A Self-Hosted Code Review Bot Invented a CVE That Was Never Issued

Description and use

The BuaJi code review bot produced a fabricated report containing a non‑existent CVE identifier, potentially leading to incorrect actions by engineers. Docker mitigated the issue by moving the bot into a Docker Sandbox and adding a CVE lookup against NIST NVD, reducing the risk of unverified findings.

Problem

A self‑hosted code review bot produced a fabricated security report that included a non‑existent CVE identifier, leading to potential mis‑action by engineers.

Outcome

The incident demonstrated that a read‑only code review bot can still produce convincing but fabricated security findings. Docker’s fix moved the bot into a sandboxed environment and added a CVE lookup step, reducing the risk of unverified claims influencing human decisions.

Workflow

• 1. Configure GitLab CI job to run BuaJi inside a Docker Sandbox using sbx run -d with a read‑only repository mount.
• 2. Pass only OLLAMA_URL and minimal environment variables to the sandbox; omit CI_JOB_TOKEN, kubeconfig, and cloud credentials.
• 3. Allow network access to localhost:11434 (Ollama model port) via sbx policy allow network.
• 4. Execute the review script that reads the diff, queries the local Ollama model, and writes a comment.
• 5. Perform a lookup against the NIST National Vulnerability Database for any CVE identifiers in the comment; if not found, fail the job.
• 6. Clean up the sandbox in after_script, ensuring it is removed even on failure.

Evidence

BuaJi rejected it in about 1,500 words. The report called the bump an "architectural takeover", a structural change smuggled in under cover of maintenance.

Source

Docker’s remediation moves the read‑only rule into a Docker Sandbox microVM: a read‑only mount, no credentials and one open network path to the model server.

Source

A CVE identifier is a public registry entry anyone can check in seconds.

Source