Skip to content

docs(adr): accept residual rustyscript transitive-CVE risk (#193) - #236

Merged
hanthor merged 1 commit into
tuna-os:mainfrom
castrojo:sec-check/rustyscript-residual-cve-risk
Oct 31, 2026
Merged

docs(adr): accept residual rustyscript transitive-CVE risk (#193)#236
hanthor merged 1 commit into
tuna-os:mainfrom
castrojo:sec-check/rustyscript-residual-cve-risk

Conversation

@castrojo

@castrojo castrojo commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

Summary

Resolves #193 (sec-check: unresolved known CVEs in rustyscript transitive dependencies).

The scripting feature embeds rustyscript 0.12.3, whose deno_core/deno_crypto/swc_ecma_* stack transitively pins rsa 0.9.10 (CVE-2023-49092 Marvin attack), rand 0.8.5 (RUSTSEC-2026-0097), and unmaintained bincode/smartstring/unic-*.

This is not bumptable: rustyscript is at its latest stable release (0.12.3) and rsa has no fixed stable version (0.10.0 is pre-release only), so there is no dependency move that clears the CVEs. Disabling the scripting feature by default was considered but rejected — it is core to dualcut's dual-mode product (ADR 0002).

Change

  • Add docs/adr/0005-rustyscript-residual-cve-risk.md recording the accepted residual risk, rationale, mitigations (127.0.0.1-only HTTP API; narrow attacker model), and the revisit trigger (bump when rustyscript/rsa release fixed dependencies).
  • Point the rustyscript dependency comment in engine/Cargo.toml at the ADR.

Docs-only change; no build, schema, or test impact.

Closes #193

— hive: backend=omp model=lab-worker/ornith

@castrojo
docs(adr): accept residual rustyscript transitive-CVE risk (tuna-os#193)
e3c11e7 
The scripting feature embeds rustyscript 0.12.3, whose deno_core/deno_crypto
stack transitively pins rsa 0.9.10 (CVE-2023-49092 Marvin attack), rand 0.8.5
(RUSTSEC-2026-0097), and unmaintained bincode/smartstring/unic-*. rustyscript
is at its latest stable release and rsa has no fixed stable version (0.10.0 is
pre-release only), so there is no dependency to bump to.

Record this as an accepted residual risk in ADR 0005 with the rationale
(scripting is core to the dual-mode product, ADR 0002), the mitigations
(127.0.0.1-only HTTP API, narrow attacker model), and the revisit trigger
(bump when rustyscript/rsa release fixed deps). Point the rustyscript
Cargo.toml comment at the ADR.

Hive-Run: tuna-os#193
Hive-Plan: ADR 0005 - document residual rustyscript CVE risk
Hive-Spec: sec-check#193
Signed-off-by: Jorge O. Castro <jorge.castro@gmail.com>
@castrojo castrojo mentioned this pull request Oct 22, 2026
Closed
@hanthor-hive-agent

hanthor-hive-agent Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor
e3c11e7

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @castrojo, head e3c11e7df7ca) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

  • sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
    • engine/Cargo.toml

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

@hanthor

hanthor commented Oct 31, 2026

Copy link
Copy Markdown
Member

Sentinel reviewed (hanthor): benign. The change is docs only: a new ADR plus a pointer in an existing Cargo.toml comment, with no dependency or version change. Maintainer decision: accept the documented residual risk. rustyscript 0.12.3 is the latest stable release and no fixed rsa release exists. scripting is core to the product (ADR 0002), and the repo is deprecated in favour of shrimply, so a fork or migration is not justified here. The ADR records when to revisit. CI is green. Merging.

hanthor
hanthor approved these changes Oct 31, 2026
View reviewed changes

@hanthor hanthor left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Documents an accepted, tracked risk; LGTM.

@hanthor
hanthor merged commit d4dcb66 into tuna-os:main Oct 31, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hanthor hanthor hanthor approved these changes
@KiKaraage KiKaraage Awaiting requested review from KiKaraage KiKaraage is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[sec-check] Unresolved known CVEs in rustyscript transitive dependencies

2 participants

@castrojo @hanthor