🛡️ Sentinel: [CRITICAL] Fix SQL injection vulnerability in pgvector table configuration - #273
🛡️ Sentinel: [CRITICAL] Fix SQL injection vulnerability in pgvector table configuration#273Himan-D wants to merge 1 commit into
Conversation
…tion Co-authored-by: Himan-D <262577684+Himan-D@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
agent-memorydash | a26843d | Jul 13 2026, 05:44 AM |
|
Agent guard: Please use Conventional Commits PR titles, e.g. |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
hystersis-app | a26843d | Jul 13 2026, 05:48 AM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
hystersis-docs | a26843d | Jul 13 2026, 05:52 AM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
agent-memory | a26843d | Jul 13 2026, 05:54 AM |
1 participant
🚨 Severity: CRITICAL
💡 Vulnerability: The table name for pgvector queries (
c.cfg.Table) was concatenated directly into SQL queries usingfmt.Sprintfwithout validation. Since table names cannot be parameterized, this left the application vulnerable to SQL injection if the configuration value was manipulated.🎯 Impact: An attacker could manipulate the
PGVECTOR_TABLEenvironment variable to execute arbitrary SQL commands on the PostgreSQL database.🔧 Fix: Added validation in
NewClientto ensure the table name strictly conforms to^[a-zA-Z0-9_.]+$before any queries are constructed.✅ Verification: Run
go test ./...to verify functionality. The validation safely allows periods for schema-qualified table names (e.g.,public.my_vectors).PR created automatically by Jules for task 12254397750249766421 started by @Himan-D