GHSA-m9gh-5x7v-rqj2: 
JavaScript vulnerability analysis and mitigation

Summary

Plugins listed in .ragrc.json were loaded without the signature verification the documentation described, also in production with signature verification enabled. Separately, rag-pipeline hub install's security scan could miss a plugin's entry file, and its stage-contract check ran the plugin with the installing process's full environment, including credentials in environment variables. Fixed in 3.8.2.

Details

Affected package

Main package only: the plugin loader (src/config), install scanner and contract probe (src/ecosystem) are not in any scoped package. 3.8.2 also changes PluginSignatureVerifier and PluginRegistry (in @devilsdev/rag-core), but only to share one signature check and add two public methods; the vulnerability is not in them.

Severity per issue

• Configured plugins loading without the documented signature check: high.
• The install scan missing the entry file, and the contract check getting the full environment: medium.

Patches

3.8.2. Configured plugins are verified before they load when the shared pluginRegistry verifies signatures (by default in production); a plugin whose manifest fails verification is not loaded, and an unsigned one loads with a warning unless requireSignedPlugins is set. The install scan covers the entry file whatever its extension and the files it loads by relative path; the contract check gets only PATH (plus SystemRoot and TEMP on Windows).

Workarounds

Load plugins through pluginRegistry.register() with a signed manifest instead of .ragrc.json. Review plugins before installing them, and install with an environment that holds no credentials.

Proof of concept

Step-by-step reproduction details are withheld for now so that users have time to upgrade. The affected configurations are described under Details and Impact. Release 3.8.2 adds regression tests for each issue in this advisory; they fail on 3.8.1 and pass on 3.8.2.

Impact

• Applications that list plugins in .ragrc.json and rely on signature verification: a tampered or unsigned plugin loaded as if it had been verified.
• Users of rag-pipeline hub install: high-risk code in a plugin's entry file could go unreported and not block the install, and the stage-contract check ran the plugin with the full environment of the installing process, including credentials in environment variables.