[uk ai resilience] UK AI Open Code Risk & Resilience Governance — Weekly Review (2026-07-29)

[github-actions[bot]]

Executive Summary

Recent-change window: 7 days (since 2026-07-22), 335 commits, 125 flagged as security-signal (~37%). No new code-scanning alerts, no secret-scanning alerts. All 4 open code-scanning alerts and the highest-severity container CVEs already have active, recently-opened tracking issues (all created 2026-07-06 through 2026-07-28) under the [uk-ai-resilience] label — indicating a mature, functioning governance loop rather than a gap. The dominant residual risk is not new vulnerability discovery but remediation velocity on long-lived recurring findings (GraphQL injection in project_command.go, recurring since 2026-07-01; cache/repo-memory XPIA poisoning, unresolved >6 months).

Asset Graph Summary (recent-change scoped)

Segment	Signal	Tag
pkg/cli/project_command.go (GraphQL injection via Sprintf)	Alerts #651/#652, tracked in 4 successive issues since 2026-07-01 (#42800→#43830→#46277→#47822)	recurring-risk
scripts/ensure-docs-slide-pdf.js (network-to-file write)	Alert #636, tracked twice (#43831, #47630)	recurring-risk
Container images (gh-aw-firewall/*, gh-aw-node, github-mcp-server, serena-mcp-server)	Continuous CVE bumps (Go stdlib, libc6); 6 open container-scan issues, all <4 days old	dependency / automation-generated
Command/shell injection hardening (bootstrap_profile_helpers.go, runner_guard.go, upgrade_command.go, git ref/path validation "VULN-001")	Multiple hardening commits this week	one-off (actively closing)
Safe-outputs pipeline (secret-argv exposure, template-injection, patch-size caps)	3+ hardening commits this week	one-off (actively closing)
Cache-memory / repo-memory XPIA poisoning	Escalation issue #47114 flags unresolved >6 months; root issues #45777, #28775, #28830	recurring-risk — long-lived
Lint/SDLC tooling (eslint-factory injection-detection rules, CodeQL/Semgrep gates)	Multiple new rules added this week (no-child-process-interpolated-command, require-fetch-try-catch, duplicate-constant checks)	automation-generated (proactive control)

Tier Classification Table

Area	Tier	Rationale
GraphQL injection, project_command.go (#651/#652)	B — Open With Conditions	Actively tracked, fix in progress across multiple PR cycles; not yet closed
Network-to-file write, ensure-docs-slide-pdf.js (#636)	C — Restricted Pending Review	Same finding re-opened twice since 2026-07-06 without closure
Container CVEs (libc6 CVE-2026-5450, Go stdlib GO-2026-4337)	C — Restricted Pending Review	No upstream fix yet for libc6; Go stdlib fix path known but pending rebuild
Cache/repo-memory XPIA poisoning	C — Restricted Pending Review	Escalated as unresolved >6 months (#47114)
Command/shell injection hardening (this week's fixes)	A — Open Safe	Actively remediated this cycle, hardening commits merged
Safe-outputs pipeline hardening (this week's fixes)	A — Open Safe	Actively remediated this cycle
Lint/SDLC proactive tooling additions	A — Open Safe	Net-positive control additions, no residual risk

Control Verification Gaps

• Ownership: Adequate — [uk-ai-resilience] labeling and consistent issue re-filing show active triage ownership.
• SDLC: Adequate — CodeQL/Semgrep gates active; new eslint rules landed this week for injection classes.
• Dependency: Partial — container CVE remediation is reactive (scan-triggered) rather than continuously patched; libc6 fix blocked on upstream Debian.
• Secret exposure: Adequate — 0 open secret-scanning alerts; recent commit hardens secret-argv exposure proactively.
• Runtime observability: Adequate — namespaced debug logger (pkg/logger) covers CLI/workflow/parser/mcp paths.
• Recovery/rollback: Partial — container rebuild cadence exists but is blocked when no upstream patch is available (libc6); no documented interim mitigation (e.g., network restriction) confirmed as deployed, only recommended.

Risk-Scoring Table and Rationale

Finding	Exposure Amp.	Patchability	Detectability	Op. Fragility	Ownership Conf.	Tier
GraphQL injection project_command.go	3	4 (fix known, PR cycles pending)	4	2	4	B
ensure-docs-slide-pdf.js file write	2	4	3	2	3	C
libc6 CVE-2026-5450 (container)	4	5 (no upstream fix)	3	3	4	C
XPIA cache/repo-memory poisoning	4	3 (design-level fix needed)	2	4	3	C

(Scale 1–5, higher = greater residual risk/effort)

Remediation Queue with SLAs

Item	Action	SLA
GraphQL injection #651/#652	Complete parameterized-query fix in project_command.go (tracked #47822)	High — 14 days
ensure-docs-slide-pdf.js #636	Validate/sanitize file paths before network-data writes (tracked #47630)	High — 14 days
libc6 container CVE	Monitor Debian tracker; rebuild gh-aw-firewall/gh-aw-node/github-mcp-server on fix availability (tracked #48405)	Critical — pending upstream, re-check weekly
Go stdlib GO-2026-4337	Rebuild gh-aw-firewall/agent with Go 1.26.5+ (tracked #47821)	Critical — 7 days
XPIA cache/repo-memory poisoning	Implement sanitization layer per escalation (tracked #47114)	Critical — overdue, >6 months

Exception Register

• libc6 CVE-2026-5450 — already governed under issue [uk-ai-resilience] [uk-ai-governance] Tier C: Unpatched Critical CVEs in container images (libc6 CVE-2026-5450) #48405: threat hypothesis = RCE via memory corruption; exploit acceleration = moderate (public CVE, no PoC); expiry 2026-09-27; mitigation = restrict MCP network exposure pending upstream fix. No new exception required this cycle.

Operational Metrics Baseline

• MTTR proxy: GraphQL injection finding open ~4 cycles (2026-07-01→present, 26+ days) — indicates slow closure velocity for Tier B findings.
• Ownership coverage: 100% of open alerts/CVEs have an assigned tracking issue.
• Unsupported dependency ratio: 1 of ~6 tracked container images blocked on unavailable upstream patch (libc6).
• Exception aging: 1 active exception (libc6), well within its 2026-09-27 expiry.
• Exposure without recovery capability: XPIA cache poisoning — no design-level mitigation deployed yet despite >6 months open; highest residual exposure-without-recovery item.

References:

• §30468470099

Generated by UK AI Operational Resilience · aut00 · 44.7 AIC · ⌖ 7.71 AIC · ⊞ 7.4K · ◷

• expires on Aug 1, 2026, 8:06 AM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-01T16:06:22.405Z.

Closed by Workflow