AI 安全與代理基礎設施
Semantica 0.6.6 Blocks SSRF, Injection, and Credential-Leak Paths in Agent Knowledge Pipelines
Semantica 0.6.6 delivers a concentrated set of fixes for multiple vulnerability classes affecting knowledge graph imports, backups, exports, and external requests, and its maintainers recommend that all deployments upgrade. The release also adds a fact-retraction mechanism that preserves provenance records, along with CrewAI integration.
The risks facing agent memory systems extend beyond prompt injection: they actively access URLs, Git repositories, archives, databases, and RDF endpoints, making them high-privilege data importers in their own right. Released on August 20, Semantica 0.6.6 addresses a batch of privately reported issues across this attack surface, including archive path traversal, SQL/SPARQL injection, stored XSS, HTTP header injection, leakage of Authorization credentials during redirects, and time-of-check-to-time-of-use gaps caused by DNS rebinding. Feed and seed imports now share SSRF protections. Administrators who need to access private-network data sources must explicitly enable `allow_private_ips`, preventing the default configuration from turning an agent into an internal-network probe.
The fixes also cover GitPython clone entry points, symlink race conditions during Markdown imports, YAML export input, and backup, restore, and triplet-store backends. These issues do not constitute a single CVE, but rather a cluster of vulnerabilities arising from shared trust assumptions across different input surfaces. The maintainers have not yet published full exploitation requirements or an affected-version matrix. Existing deployments should treat 0.6.6 as the minimum secure baseline and restrict permissions for graph database and external-connection credentials.
On the feature side, `ContextGraph` now supports retraction and purge. Retraction removes a fact from the active graph while preserving the source record documenting its withdrawal; purge performs the actual deletion. This approach is better suited than directly overwriting nodes for agent memory systems that require auditing or need to address the “right to be forgotten.” The release also generates entity and relationship IRIs using deterministic rules, standardizes timestamps with UTC offsets, and adds a CrewAI interface. Engineering teams should next monitor whether CVEs are assigned to the individual vulnerabilities, whether previously imported data needs to be revalidated, and whether SSRF protections remain consistent across proxy, redirect, and custom DNS environments.