaluation entry points enforce the same checks.