mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
1629 lines
56 KiB
JSON
1629 lines
56 KiB
JSON
|
{
|
||
|
|
"cases": [
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "exportVariable(name, val) in packages/core/src/core.ts",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "actions-toolkit-aea58b64437b5cd9",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "get_jinja_env",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "adfinis-document-merge-service-07b7ac5dceffaea7",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.4,
|
||
|
|
"entry_point": "setDeepProperty",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "blackprint-engine-js-85c296cd30ba6377",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.72,
|
||
|
|
"entry_point": "execute_sql tool via HTTP /mcp endpoint (unauthenticated, binds 0.0.0.0) or stdio transport; attacker-controlled SQL argument reaches isReadOnlySQL/checkReadOnly",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "bytebase-dbhub-953fb8fbbf9d53ad",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "execute_sql tool via HTTP transport POST /mcp (unauthenticated, binds 0.0.0.0); attacker-controlled SQL string reaches areAllStatementsReadOnly -> isReadOnlySQL -> splitSQLStatements -> scanTokenMySQL in src/utils/sql-parser.ts",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "bytebase-dbhub-f2624a2ead8d31ca",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "MCP tool import_space (space_to_space_migration_handler -> import_space) with LLM-controlled args.host/proxy",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "contentful-contentful-mcp-server-22e8b2fc09c3b2c4",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "MCP tool call: space_to_space_migration_handler (action: enable) then export_space/import_space with LLM-controlled host/proxy args",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "contentful-contentful-mcp-server-27601a06292d6956",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "MCP tool export_space (space_to_space_migration_handler -> export_space) with LLM-controlled args.host/proxy reaching contentful-export",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "contentful-contentful-mcp-server-df53a40a29ee8d8d",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "dataStoreORMGetVerifiableCredentialsByClaims (packages/data-store/src/data-store-orm.ts) via order[].column",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "decentralized-identity-veramo-39528b62cd2d5678",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "isExternal(url) called from fetchMixin request/loadNested with URL derived from router path (location.hash)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "docsifyjs-docsify-c2fea35ed6fa4e81",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "GET /authorize and GET /callback routes in get_oauth_associate_router (fastapi_users/router/oauth.py); attacker-controlled source is the state query parameter on the callback route",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "fastapi-users-fastapi-users-178fe59502d96974",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "GET /authorize and GET /callback routes in get_oauth_router (fastapi_users/router/oauth.py); attacker-controlled source is the state query parameter on the callback route",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "fastapi-users-fastapi-users-9c433ae430a57ba5",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "GET /authorize route handler `authorize` in fastapi_users/router/oauth.py (registered via get_oauth_router); attacker-controlled source is the OAuth flow initiated through this route, whose stateless state token is later accepted by the /callback handler",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "fastapi-users-fastapi-users-e791a1b252858adc",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "fulltext_query",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "getzep-graphiti-73934de4dd08076d",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "MCP search_nodes entity_types -> SearchFilters.node_labels",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "getzep-graphiti-97bc32f1aefac918",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "i18next-http-backend Backend.read(lng, ns) via loadPath template interpolation (library API; no in-repo route/handler shown)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "i18next-i18next-http-backend-2b2cfaace81a0901",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "i18next-http-backend Backend.read(lng, ns) with loadPath template beginning with {{lng}} or {{ns}}",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "i18next-i18next-http-backend-5a9e051d7969dda7",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "i18next-http-backend Backend.read(lng, ns) with loadPath template beginning with {{lng}} or {{ns}}",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "i18next-i18next-http-backend-b3a1a4fce7f4365b",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "i18next-http-backend Backend.read(lng, ns) with loadPath template beginning with {{lng}} or {{ns}}",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "i18next-i18next-http-backend-c049883fe38d4aea",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.05,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "i18next-i18next-http-middleware-2ac286aacdb87c09",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.05,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "i18next-i18next-http-middleware-6f79ac0172d3a406",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "lib/index.js middleware reading req.query.lng and setting res.setHeader('Content-Language', ...)