Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

transformerlab/transformerlab-api

              main @ 5a8f71e
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Path Traversal: 18 prior fixes. Scrutinize any change in this area.

transformerlab/routers/data.py: most-fixed (8 issues). Treat as high-risk during review.

22 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: The dataset preview endpoints are a highly targeted surface where inadequate validation historically allowed traversing out of dataset directories via uncanonicalized paths, symlink attacks, and unsafe file reads. Remediation required multi-layered defenses including parent containment checks and symlink rejection.

Server-Side Template Injection: The dataset preview endpoint was vulnerable to template injection via dynamic Jinja2 compilation, potentially leading to remote code execution. This required restricting the template engine to a strict SandboxedEnvironment.

SSRF: The OpenAI API helper was susceptible to Server-Side Request Forgery when fetching streaming responses, necessitating the implementation of explicit host allowlist checks to block loopback, private, and multicast address ranges.