A Self-Hosted Code Review Bot Invented a CVE That Was Never Issued

说明与用途

BuaJi 代码审查机器人生成了包含不存在的 CVE 标识符的虚假报告，可能导致工程师采取错误行动。Docker 通过将机器人迁移到 Docker Sandbox 并添加对 NIST NVD 的 CVE 查询来缓解此问题，降低了未验证发现的风险。

问题

A self‑hosted code review bot produced a fabricated security report that included a non‑existent CVE identifier, leading to potential mis‑action by engineers.

结果

The incident demonstrated that a read‑only code review bot can still produce convincing but fabricated security findings. Docker’s fix moved the bot into a sandboxed environment and added a CVE lookup step, reducing the risk of unverified claims influencing human decisions.

工作流

• 1. Configure GitLab CI job to run BuaJi inside a Docker Sandbox using sbx run -d with a read‑only repository mount.
• 2. Pass only OLLAMA_URL and minimal environment variables to the sandbox; omit CI_JOB_TOKEN, kubeconfig, and cloud credentials.
• 3. Allow network access to localhost:11434 (Ollama model port) via sbx policy allow network.
• 4. Execute the review script that reads the diff, queries the local Ollama model, and writes a comment.
• 5. Perform a lookup against the NIST National Vulnerability Database for any CVE identifiers in the comment; if not found, fail the job.
• 6. Clean up the sandbox in after_script, ensuring it is removed even on failure.

证据

BuaJi rejected it in about 1,500 words. The report called the bump an "architectural takeover", a structural change smuggled in under cover of maintenance.

来源

Docker’s remediation moves the read‑only rule into a Docker Sandbox microVM: a read‑only mount, no credentials and one open network path to the model server.

来源

A CVE identifier is a public registry entry anyone can check in seconds.

来源