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "i18next-i18next-http-middleware-f31f66289fdccb72",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "i18nextMiddleware (handle) \u2014 Express/Connect middleware; attacker-controlled source: req.query.lng (or req.cookies/req.headers) via languageDetector.detect(req,res), reaching options.setHeader(res,'Content-Language', utils.escape(lng))",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "i18next-i18next-http-middleware-f3e2a6886951f36a",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "MdPreview component rendering attacker-controlled markdown via modelValue prop (Vue v-html sink)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "imzbf-md-editor-v3-14658213915dbde5",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.05,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "imzbf-md-editor-v3-86b846dab33e56c7",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "MdPreview component (packages/MdEditor/layouts/Content) rendering modelValue markdown via useMarkdownIt -> md.render; attacker-controlled source is the markdown modelValue prop containing a fenced code block info string",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "imzbf-md-editor-v3-b9c833a3524a57a9",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.35,
|
||
|
|
"entry_point": "MdPreview component rendering attacker-controlled Markdown via useMarkdownIt highlight callback",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "imzbf-md-editor-v3-ff3920b5df37b315",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "lsp_message_listener(\"client\") handler shadow_virtual_documents, invoked via jupyter-server websocket LSP message with params.textDocument.uri",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "jupyter-lsp-jupyterlab-lsp-59f9a8b80b133f6f",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.2,
|
||
|
|
"entry_point": "load_jupyter_server_extension",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "jupyter-lsp-jupyterlab-lsp-60c7277caac70c32",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.4,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "jupyter-lsp-jupyterlab-lsp-848f2511afb727bd",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "EverNoteLoader._parse_note_xml (library document loader; no in-repo HTTP route or CLI argument shown)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "langchain-ai-langchain-community-24110ebd7e55a43e",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "EverNoteLoader._parse_note_xml (invoked via EverNoteLoader.load from a user-supplied Evernote XML file path)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "langchain-ai-langchain-community-443284aa2697f832",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "EverNoteLoader._lazy_load via EverNoteLoader(file_path).load()",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "langchain-ai-langchain-community-542348d46bfb41ad",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "langchain-ai-langchain-community-851ae3e950fdf631",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "EverNoteLoader.lazy_load (document loader invoked by application code, not an in-repo route/handler)",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "langchain-ai-langchain-community-8913cdff6b587b55",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.35,
|
||
|
|
"entry_point": "EverNoteLoader.__init__ / _parse_note_xml (file_path argument)",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "langchain-ai-langchain-community-955aa8b3ccdc9201",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "EverNoteLoader.lazy_load (document loader invoked by application code, not an in-repo route/handler)",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "langchain-ai-langchain-community-ea70641d99d14858",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "locize-i18next-locize-backend-1350d6ba510ab0b1",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "getLanguages(callback) invoked via i18next backendConnector; projectId sourced from backend options (not shown to be attacker-controlled in-repo)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "locize-i18next-locize-backend-18e5470fd70853b3",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "i18next backend read(language, namespace, callback) invoked via i18next-browser-languagedetector ?lng=/?ns= query parameters",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "locize-i18next-locize-backend-584c6dd65813628c",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "writePage (lib/index.js) \u2014 invoked via i18next saveMissing/addResourceBundle flow; lng/ns sourced from i18next language/namespace values (e.g. ?lng=/?ns= via i18next-browser-languagedetector)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "locize-i18next-locize-backend-8cfe1c2a6968c02e",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "locize-i18next-locize-backend-9798d205421de2b8",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "writePage(lng, namespace, missings, callback) invoked via write() from i18next saveMissing flow; lng/ns originate from i18next language/namespace values (e.g. ?lng=/?ns= via i18next-browser-languagedetector)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "locize-i18next-locize-backend-aeb610c5ad8a87b0",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.72,
|
||
|
|
