Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

stanfordnlp/dspy

              main @ 4987601
            

Fixes

CVEs

HIGH

Peak severity

57.1%

Coverage

Highlights

Sandbox Escape: 2 prior fixes. Scrutinize any change in this area.

dspy/primitives/python_interpreter.py: most-fixed (4 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: The sandbox environment responsible for running LLM-generated Python code has suffered from multiple vulnerabilities, including direct arbitrary code execution via local execution and insufficient restriction of sandboxed execution permissions. Hardening the Deno and Pyodide configurations is critical to preventing host compromise.

Deserialization of Untrusted Data: The use of pickle.load in the disk caching mechanism allowed for arbitrary code execution if a user loaded a malicious or compromised cache file, requiring the introduction of a restricted, opt-in deserialization path.

Path Traversal: Improper path canonicalization and verification allowed sandbox execution command options to read or write to unauthorized host directories, leading to arbitrary host file disclosure.