Scan report

jgraph / drawio-mcp

View on GitHub (opens in a new tab)
JavaScript
5504 stars
Scanned 24 Sep 2026, 10:28

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

45 risk score

Real issues worth reviewing before you rely on this code.

High: 2
Medium: 20
Low: 2

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

3 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 3
Medium: 1
Low: 1

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

29 total findings

Likely real: 21
Uncertain: 4
Likely noise: 4

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a medium vulnerability score of 45, which means there are several insecure coding patterns that an attacker could exploit to steal secrets or code. However, the scan also found signs of potentially malicious intent with a low score of 3, suggesting the code might be intentionally harmful rather than just poorly written. Most of these issues relate to common mistakes like using unescaped user input in logs or allowing variable interpolation in scripts, which are typical errors that can be fixed by developers. There is only one high-severity finding involving an encoded payload being decoded and executed, but this appears to be a specific edge case rather than widespread malicious behavior. Overall, while the code contains some risky patterns that need attention, it does not look like a repository designed to cause harm, so you can proceed with caution if you are comfortable addressing the identified issues.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 24

Pattern-based code analysis · Vulnerability
YARA 4

Malware signature rules · Malicious pattern
GuardDog 1

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-app-server-image.yml line 149

Likely real
Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
```
run: |
          {
            echo "### ${IMAGE}:${{ steps.version.outputs.version }}"
            echo
            if [ "${{ inputs.dry_run }}" = "true" ]; then
              echo "Dry run — built and smoke-tested, nothing was pushed."
            else
              echo "Pushed \`${IMAGE}:${{ steps.version.outputs.version }}\` and \`${IMAGE}:latest\` for linux/amd64 and linux/arm64."
              echo
              echo "https://hub.docker.com/r/${IMAGE}/tags"
            fi
          } >> "$GITHUB_STEP_SUMMARY"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-tool-server.yml line 80

Likely real
Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
```
run: |
          {
            echo "### @drawio/mcp@${{ steps.version.outputs.version }}"
            echo
            if [ "${{ inputs.dry_run }}" = "true" ]; then
              echo "Dry run — nothing was published."
            else
              echo "Published to https://www.npmjs.com/package/@drawio/mcp/v/${{ steps.version.outputs.version }}"
            fi
          } >> "$GITHUB_STEP_SUMMARY"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/mcp-tool-server/src/libavoid-pass.js line 289

Likely real
Yes, 98% confidence

User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within.
```
var geo = "<mxGeometry " + geoAttrStr + ">" +
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/mcp-tool-server/package.json line 15

Likely real
Yes, 87% confidence

Detects LOLBAS usage in install hooks (execution and network tools) [threat-process-hooks]
```
"prepack": "npm run copy-shared",
    "postinstall": "node src/postinstall.js",
    "test": "node --test"
  },
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/shared/mx-xml.js line 391

Likely real
Yes, 76% confidence

RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
```
var re = new RegExp("\\b" + name + '\\s*=\\s*"[^"]*"');
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-tool-server.yml line 38

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/update-search-index.yml line 39

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: peter-evans/create-pull-request@v8
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/update-search-index.yml line 18

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/setup-node@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/update-search-index.yml line 16

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-tool-server.yml line 40

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/setup-node@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-app-server-image.yml line 139

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: peter-evans/dockerhub-description@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-app-server-image.yml line 122

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: docker/build-push-action@v7
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-app-server-image.yml line 116

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: docker/login-action@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-app-server-image.yml line 74

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: docker/build-push-action@v7
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-app-server-image.yml line 58

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: docker/metadata-action@v6
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-app-server-image.yml line 54

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: docker/setup-buildx-action@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-app-server-image.yml line 52

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: docker/setup-qemu-action@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/publish-app-server-image.yml line 37

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/check-skill-sync.yml line 25

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/mcp-tool-server/src/cdn-cache.js line 128

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
renameSync(tmp, join(dir, source.file));
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/mcp-tool-server/src/cdn-cache.js line 101

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
var entry = JSON.parse(readFileSync(join(cacheDir(), source.file), "utf8"));
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/mcp-tool-server/src/cdn-cache.js line 123

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
var tmp = join(dir, source.file + "." + process.pid + ".tmp");
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/mcp-tool-server/src/cdn-cache.js line 140

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
try { rmSync(join(cacheDir(), source.file)); } catch (e) {}
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/mcp-app-server/src/index.js line 227

Likely real
Yes, 89% confidence

Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.
```
console.log(`[req] ${req.method} method=${method || "(none)"} session=${sessionId} accept=${req.headers["accept"] || ""}`);
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/mcp-app-server/src/index.js line 232

Likely real
Yes, 89% confidence

Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like ` ` and ` ` and cause an attacker to forge log entries or include malicious content into the logs. Use proper input validation and/or output encoding to prevent log entries from being forged.
```
console.log(`[res] method=${method || "(none)"} session=${sessionId} status=${res.statusCode} ${elapsed}ms`);
```