"entry_point": "read(language, namespace, callback) in lib/index.js \u2014 invoked by i18next with lng/ns values; no in-repo HTTP route, request handler, or CLI argument is shown supplying attacker-controlled input",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "locize-i18next-locize-backend-cb455d00d91ca577",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "getLanguages(callback) invoked via i18next backend connector; projectId sourced from options (potentially user-controlled via URL-derived projectId)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "locize-i18next-locize-backend-dbf6a68751e65a86",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "DirectoryPromptRegistry.set() / _load() (no in-repo HTTP route or CLI handler shown)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "masci-banks-24da65ea9fb61613",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "DirectoryPromptRegistry.set() -> PromptFile.from_prompt_path() (no in-repo HTTP route or CLI handler shown)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "masci-banks-9b334183159336ae",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "onInvite(ev) handler invoked on m.room.member invite events; attacker-controlled source is the m.room.tombstone event's replacement room, whose m.room.create predecessor is unchecked",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "matrix-org-matrix-appservice-bridge-3a8081647e10c293",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "KafkaManager._listen (message queue consumer) via _publish/_kafka_listen",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "miguelgrinberg-python-socketio-00b05c32e133ffef",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "socketio.AsyncAioPikaManager._listen (message queue consumer); no in-repo HTTP route or CLI argument reaches it",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "miguelgrinberg-python-socketio-0dd2752b7ff39492",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "AsyncAioPikaManager._listen (message queue consumer)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "miguelgrinberg-python-socketio-2b8c261372830554",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "KafkaManager._listen consuming messages from Kafka topic via _kafka_listen",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "miguelgrinberg-python-socketio-341d5917c00e4357",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "async_pubsub_manager._thread consuming messages from message queue backend (e.g., Redis) via _listen()",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "miguelgrinberg-python-socketio-5d4345900d56a792",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "redis_manager._publish (inter-server message queue publish); deserialization occurs in _listen via pickle.loads on messages received from the Redis message queue",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "miguelgrinberg-python-socketio-60fc7c8db24ac5b2",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "ZmqManager._listen consuming messages from zmq_listen() (ZeroMQ SUB socket)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "miguelgrinberg-python-socketio-ad0487db8c741a79",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "zmq_manager._listen -> pickle.loads(message) on messages received from the ZeroMQ SUB socket (message queue)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "miguelgrinberg-python-socketio-ca0498a351537e6c",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "socketio.AsyncServer/Server message queue backend (kombu_manager._publish/_listen) via compromised message queue",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "miguelgrinberg-python-socketio-d57a8cae8d3699b2",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "AsyncRedisManager._publish (inter-server message queue publish path); no in-repo HTTP route or CLI argument reaches it",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "miguelgrinberg-python-socketio-d92e3b5b1e39df38",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "pubsub_manager._thread consuming messages from message queue backend (e.g., Redis) via _listen()",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "miguelgrinberg-python-socketio-dcdad8750e6476fa",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "handleInclude (mj-include tag processing in packages/mjml-parser-xml/src/index.js)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "mjmlio-mjml-21920f03d2b1388b",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "MJMLParser(xml, options)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "mjmlio-mjml-a6b0d0415c3244f0",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "mjml-parser-xml handleCssHtmlInclude via mj-include file attribute",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "mjmlio-mjml-ce0bbf2616ad8e14",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "blacksheep/scribe.py:ensure_host_header (HTTP client request serialization)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "neoteroi-blacksheep-124a318e5d127406",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "neoteroi-blacksheep-1f6f0ef7d646a82a",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "blacksheep/scribe.py:write_header (HTTP client header serialization)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "neoteroi-blacksheep-33dede7470101897",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "write_request_uri (HTTP client request serialization)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "neoteroi-blacksheep-c38a75f40e8c6117",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "neoteroi-blacksheep-e1e5cecd9603e39f",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "blacksheep/scribe.py:write_request_method (HTTP client request serialization)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "neoteroi-blacksheep-fd365891403dccf1",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "thefuck CLI: side_effect invoked by the 'undo archive operation' feature after a tar extraction command; attacker-controlled source is the tar archive member names (archive.getnames()) from the tar file path in old_cmd.script_parts",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "nvbn-thefuck-456ad18acb14f1b2",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "thefuck CLI: 'fuck' command triggers side_effect in thefuck/rules/dirty_unzip.py after matching an 'unzip' command; attacker-controlled source is the zip archive namelist entries (path traversal names like ../../file)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "nvbn-thefuck-74126de049d52d8c",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "sb.compile(payload)().run()",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "nyariv-sandboxjs-6f56e3b04e801fe1",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.35,
