koel / koel

1. high Semgrep Executing non-constant commands. This can lead to command injection. /scripts/koel-init.php:7 43%
2. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /CLAUDE.md 1%
3. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /AGENTS.md 1%
4. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /.github/workflows/test-proxy-auth-e2e.yml 1%
5. medium Semgrep RegExp() called with a `route` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /resources/assets/js/router.ts:71 100%
6. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /resources/assets/js/components/ai/AiChatMessage.vue:4 100%
7. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /resources/assets/js/components/album/AlbumInfo.vue:12 100%
8. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /resources/assets/js/components/artist/ArtistInfo.vue:11 100%
9. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /resources/assets/js/components/podcast/EpisodeItem.vue:47 100%
10. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /resources/assets/js/components/podcast/PodcastItem.vue:46 100%
11. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /resources/assets/js/components/screens/EpisodeScreen.vue:53 100%
12. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /resources/assets/js/components/ui/Overlay.vue:16 100%
13. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /resources/assets/js/components/screens/PodcastScreen.vue:19 100%
14. medium Semgrep This pnpm workspace configuration does not set a minimum release age. Newly published packages can be malicious or unstable. Add `minimumReleaseAge: 10080` (minutes) to wait at least seven days before installing newly published package versions. Added in: v10.16.0 Reference: https://pnpm.io/settings#minimumreleaseage /pnpm-workspace.yaml:6 99%
15. medium Semgrep A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy. /config/database.php:125 99%
16. medium Semgrep A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy. /config/database.php:140 99%
17. medium Semgrep Missing or incorrect trustPolicy. Set `trustPolicy: no-downgrade` to prevent malicious package updates from downgrading security settings. Added in: v10.21.0 Reference: https://pnpm.io/settings#trustpolicy /pnpm-workspace.yaml:6 99%
18. medium Semgrep Missing or incorrect blockExoticSubdeps. Set `blockExoticSubdeps: true` to transitive dependencies from being installed from untrusted sources. Added in: v10.26.0 Reference: https://pnpm.io/settings#blockexoticsubdeps /pnpm-workspace.yaml:6 94%
19. medium Semgrep Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. /resources/assets/js/services/httpUpload.ts:73 55%
20. medium Semgrep File name based on user input risks server-side request forgery. /server.php:15 55%
21. low Dependency checker Loose version constraint: '@testing-library/user-event^14.6.1' — attacker could push malicious update package.json 8%
22. low Dependency checker Loose version constraint: '@fortawesome/free-regular-svg-icons^6.7.2' — attacker could push malicious update package.json 4%
23. low Dependency checker Loose version constraint: '@testing-library/vue^6.6.1' — attacker could push malicious update package.json 2%
24. low Dependency checker Loose version constraint: 'postcss^8.5.23' — attacker could push malicious update package.json 2%
25. low Dependency checker Loose version constraint: 'laravel-vite-plugin^2.1.0' — attacker could push malicious update package.json 2%
26. low Dependency checker Loose version constraint: 'postcss-mixins^10.0.1' — attacker could push malicious update package.json 2%
27. low Dependency checker Loose version constraint: 'postcss-nested^6.2.0' — attacker could push malicious update package.json 2%
28. low Dependency checker Loose version constraint: 'pusher-js^8.6.0' — attacker could push malicious update package.json 2%
29. low Dependency checker Loose version constraint: 'rollup-plugin-visualizer^6.0.3' — attacker could push malicious update package.json 2%
30. low Dependency checker Loose version constraint: 'tailwindcss^4.3.0' — attacker could push malicious update package.json 2%
31. low Dependency checker Loose version constraint: 'typescript^5.8.3' — attacker could push malicious update package.json 2%
32. low Dependency checker Loose version constraint: 'vitepress^1.6.3' — attacker could push malicious update package.json 2%
33. low Dependency checker Loose version constraint: 'vitepress-plugin-llms^1.11.0' — attacker could push malicious update package.json 2%
34. low Dependency checker Loose version constraint: 'vue-tsc^3.2.5' — attacker could push malicious update package.json 2%
35. low Dependency checker Loose version constraint: 'marked^17.0.4' — attacker could push malicious update package.json 2%
36. low Dependency checker Loose version constraint: 'lucide-vue-next^0.577.0' — attacker could push malicious update package.json 2%
37. low Dependency checker Loose version constraint: 'lodash-es^4.18.1' — attacker could push malicious update package.json 2%
38. low Dependency checker Loose version constraint: 'ky^2.1.0' — attacker could push malicious update package.json 2%
39. low Dependency checker Loose version constraint: 'ismobilejs^0.4.1' — attacker could push malicious update package.json 2%
40. low Dependency checker Loose version constraint: 'idb^8.0.3' — attacker could push malicious update package.json 2%
41. low Dependency checker Loose version constraint: 'fuse.js^7.1.0' — attacker could push malicious update package.json 2%
42. low Dependency checker Loose version constraint: 'events^3.3.0' — attacker could push malicious update package.json 2%
