ConardLi / easy-dataset

Large result: showing the top 254 of 348 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.

1. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /Dockerfile:85 22%
2. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /Dockerfile:86 22%
3. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /lib/util/file.js 3%
4. medium Semgrep Possible writing outside of the destination, make sure that the target path is nested in the intended destination /app/api/projects/[projectId]/files/route.js:203 98%
5. medium Semgrep This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/ /.npmrc:1 97%
6. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-build.yml:24 52%
7. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-build.yml:40 52%
8. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-build.yml:32 52%
9. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-build.yml:21 52%
10. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/docker-build.yml:18 52%
11. medium Semgrep Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information. /electron/modules/server.js:51 51%
12. medium Semgrep Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information. /electron/modules/server.js:132 51%
13. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:387 37%
14. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:388 37%
15. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/files.js:20 37%
16. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:388 37%
17. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/tasks/route.js:50 37%
18. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:387 37%
19. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:256 37%
20. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:252 37%
21. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:245 37%
22. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:177 37%
23. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:135 37%
24. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:135 37%
25. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:133 37%
26. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/db-updater.js:93 37%
27. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:256 37%
28. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/tasks/route.js:87 37%
29. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/delete-directory/route.js:29 37%
30. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/open-directory/route.js:29 37%
31. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/database.js:20 37%
32. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/database.js:20 37%
33. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/database.js:44 37%
34. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/database.js:45 37%
35. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/database.js:46 37%
36. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/db-updater.js:48 37%
37. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/db-updater.js:53 37%
38. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:119 37%
39. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/logger.js:15 37%
40. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/logger.js:52 37%
41. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/logger.js:73 37%
42. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/logger.js:73 37%
43. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/server.js:77 37%
44. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/base.js:56 37%
45. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/chunks.js:207 37%
46. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/chunks.js:208 37%
47. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/chunks.js:209 37%
48. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/chunks.js:215 37%
49. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/chunks.js:215 37%
50. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:279 37%
51. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:175 37%
52. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:176 37%
53. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:176 37%
54. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:179 37%
55. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:199 37%
56. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:201 37%
57. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:201 37%
58. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:224 37%
59. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:225 37%
60. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:238 37%
61. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:238 37%
62. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/split-markdown/output/fileWriter.js:36 37%
63. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:280 37%
64. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:291 37%
65. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:291 37%
66. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:322 37%
67. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:323 37%
68. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:339 37%
69. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/text-splitter.js:339 37%
70. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/services/images/index.js:217 37%
71. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/services/images/index.js:217 37%
72. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/services/images/index.js:218 37%
73. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/services/images/index.js:218 37%
74. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:48 37%
75. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/projects.js:131 37%
76. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/projects.js:145 37%
77. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:10 37%
78. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:11 37%
79. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:17 37%
80. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:17 37%
81. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:39 37%
82. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:40 37%
83. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:41 37%
84. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:42 37%
85. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:48 37%
86. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/files.js:48 37%
87. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:77 37%
88. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:77 37%
89. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/upload-files.js:189 37%
90. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/default.js:11 37%
91. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/default.js:26 37%
92. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/mineru-local.js:18 37%
93. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/mineru.js:26 37%
94. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/mineru.js:126 37%
95. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/vision.js:19 37%
96. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/vision.js:49 37%
97. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/files/route.js:199 37%
98. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/pdf-convert/route.js:27 37%
99. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/image-datasets/export-zip/route.js:55 37%
100. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/image-datasets/export-zip/route.js:55 37%
101. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/image-datasets/export-zip/route.js:47 37%
102. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/huggingface/upload/route.js:58 37%
103. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/huggingface/upload/route.js:42 37%
104. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/files/route.js:203 37%
105. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/files/route.js:203 37%
106. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/models/route.js:69 37%
107. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/files/route.js:198 37%
108. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/files/route.js:87 37%
109. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/files/route.js:86 37%
110. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/custom-split/route.js:25 37%
111. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/batch-delete-files/route.js:98 37%
112. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/batch-delete-files/route.js:97 37%
113. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/preview/[fileId]/route.js:26 37%
114. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/pdf-convert/route.js:59 37%
115. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/models/route.js:18 37%
116. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/pdf-convert/route.js:59 37%
117. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/models/[modelId]/route.js:133 37%
118. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/models/[modelId]/route.js:73 37%
119. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/models/[modelId]/route.js:17 37%
120. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/llamaFactory/generate/route.js:22 37%
121. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/llamaFactory/generate/route.js:20 37%
122. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/llamaFactory/generate/route.js:18 37%
123. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/llamaFactory/checkConfig/route.js:14 37%
124. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/zip-import/route.js:88 37%
125. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/zip-import/route.js:88 37%
126. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/zip-import/route.js:63 37%
127. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/zip-import/route.js:63 37%
128. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/zip-import/route.js:27 37%
129. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/files/route.js:89 37%
130. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/files/route.js:89 37%
131. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/batch-delete-files/route.js:100 37%
132. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/batch-delete-files/route.js:100 37%
133. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/zip-import/route.js:117 37%
134. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/llamaFactory/checkConfig/route.js:15 37%
135. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/llamaFactory/generate/route.js:19 37%
136. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/llamaFactory/generate/route.js:21 37%
137. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/models/[modelId]/route.js:27 37%
138. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/models/[modelId]/route.js:83 37%
139. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/models/[modelId]/route.js:143 37%
140. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/models/route.js:28 37%
141. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/models/route.js:79 37%
142. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/preview/[fileId]/route.js:24 37%
143. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/preview/[fileId]/route.js:24 37%
144. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/tasks/route.js:97 37%
145. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/database.js:13 37%
146. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/db-updater.js:128 37%
147. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/zip-import/route.js:117 37%
148. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/pdf-convert/route.js:31 37%
149. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/zip-import/route.js:36 37%
150. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/zip-import/route.js:31 37%
151. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/zip-import/route.js:31 37%
152. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/route.js:77 37%
153. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/route.js:77 37%
154. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/pdf-convert/route.js:88 37%
155. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/pdf-convert/route.js:88 37%
156. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/pdf-convert/route.js:36 37%
157. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/huggingface/upload/route.js:46 37%
158. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/images/pdf-convert/route.js:31 37%
159. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/image-datasets/route.js:54 37%
160. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/image-datasets/route.js:54 37%
161. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/image-datasets/[datasetId]/route.js:68 37%
162. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/image-datasets/[datasetId]/route.js:68 37%
163. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/image-datasets/[datasetId]/route.js:24 37%
164. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/image-datasets/[datasetId]/route.js:24 37%
165. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /app/api/projects/[projectId]/huggingface/upload/route.js:46 37%
166. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/upload-files.js:187 37%
167. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/images.js:84 37%
168. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/images.js:84 37%
169. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/images.js:154 37%
170. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/images.js:154 37%
171. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/projects.js:146 37%
172. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:59 37%
173. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/texts.js:59 37%
174. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/upload-files.js:187 37%
175. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/logger.js:48 37%
176. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/default.js:14 37%
177. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/default.js:14 37%
178. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/default.js:24 37%
179. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/mineru-local.js:19 37%
180. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/mineru-local.js:19 37%
181. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/mineru-local.js:22 37%
182. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/mineru.js:27 37%
183. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/file/file-process/pdf/mineru.js:27 37%
184. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/files.js:49 37%
185. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/logger.js:10 37%
186. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/logger.js:67 37%
187. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /electron/modules/server.js:73 37%
188. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/chunks.js:226 37%
189. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/chunks.js:226 37%
190. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:107 37%
191. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:107 37%
192. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:131 37%
193. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:131 37%
194. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:164 37%
195. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:164 37%
196. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:209 37%
197. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:279 37%
198. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/fileToDb.js:311 37%
199. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/files.js:21 37%
200. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/files.js:21 37%
201. medium Semgrep Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. /lib/db/files.js:49 37%
202. low Dependency checker Loose version constraint: '@huggingface/hub^2.0.2' — attacker could push malicious update package.json 4%
203. low Dependency checker Loose version constraint: '@ai-sdk/openai^1.3.9' — attacker could push malicious update package.json 2%
204. low Dependency checker Loose version constraint: 'xlsx^0.18.5' — attacker could push malicious update package.json 2%
205. low Dependency checker Loose version constraint: 'next-themes^0.2.1' — attacker could push malicious update package.json 2%
206. low Dependency checker Loose version constraint: 'ollama-ai-provider^1.2.0' — attacker could push malicious update package.json 2%
207. low Dependency checker Loose version constraint: 'opener^1.5.2' — attacker could push malicious update package.json 2%
208. low Dependency checker Loose version constraint: 'react^18.2.0' — attacker could push malicious update package.json 2%
209. low Dependency checker Loose version constraint: 'react-dom^18.2.0' — attacker could push malicious update package.json 2%
210. low Dependency checker Loose version constraint: 'react-i18next^15.4.1' — attacker could push malicious update package.json 2%
211. low Dependency checker Loose version constraint: 'react-markdown^10.0.1' — attacker could push malicious update package.json 2%
212. low Dependency checker Loose version constraint: 'recharts^3.6.0' — attacker could push malicious update package.json 2%
213. low Dependency checker Loose version constraint: 'remark-gfm^4.0.1' — attacker could push malicious update package.json 2%
214. low Dependency checker Loose version constraint: 'sharp^0.33.1' — attacker could push malicious update package.json 2%
215. low Dependency checker Loose version constraint: 'sonner^2.0.3' — attacker could push malicious update package.json 2%
216. low Dependency checker Loose version constraint: 'turndown^7.2.0' — attacker could push malicious update package.json 2%
217. low Dependency checker Loose version constraint: 'next^14.2.29' — attacker could push malicious update package.json 2%
218. low Dependency checker Loose version constraint: 'xmldom^0.6.0' — attacker could push malicious update package.json 2%
219. low Dependency checker Loose version constraint: 'zhipu-ai-provider^0.1.1' — attacker could push malicious update package.json 2%
220. low Dependency checker Loose version constraint: 'zod^3.25.76' — attacker could push malicious update package.json 2%
221. low Dependency checker Loose version constraint: '@commitlint/cli^19.8.0' — attacker could push malicious update package.json 2%
222. low Dependency checker Loose version constraint: '@commitlint/config-conventional^19.8.0' — attacker could push malicious update package.json 2%
223. low Dependency checker Loose version constraint: 'concurrently^8.2.2' — attacker could push malicious update package.json 2%
224. low Dependency checker Loose version constraint: 'electron^35.0.0' — attacker could push malicious update package.json 2%
225. low Dependency checker Loose version constraint: 'electron-builder^24.13.3' — attacker could push malicious update package.json 2%
226. low Dependency checker Loose version constraint: 'husky^9.1.7' — attacker could push malicious update package.json 2%
227. low Dependency checker Loose version constraint: 'pkg^5.8.1' — attacker could push malicious update package.json 2%
228. low Dependency checker Loose version constraint: 'prisma^6.6.0' — attacker could push malicious update package.json 2%
229. low Dependency checker Loose version constraint: 'wait-on^7.2.0' — attacker could push malicious update package.json 2%
230. low Dependency checker Loose version constraint: 'formidable^3.5.2' — attacker could push malicious update package.json 2%
231. low Dependency checker Loose version constraint: '@emotion/styled^11.11.0' — attacker could push malicious update package.json 2%
232. low Dependency checker Loose version constraint: '@fontsource/inter^5.0.16' — attacker could push malicious update package.json 2%
233. low Dependency checker Loose version constraint: '@fontsource/jetbrains-mono^5.0.18' — attacker could push malicious update package.json 2%
234. low Dependency checker Loose version constraint: '@lobehub/icons^1.96.0' — attacker could push malicious update package.json 2%
235. low Dependency checker Loose version constraint: '@opendocsg/pdf2md^0.2.1' — attacker could push malicious update package.json 2%
236. low Dependency checker Loose version constraint: '@openrouter/ai-sdk-provider^0.4.5' — attacker could push malicious update package.json 2%
237. low Dependency checker Loose version constraint: '@prisma/client^6.6.0' — attacker could push malicious update package.json 2%
238. low Dependency checker Loose version constraint: 'adm-zip^0.5.16' — attacker could push malicious update package.json 2%
239. low Dependency checker Loose version constraint: 'ai^4.3.4' — attacker could push malicious update package.json 2%
240. low Dependency checker Loose version constraint: 'axios^1.8.4' — attacker could push malicious update package.json 2%
241. low Dependency checker Loose version constraint: 'electron-build^0.0.3' — attacker could push malicious update package.json 2%
242. low Dependency checker Loose version constraint: 'electron-updater^6.3.9' — attacker could push malicious update package.json 2%
243. low Dependency checker Loose version constraint: '@emotion/react^11.11.3' — attacker could push malicious update package.json 2%
244. low Dependency checker Loose version constraint: 'framer-motion^12.4.10' — attacker could push malicious update package.json 2%
245. low Dependency checker Loose version constraint: 'github-markdown-css^5.8.1' — attacker could push malicious update package.json 2%
246. low Dependency checker Loose version constraint: 'i18next^24.2.2' — attacker could push malicious update package.json 2%
247. low Dependency checker Loose version constraint: 'i18next-browser-languagedetector^8.0.4' — attacker could push malicious update package.json 2%
248. low Dependency checker Loose version constraint: 'image-size^2.0.2' — attacker could push malicious update package.json 2%
249. low Dependency checker Loose version constraint: 'jotai^2.12.3' — attacker could push malicious update package.json 2%
250. low Dependency checker Loose version constraint: 'jsonrepair^3.13.1' — attacker could push malicious update package.json 2%
251. low Dependency checker Loose version constraint: 'jszip^3.10.1' — attacker could push malicious update package.json 2%
252. low Dependency checker Loose version constraint: 'langchain^0.3.24' — attacker could push malicious update package.json 2%
253. low Dependency checker Loose version constraint: 'mammoth^1.9.0' — attacker could push malicious update package.json 2%
254. low Dependency checker Loose version constraint: 'nanoid^5.1.5' — attacker could push malicious update package.json 2%