|
||
|
|
"entry_point": "SandboxGlobal constructor (src/utils.ts)",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "nyariv-sandboxjs-8907b6ee6ed61749",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "sb.compile(payload)().run()",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "nyariv-sandboxjs-b6255163764154c4",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "MCP tool `sparql_query` (and `ckan_package_search`) via caller-controlled `server_url` argument reaching `querySparqlEndpoint`",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "ondata-ckan-mcp-server-01a3f68f84397eb4",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.72,
|
||
|
|
"entry_point": "POST /mcp (runHTTP) -> MCP tool ckan_package_search with caller-controlled server_url argument",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "ondata-ckan-mcp-server-a67313c11ab9b56d",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.85,
|
||
|
|
"entry_point": "MCP tool ckan_package_search (server_url argument) \u2192 makeCkanRequest \u2192 validateServerUrl; also sparql_query \u2192 querySparqlEndpoint",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "ondata-ckan-mcp-server-b0b05cdc830b1f8b",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "MCP tool ckan_package_search (server_url argument) via POST /mcp HTTP transport or stdio",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "ondata-ckan-mcp-server-b8b9256817a983f6",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "convertMdToPdf (library API / CLI md-to-pdf)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "simonhaenisch-md-to-pdf-5632b7e3540ca36a",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "read_file tool (readFileFromUrl) invoked via MCP tool call with attacker-controlled url argument",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "sorlen008-desktopcommandermcp-5a235aad1fe787d3",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.35,
|
||
|
|
"entry_point": "launchEditor(file, specifiedEditor, onErrorCallback)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "vitejs-launch-editor-3dc9b0970ceb7a9f",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "generateReport (CLI report generation)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "webpack-webpack-bundle-analyzer-4fd3e40668597204",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "express route app.use('/') rendering viewer template with chartData from bundle stats",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "webpack-webpack-bundle-analyzer-6873b00ca1b99ac3",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "express route app.use('/', (req, res) => res.render('viewer', ...)) serving chartData to the browser",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "webpack-webpack-bundle-analyzer-8e07af8a5ee1cc52",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet (long_name/short_name) stored via malla-capture and rendered in dashboard tables",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-102f65835648c1bf",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.35,
|
||
|
|
"entry_point": "renderReceptionLink (src/malla/static/js/chat.js)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-1556fb480b2c71aa",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet -> malla-capture stores node long_name/short_name in SQLite -> dashboard chat.js refreshPop renders popContent(msg) via innerHTML",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-15753fae1999978e",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.05,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-38f6d66db3fc1a00",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-42903a442918a77d",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet -> malla-capture -> SQLite -> dashboard page rendering direct_receptions.js populateLegendTable",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-4310c9496e91e5d8",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "relay_node_analysis.js renderTable() rendering candidate.node_name from /api relay node stats (data.relay_node_stats) fetched via response.json()",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-45807117f798f314",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "relay_node_analysis.js loaded via script[data-node-id] on relay node analysis page; candidate.node_name from MQTT NODEINFO_APP stored in SQLite and rendered via innerHTML in candidatesCell",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-4c7ce7ae0b9dd0cf",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.05,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-4f35f98164a41ae0",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-537a67dbc27ba245",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-57d866ab0161a4d1",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "Dashboard table rendering via modern-table.js loadData() fetching this.options.endpoint; attacker-controlled node names (long_name/short_name) from Meshtastic MQTT NODEINFO_APP packets stored in SQLite and returned in JSON data.data, then rendered via innerHTML in renderTableBody()/renderCell()",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-5b8f3116fefd595b",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.1,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-5ff17e7834f57d91",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-6f04e80aaedfe574",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-6fd318e0879ce234",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet ingestion (malla-capture) storing long_name/short_name, rendered by chat.js renderNodeLink via renderRelayCand in the dashboard relay/reception popup",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-72b8d4dc93a566fb",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet -> malla-capture stores node long_name/short_name -> chat.js replySnippet renders reply label via