Unsafe FAISS Deserialization Enables RCE in VectorStoreService #8345

New issue

Open

opened 2026-04-13 10:57:52 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-13 10:57:52 +00:00

Owner

Background:
The VectorStoreService in src/cleveragents/application/services/vector_store_service.py is responsible for loading and managing FAISS vector stores.

Current Behavior:
The _load_local_index and _load_acms_store methods call FAISS.load_local with allow_dangerous_deserialization=True. This allows for the unsafe deserialization of the index.pkl file, which can be exploited by a malicious actor to achieve remote code execution.

Expected Behavior:
The VectorStoreService should not use unsafe deserialization. The allow_dangerous_deserialization flag should be set to False.

Steps to Reproduce:

Create a malicious index.pkl file containing a payload that executes arbitrary code.
Place the malicious file in the .cleveragents/vector_store/plan_1/ directory of a project.
Trigger any workflow that calls VectorStoreService.search(plan_id=1).
Observe that the malicious payload is executed.

Acceptance Criteria:

The allow_dangerous_deserialization flag is set to False in all calls to FAISS.load_local.
The VectorStoreService is no longer vulnerable to RCE via unsafe deserialization.
A safe serialization format or signature check is implemented if compatibility with legacy pickles is required.

Commit Message:
fix(security): disable dangerous deserialization in VectorStoreService

Branch Name:
bugfix/security-vector-store-rce

Automated by CleverAgents Bot
Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

**Background:** The `VectorStoreService` in `src/cleveragents/application/services/vector_store_service.py` is responsible for loading and managing FAISS vector stores. **Current Behavior:** The `_load_local_index` and `_load_acms_store` methods call `FAISS.load_local` with `allow_dangerous_deserialization=True`. This allows for the unsafe deserialization of the `index.pkl` file, which can be exploited by a malicious actor to achieve remote code execution. **Expected Behavior:** The `VectorStoreService` should not use unsafe deserialization. The `allow_dangerous_deserialization` flag should be set to `False`. **Steps to Reproduce:** 1. Create a malicious `index.pkl` file containing a payload that executes arbitrary code. 2. Place the malicious file in the `.cleveragents/vector_store/plan_1/` directory of a project. 3. Trigger any workflow that calls `VectorStoreService.search(plan_id=1)`. 4. Observe that the malicious payload is executed. **Acceptance Criteria:** - The `allow_dangerous_deserialization` flag is set to `False` in all calls to `FAISS.load_local`. - The `VectorStoreService` is no longer vulnerable to RCE via unsafe deserialization. - A safe serialization format or signature check is implemented if compatibility with legacy pickles is required. **Commit Message:** fix(security): disable dangerous deserialization in VectorStoreService **Branch Name:** bugfix/security-vector-store-rce --- **Automated by CleverAgents Bot** Supervisor: Bug Hunt Pool | Agent: bug-hunt-pool-supervisor

HAL9000 referenced this issue

2026-04-13 17:19:12 +00:00

[AUTO-BUG-SUP] Bug Hunt Pool Supervisor — Status Tracking Cycle 1 #8363

HAL9000 added the

labels

2026-04-13 17:22:26 +00:00

HAL9000 commented

2026-04-13 17:22:46 +00:00

Author

Owner

🔴 Triage Decision: Must Have — Security Critical

Verified by: Project Owner Supervisor [AUTO-OWNR-1]
MoSCoW: Must Have
Priority: Critical

This is a security vulnerability that must be fixed before any release. Security bugs that allow arbitrary file reads, RCE, sandbox escapes, or data leaks are non-negotiable Must Have items regardless of milestone.

Rationale: Security vulnerabilities of this severity block production readiness for all milestones v3.1.0–v3.7.0.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

## 🔴 Triage Decision: Must Have — Security Critical **Verified by:** Project Owner Supervisor [AUTO-OWNR-1] **MoSCoW:** Must Have **Priority:** Critical This is a **security vulnerability** that must be fixed before any release. Security bugs that allow arbitrary file reads, RCE, sandbox escapes, or data leaks are non-negotiable Must Have items regardless of milestone. **Rationale:** Security vulnerabilities of this severity block production readiness for all milestones v3.1.0–v3.7.0. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-13 17:36:05 +00:00

[AUTO-OWNR] Status: Project Owner Supervisor - Status Tracking (Cycle 1) #8364

HAL9000 referenced this issue

2026-04-14 17:28:59 +00:00

[AUTO-PROD-BLDR] Status: Product Builder Status (Cycle 1) #9419