43. low Dependency checker Loose version constraint: 'dompurify^3.4.17' — attacker could push malicious update package.json 2%
44. low Dependency checker Loose version constraint: 'chart.js^4.5.1' — attacker could push malicious update package.json 2%
45. low Dependency checker Loose version constraint: '@zip.js/zip.js^2.18.2' — attacker could push malicious update package.json 2%
46. low Dependency checker Loose version constraint: '@tiptap/vue-3^3.31.4' — attacker could push malicious update package.json 2%
47. low Dependency checker Loose version constraint: '@tiptap/starter-kit^3.31.4' — attacker could push malicious update package.json 2%
48. low Dependency checker Loose version constraint: '@tiptap/pm^3.31.4' — attacker could push malicious update package.json 2%
49. low Dependency checker Loose version constraint: '@laravel/echo-vue^2.1.6' — attacker could push malicious update package.json 2%
50. low Dependency checker Loose version constraint: '@fortawesome/vue-fontawesome^3.0.8' — attacker could push malicious update package.json 2%
51. low Dependency checker Loose version constraint: '@fortawesome/free-solid-svg-icons^6.7.2' — attacker could push malicious update package.json 2%
52. low Dependency checker Loose version constraint: '@fortawesome/free-brands-svg-icons^6.7.2' — attacker could push malicious update package.json 2%
53. low Dependency checker Loose version constraint: '@fortawesome/fontawesome-svg-core^6.7.2' — attacker could push malicious update package.json 2%
54. low Dependency checker Loose version constraint: '@types/lodash-es^4.17.12' — attacker could push malicious update package.json 2%
55. low Dependency checker Loose version constraint: 'nprogress^0.2.0' — attacker could push malicious update package.json 2%
56. low Dependency checker Loose version constraint: 'qrcode^1.5.4' — attacker could push malicious update package.json 2%
57. low Dependency checker Loose version constraint: 'style-observer^0.1.2' — attacker could push malicious update package.json 2%
58. low Dependency checker Loose version constraint: 'three^0.146.0' — attacker could push malicious update package.json 2%
59. low Dependency checker Loose version constraint: 'tiny-typed-emitter^2.1.0' — attacker could push malicious update package.json 2%
60. low Dependency checker Loose version constraint: 'vue^3.5.44' — attacker could push malicious update package.json 2%
61. low Dependency checker Loose version constraint: 'vue-advanced-cropper^2.8.9' — attacker could push malicious update package.json 2%
62. low Dependency checker Loose version constraint: 'vue-chartjs^5.3.4' — attacker could push malicious update package.json 2%
63. low Dependency checker Loose version constraint: 'youtube-player^5.6.0' — attacker could push malicious update package.json 2%
64. low Dependency checker Loose version constraint: '@commitlint/cli^19.8.1' — attacker could push malicious update package.json 2%
65. low Dependency checker Loose version constraint: '@commitlint/config-conventional^19.8.1' — attacker could push malicious update package.json 2%
66. low Dependency checker Loose version constraint: '@faker-js/faker^10.5.0' — attacker could push malicious update package.json 2%
67. low Dependency checker Loose version constraint: '@floating-ui/dom^1.7.2' — attacker could push malicious update package.json 2%
68. low Dependency checker Loose version constraint: '@tailwindcss/postcss^4.3.0' — attacker could push malicious update package.json 2%
69. low Dependency checker Loose version constraint: '@tailwindcss/vite^4.3.0' — attacker could push malicious update package.json 2%
70. low Dependency checker Loose version constraint: 'nouislider^14.7.0' — attacker could push malicious update package.json 2%
71. low Dependency checker Loose version constraint: '@types/nprogress^0.2.3' — attacker could push malicious update package.json 2%
72. low Dependency checker Loose version constraint: '@types/pusher-js^4.2.2' — attacker could push malicious update package.json 2%
73. low Dependency checker Loose version constraint: '@types/three^0.144.0' — attacker could push malicious update package.json 2%
74. low Dependency checker Loose version constraint: '@types/youtube-player^5.5.11' — attacker could push malicious update package.json 2%
75. low Dependency checker Loose version constraint: '@vitejs/plugin-vue^6.0.4' — attacker could push malicious update package.json 2%
76. low Dependency checker Loose version constraint: '@vueuse/components^13.4.0' — attacker could push malicious update package.json 2%
77. low Dependency checker Loose version constraint: '@vueuse/core^13.4.0' — attacker could push malicious update package.json 2%
78. low Dependency checker Loose version constraint: '@vueuse/integrations^13.4.0' — attacker could push malicious update package.json 2%
79. low Dependency checker Loose version constraint: 'autoprefixer^10.4.21' — attacker could push malicious update package.json 2%
80. low Dependency checker Loose version constraint: 'factoria^5.0.0' — attacker could push malicious update package.json 2%
81. low Dependency checker Loose version constraint: 'fake-indexeddb^6.2.5' — attacker could push malicious update package.json 2%
82. low Dependency checker Loose version constraint: 'jest-serializer-vue^2.0.2' — attacker could push malicious update package.json 2%
83. low Dependency checker Loose version constraint: 'jsdom^26.1.0' — attacker could push malicious update package.json 2%
84. low Dependency checker Loose version constraint: 'laravel-echo^2.1.6' — attacker could push malicious update package.json 2%

No findings match these filters. Clear filters