A Self-Hosted Code Review Bot Invented a CVE That Was Never Issued

Описание и применение

Бот‑ревьюер BuaJi, работающий в CI‑pipeline, сгенерировал фиктивный отчёт с несуществующим CVE‑идентификатором, что могло привести к ошибочным действиям инженеров. Docker перенёс бота в изолированную среду Docker Sandbox и добавил проверку CVE‑идентификаторов через NIST NVD, тем самым снизив риск недостоверных выводов.

Задача

A self‑hosted code review bot produced a fabricated security report that included a non‑existent CVE identifier, leading to potential mis‑action by engineers.

Результат

The incident demonstrated that a read‑only code review bot can still produce convincing but fabricated security findings. Docker’s fix moved the bot into a sandboxed environment and added a CVE lookup step, reducing the risk of unverified claims influencing human decisions.

Рабочий процесс

• 1. Configure GitLab CI job to run BuaJi inside a Docker Sandbox using sbx run -d with a read‑only repository mount.
• 2. Pass only OLLAMA_URL and minimal environment variables to the sandbox; omit CI_JOB_TOKEN, kubeconfig, and cloud credentials.
• 3. Allow network access to localhost:11434 (Ollama model port) via sbx policy allow network.
• 4. Execute the review script that reads the diff, queries the local Ollama model, and writes a comment.
• 5. Perform a lookup against the NIST National Vulnerability Database for any CVE identifiers in the comment; if not found, fail the job.
• 6. Clean up the sandbox in after_script, ensuring it is removed even on failure.

Доказательства

BuaJi rejected it in about 1,500 words. The report called the bump an "architectural takeover", a structural change smuggled in under cover of maintenance.

Источник

Docker’s remediation moves the read‑only rule into a Docker Sandbox microVM: a read‑only mount, no credentials and one open network path to the model server.

Источник

A CVE identifier is a public registry entry anyone can check in seconds.

Источник