Cairn

Tar extraction safety in curator rollback

NousResearch/hermes-agent · cluster 23794 · agent

Data as of

2 open items. Fix attempted, not merged.

The short answer

2open issues
0open PRs
3items grouped
Known?
Yes. 3 related items grouped here, 0 issues already closed.
Fix event
No fix has been merged to main. 1 PR closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
2 issues and 0 PRs. Broad area: open items may be separate problems.

These items address missing or insufficient validation of tar archive members during curator rollback, specifically targeting unsafe members and symlinks that could pose security risks during extraction.

Open issues2

  • Issue#23794Reject tar links during curator rollback
  • Issue#65556tarfile.extractall fallback path at curator_backup.py:634 lacks member validation

Open PRs0

No open pull requests.

1 PR closed without merging

From the close comments: stale or abandoned 1

  • #23796 Reject unsafe curator rollback tar members · stale or abandoned
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.45: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Closed issues
0
Attempts
1 PR closed without merging

For your agent

The same facts, typed.

cluster/23794.json
cluster/23794.md