innerHTML",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-73c0175a1009ffbf",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.35,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-73c893bd45ba49e4",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-7932922eb2f3ffd7",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "DOMContentLoaded handler reading script[data-node-id] and RelayNodeAnalysis.initialize()",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-7c1f433c84c430e9",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet (long_name/short_name) ingested by malla-capture, stored in SQLite, rendered in dashboard chat.js popContent via showPop",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-825a0f3ce563c373",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-82abf2e471225864",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "GET /api/chat/messages (chat.js loadInitial/poll) -> ingestPacket -> buildLine/buildAttachedLine -> nodeName/nodeShort rendering; attacker-controlled source: Meshtastic MQTT NODEINFO_APP long_name/short_name stored in SQLite and returned in data.nodes",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-858255cb6145e104",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.05,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-883431759ab33742",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.1,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-88ea3b4a289a3fad",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.6,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet ingestion (malla-capture) storing node long_name/short_name, rendered in dashboard chat.js buildLine via nodeName/nodeShort",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-92e437caca55290b",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet (long_name/short_name) stored via malla-capture and rendered in dashboard templates",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-a702272ae0bd1f71",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet long_name/short_name stored in SQLite and rendered in dashboard pages",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-ad44f61c36756061",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "node-picker.js renderResults() rendering node.long_name/short_name into innerHTML; node names sourced from Meshtastic MQTT NODEINFO_APP packets stored in SQLite and served to the dashboard node picker",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-aeb1d1e3d40815a8",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.35,
|
||
|
|
"entry_point": "clearLegendTable(message) in src/malla/static/js/direct_receptions.js",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-b191f629ba89630f",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet -> malla-capture stores node long_name/short_name -> dashboard chat.js renderRelayCand renders relay candidate label into DOM",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-bf4b3bcd2652952c",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": false,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-c22cc3e1b0b1f9fb",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet ingestion (malla-capture) storing long_name/short_name, rendered in dashboard chat.js showPop via popContent innerHTML",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-c3ab7f5f4e769cc6",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.35,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-cebac68936070d13",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": false,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-d56a5a6b8c4e3e04",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": false
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-d9b404295d8ef60a",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.55,
|
||
|
|
"entry_point": "showErrorMessage (src/malla/static/js/direct_receptions.js)",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-e764f475693cced8",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet ingestion -> chat.js buildAttachedLine rendering node names into innerHTML",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zenitram-malla-f3535c03a02fa0e3",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.35,
|
||
|
|
"entry_point": "showError(message) in src/malla/static/js/modern-table.js, called from loadData catch with error.message derived from fetch response status/statusText",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-f81bc6d320308ed9",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.35,
|
||
|
|
"entry_point": "MQTT NODEINFO_APP packet ingestion (malla-capture) storing long_name/short_name rendered in dashboard templates",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": null,
|
||
|
|
"id": "zenitram-malla-fdeb54294795c9dd",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": false,
|
||
|
|
"verdict": "rejected",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.75,
|
||
|
|
"entry_point": "GET /sse (SSE transport) -> POST /messages?sessionId=... -> tools/call upload_markdown with attacker-controlled file_path",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zereight-gitlab-mcp-2367b459f8c3802b",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"advisory_cited": true,
|
||
|
|
"confidence": 0.9,
|
||
|
|
"entry_point": "GET /sse and POST /messages Express handlers in startSSEServer (index.ts); attacker-controlled source is the unauthenticated HTTP request reaching the SSE transport, which invokes the upload_markdown tool with attacker-supplied file_path",
|
||
|
|
"fix_addresses_it": true,
|
||
|
|
"human_spot_check": {
|
||
|
|
"date": "2026-10-12",
|
||
|
|
"decision": "accept",
|
||
|
|
"reviewer": "mc"
|
||
|
|
},
|
||
|
|
"id": "zereight-gitlab-mcp-768c7d5a32ccc95b",
|
||
|
|
"model": "deepseek-flash",
|
||
|
|
"reachable_in_repo": true,
|
||
|
|
"verdict": "accepted",
|
||
|
|
"vulnerable_pre_fix": true
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|