Add INC-135 (llmware SQLi) + schema: distinguish tooling CVEs from AI-behaviour incidents - #122
Open
emmanuelgjr wants to merge 2 commits into
Open
emmanuelgjr wants to merge 2 commits into
emmanuelgjr wants to merge 2 commits into
Conversation
…te one INC-132 was allocated twice - by #117 and by #109 - because both read the end of data/incidents.json while the other was open, and the second one only found out when the merge conflicted. A duplicate id also silently breaks anything that resolves an incident by id: the webapp deep link, the evidence join, the reports. validate.js gains checkIncidentIds(), which fails on a duplicate and names it. scripts/next-incident-id.mjs prints a free id; --check-prs also accounts for ids claimed by open pull requests, which is what would have caught this one - it currently reports INC-136, because INC-135 is claimed by open PR #122. The duplicate case is deliberately not tested by mutating data/incidents.json: node --test runs suites in parallel, so writing to the shared corpus races the suites reading it, which is a bug this repository has already had. The guard is covered by a corpus-uniqueness test and a wiring test instead, and was negative-tested by hand: injecting a duplicate made validate.js exit 1 with "INC-006 is used by 2 records". Baseline before: 0 errors, 88 warnings, 327 passed; 85/85 tests. Baseline after : 0 errors, 88 warnings, 328 passed; 89/89 tests, twice. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gautamgb
added a commit
to gautamgb/crosswalk
that referenced
this pull request
Sep 18, 2026
Pillar Security's Deadbugz disclosure: a malicious MCP server serves its documented, benign tool contract for the first two tool calls in a session, then substitutes credential-harvesting instructions on the third call. A connect-and-check review never crosses the threshold, so this is invisible to single-session auditing by construction. Renumbered from INC-132 to INC-136: GenAI-Security-Project#117 claimed 132-134 while this was open, GenAI-Security-Project#122 (open) claims 135. Category is research-demonstrated, not real-world: the schema defines real-world as a confirmed incident, and this entry's own impact field says no compromise was confirmed, 23 delivery PRs opened, none merged. INC-126 is the one other entry in the dataset with comparable unconfirmed-impact language and it carries the same category. Mapped to ASI01 (goal hijack), ASI02 (tool misuse), ASI04 (agentic supply chain). Source: https://www.pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign
…ord is CVE-2026-85689: llmware 0.4.6 interpolates filter and lookup values straight into SQL WHERE clauses in both backends, so an attacker-controlled filter neutralises the caller's scoping and returns rows from other documents and collections; on PostgreSQL it is full boolean/UNION injection. The record states its status plainly rather than implying a tidy disclosure: the CNA is VulnCheck rather than the vendor, the 7.1 is VulnCheck's own secondary metric, llmware has published no advisory, the upstream report (llmware-ai/llmware#1304, opened 2026-06-12) is still open with no maintainer response, and no release after the affected 0.4.6 exists. It is recorded as unfixed. **No control_failures.** The instruction was to add one only where a vendor advisory explicitly names a control that failed or was absent. llmware has published no advisory, so no such statement exists and the array is omitted rather than filled from the reporter's words. Schema change — two new optional fields on Incident: incident_class tooling-cve | ai-behaviour. A conventional software vulnerability in GenAI tooling is AI-relevant because of what it exposes, not because the model misbehaved; the index should not blur the two. INC-132..134 are backfilled as tooling-cve, which is what they are. mapping_status draft | sme-confirmed. Says who decided owasp_entries, not anything about the incident. INC-132..135 are all draft: an agent proposed the entries and no SME has signed them. Records predating the fields simply lack them; nothing else is backfilled. Baseline before and after: 0 errors, 88 warnings, 327 passed; 85/85 tests. Incidents 134 -> 135. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
emmanuelgjr
force-pushed
the
feat/incident-llmware-cve
branch
from
September 18, 2026 20:32
0fca06d to
4e0ea86
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Item 1 of the batch. Accepts #82 as an incident under the conditions you set. Closes #82 on merge.
data/incidents-schema.jsonTwo new optional fields on
Incident, flagged here because a schema change deserves its own look:incident_classtooling-cve·ai-behaviourmapping_statusdraft·sme-confirmedowasp_entries, not anything about the incident.draft= an agent proposed the entries from the source text; no SME has signed them.Backfill: INC-132, INC-133 and INC-134 are set to
tooling-cve/draft— that is what they already were. Records predating the fields simply lack them; nothing else is touched, and neither field is required.INC-135
CVE-2026-85689— llmware 0.4.6 interpolates filter and lookup values straight into SQLWHEREclauses in both the SQLite and PostgreSQL backends. The validator "only checks keys against an allow-list and never sanitizes values", so an attacker-controlled filter neutralises the caller's scoping and returns rows from other documents and collections; on PostgreSQL it is full boolean/UNION injection.Entry mapping is DRAFT (
DSGAI13Vector Store Platform Security,DSGAI01Sensitive Data Leakage) — proposed, pending SME review.No
control_failures, deliberatelyYour condition was to add one only if the vendor advisory explicitly states a failed or absent control with a quotable basis. llmware has published no advisory — the repository carries zero GitHub security advisories. The only technical account is the reporter's own, in an upstream issue. Filling
control_failuresfrom the reporter's words would misrepresent whose statement it is, so the array is omitted.The record says what state this is actually in
Unlike INC-133 and INC-134, this one has no tidy disclosure behind it, and the record says so rather than implying otherwise:
llmware-ai/llmware#1304has been open since 2026-06-12 with no maintainer response.Verification
npm run audit:incidents: all 135 records satisfy the schema. Incidents 134 → 135.🤖 Generated with Claude Code