From f0c337eb01fb0c98f435da9d93f0987b78a5ab64 Mon Sep 17 00:00:00 2001 From: Owen McGirr Date: Sat, 17 Oct 2026 10:51:59 +0100 Subject: [PATCH 1/3] Scope the neural audit around the zip 8.6 advisories Candle cannot avoid candle-core 0.11.0, the newest release, requires zip ^8.6.0, and the fix for RUSTSEC-2026-0367 and RUSTSEC-2026-0369 is in zip 9. Candle only reads archive entries and never extracts to disk, and the worker loads only the pinned safetensors model, so the audit ignores the two advisories and SECURITY.md records why. Closes #44 Co-Authored-By: Claude Fable 5.1 --- .github/workflows/neural.yml | 4 ++-- neural/SECURITY.md | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/neural.yml b/.github/workflows/neural.yml index d9c4a7a..f285f07 100644 --- a/.github/workflows/neural.yml +++ b/.github/workflows/neural.yml @@ -101,5 +101,5 @@ jobs: - uses: dtolnay/rust-toolchain@4716b85f2fac3e324e64fa2810f6b5c3905760a5 - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 - run: cargo install cargo-audit --locked --version 0.22.0 - # Scoped, documented maintenance-only exception. Root CI remains unchanged. - - run: cargo audit --file neural/Cargo.lock --deny warnings --ignore RUSTSEC-2024-0436 + # Scoped, documented exceptions (see neural/SECURITY.md). Root CI remains unchanged. + - run: cargo audit --file neural/Cargo.lock --deny warnings --ignore RUSTSEC-2024-0436 --ignore RUSTSEC-2026-0367 --ignore RUSTSEC-2026-0369 diff --git a/neural/SECURITY.md b/neural/SECURITY.md index e253574..3c00438 100644 --- a/neural/SECURITY.md +++ b/neural/SECURITY.md @@ -2,7 +2,10 @@ This companion is opt-in. It does not change the root crate's dependencies or audit policy. -The neural dependency audit uses `cargo audit --file neural/Cargo.lock --deny warnings --ignore RUSTSEC-2024-0436`. This single exception covers `paste` 1.0.15, an unmaintained build-time macro dependency of Candle. The advisory reports maintenance status, not a known memory-safety exploit. Replacement requires an upstream-compatible Candle update or an independently reviewed patch. Review this exception at each dependency update. No other advisory is ignored. The root audit still denies all warnings. +The neural dependency audit uses `cargo audit --file neural/Cargo.lock --deny warnings` with three documented exceptions. No other advisory is ignored, and the root audit still denies all warnings. Review every exception at each dependency update. + +- `RUSTSEC-2024-0436` covers `paste` 1.0.15, an unmaintained build-time macro dependency of Candle. The advisory reports maintenance status, not a known memory-safety exploit. Replacement requires an upstream-compatible Candle update or an independently reviewed patch. +- `RUSTSEC-2026-0367` and `RUSTSEC-2026-0369` cover `zip` 8.6.0, which `candle-core` 0.11.0 requires as `^8.6.0`. Both advisories concern `ZipArchive::extract()` and `ZipStreamReader::extract()` writing Unix permission bits and symlink targets to disk from attacker-controlled archives; the fix is in `zip` 9, a semver-major change that no released Candle accepts. Candle uses `zip` only to read entries of `.npz` and PyTorch pickle files through `ZipArchive::new` and never calls `extract()`, and the worker loads only the hash-pinned safetensors model, so no archive is extracted to disk. Remove these two exceptions when Candle moves to `zip` 9. Worker files are executable code supplied by the embedding application. Install them in a directory writable only by trusted users. The model manifest is not a signature; compatibility comes from hashes compiled into the library. Runtime loading hashes the exact owned bytes used by inference. The worker has no network API, file writes, clipboard access or input-injection code. Process isolation bounds hangs and crashes; it is not an operating-system security sandbox. From 44c244888dcbd6ac12487b2bd034da40daaf15a5 Mon Sep 17 00:00:00 2001 From: Owen McGirr Date: Sat, 17 Oct 2026 10:52:32 +0100 Subject: [PATCH 2/3] Name the GGUF model in the audit exception Co-Authored-By: Claude Fable 5.1 --- neural/SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/neural/SECURITY.md b/neural/SECURITY.md index 3c00438..5f31484 100644 --- a/neural/SECURITY.md +++ b/neural/SECURITY.md @@ -5,7 +5,7 @@ This companion is opt-in. It does not change the root crate's dependencies or au The neural dependency audit uses `cargo audit --file neural/Cargo.lock --deny warnings` with three documented exceptions. No other advisory is ignored, and the root audit still denies all warnings. Review every exception at each dependency update. - `RUSTSEC-2024-0436` covers `paste` 1.0.15, an unmaintained build-time macro dependency of Candle. The advisory reports maintenance status, not a known memory-safety exploit. Replacement requires an upstream-compatible Candle update or an independently reviewed patch. -- `RUSTSEC-2026-0367` and `RUSTSEC-2026-0369` cover `zip` 8.6.0, which `candle-core` 0.11.0 requires as `^8.6.0`. Both advisories concern `ZipArchive::extract()` and `ZipStreamReader::extract()` writing Unix permission bits and symlink targets to disk from attacker-controlled archives; the fix is in `zip` 9, a semver-major change that no released Candle accepts. Candle uses `zip` only to read entries of `.npz` and PyTorch pickle files through `ZipArchive::new` and never calls `extract()`, and the worker loads only the hash-pinned safetensors model, so no archive is extracted to disk. Remove these two exceptions when Candle moves to `zip` 9. +- `RUSTSEC-2026-0367` and `RUSTSEC-2026-0369` cover `zip` 8.6.0, which `candle-core` 0.11.0 requires as `^8.6.0`. Both advisories concern `ZipArchive::extract()` and `ZipStreamReader::extract()` writing Unix permission bits and symlink targets to disk from attacker-controlled archives; the fix is in `zip` 9, a semver-major change that no released Candle accepts. Candle uses `zip` only to read entries of `.npz` and PyTorch pickle files through `ZipArchive::new` and never calls `extract()`, and the worker loads only the hash-pinned GGUF model from the bundle, so no archive is extracted to disk. Remove these two exceptions when Candle moves to `zip` 9. Worker files are executable code supplied by the embedding application. Install them in a directory writable only by trusted users. The model manifest is not a signature; compatibility comes from hashes compiled into the library. Runtime loading hashes the exact owned bytes used by inference. The worker has no network API, file writes, clipboard access or input-injection code. Process isolation bounds hangs and crashes; it is not an operating-system security sandbox. From ec7575085ca1d1f13f14bbceaf19469e7e45579b Mon Sep 17 00:00:00 2001 From: Owen McGirr Date: Sat, 17 Oct 2026 11:04:17 +0100 Subject: [PATCH 3/3] Ignore RUSTSEC-2026-0368 as well and note Candle's ZipWriter use Co-Authored-By: Claude Fable 5.1 --- .github/workflows/neural.yml | 2 +- neural/SECURITY.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/neural.yml b/.github/workflows/neural.yml index f285f07..ebaa0af 100644 --- a/.github/workflows/neural.yml +++ b/.github/workflows/neural.yml @@ -102,4 +102,4 @@ jobs: - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 - run: cargo install cargo-audit --locked --version 0.22.0 # Scoped, documented exceptions (see neural/SECURITY.md). Root CI remains unchanged. - - run: cargo audit --file neural/Cargo.lock --deny warnings --ignore RUSTSEC-2024-0436 --ignore RUSTSEC-2026-0367 --ignore RUSTSEC-2026-0369 + - run: cargo audit --file neural/Cargo.lock --deny warnings --ignore RUSTSEC-2024-0436 --ignore RUSTSEC-2026-0367 --ignore RUSTSEC-2026-0368 --ignore RUSTSEC-2026-0369 diff --git a/neural/SECURITY.md b/neural/SECURITY.md index 5f31484..19b8033 100644 --- a/neural/SECURITY.md +++ b/neural/SECURITY.md @@ -2,10 +2,10 @@ This companion is opt-in. It does not change the root crate's dependencies or audit policy. -The neural dependency audit uses `cargo audit --file neural/Cargo.lock --deny warnings` with three documented exceptions. No other advisory is ignored, and the root audit still denies all warnings. Review every exception at each dependency update. +The neural dependency audit uses `cargo audit --file neural/Cargo.lock --deny warnings` with four documented exceptions. No other advisory is ignored, and the root audit still denies all warnings. Review every exception at each dependency update. - `RUSTSEC-2024-0436` covers `paste` 1.0.15, an unmaintained build-time macro dependency of Candle. The advisory reports maintenance status, not a known memory-safety exploit. Replacement requires an upstream-compatible Candle update or an independently reviewed patch. -- `RUSTSEC-2026-0367` and `RUSTSEC-2026-0369` cover `zip` 8.6.0, which `candle-core` 0.11.0 requires as `^8.6.0`. Both advisories concern `ZipArchive::extract()` and `ZipStreamReader::extract()` writing Unix permission bits and symlink targets to disk from attacker-controlled archives; the fix is in `zip` 9, a semver-major change that no released Candle accepts. Candle uses `zip` only to read entries of `.npz` and PyTorch pickle files through `ZipArchive::new` and never calls `extract()`, and the worker loads only the hash-pinned GGUF model from the bundle, so no archive is extracted to disk. Remove these two exceptions when Candle moves to `zip` 9. +- `RUSTSEC-2026-0367`, `RUSTSEC-2026-0368` and `RUSTSEC-2026-0369` cover `zip` 8.6.0, which `candle-core` 0.11.0 requires as `^8.6.0`. All three advisories concern `ZipArchive::extract()` and `ZipStreamReader::extract()` writing attacker-controlled archives to disk: SUID and SGID bits are kept, permissions are applied through symlinks, and symlink targets may resolve outside the destination directory; the fix is in `zip` 9, a semver-major change that no released Candle accepts. Candle uses `zip` only to read `.npz` and PyTorch pickle entries through `ZipArchive::new` and to write `.npz` files through `ZipWriter`; it never calls `extract()`, and the worker loads only the hash-pinned GGUF model from the bundle, so no archive is extracted to disk. Remove these three exceptions when Candle moves to `zip` 9. Worker files are executable code supplied by the embedding application. Install them in a directory writable only by trusted users. The model manifest is not a signature; compatibility comes from hashes compiled into the library. Runtime loading hashes the exact owned bytes used by inference. The worker has no network API, file writes, clipboard access or input-injection code. Process isolation bounds hangs and crashes; it is not an operating-system security sandbox.