MalDet · Static Security Report
The repository has a medium vulnerability score of 41.0, which means there are several insecure coding patterns that an attacker could exploit if they find and use the code. However, the malicious-pattern risk is zero, indicating that the code does not appear to be intentionally designed to harm others. The most serious issues involve using functions like mark_safe() and exec() without proper checks, which can lead to cross-site scripting attacks or dangerous code injection. Additionally, there are several loose version constraints for popular libraries like Django and PyYAML, meaning attackers might push malicious updates that could break your application. While the code itself is not malicious, it relies on outdated versions of critical packages that could be vulnerable to known exploits.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 0 | 16 | 0 | 16 |
| bandit | Insecure coding patterns in Python source | 0 | 5 | 0 | 5 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 4 | 4 |
18 of 25 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| medium | semgrep | 'mark_safe()' is used to mark a string as "safe" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead. | 2 | /slippers/templatetags/slippers.py:129 |
| medium | bandit | Potential XSS on mark_safe function. | 2 | /slippers/props.py:163 |
| medium | bandit | Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed. | 2 | /slippers/templatetags/slippers.py:129 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 12 | /.github/workflows/docs.yml:11 |
| medium | semgrep | Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. | 1 | /slippers/props.py:51 |
| medium | semgrep | Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS. | 1 | /slippers/templatetags/slippers.py:127 |
| medium | bandit | Use of exec detected. | 1 | /slippers/props.py:51 |
| low | dep_checker | Loose version constraint: 'Django>=3.2' — attacker could push malicious update | 1 | pyproject.toml |
| low | dep_checker | Loose version constraint: 'PyYAML>=5.4.0' — attacker could push malicious update | 1 | pyproject.toml |
| low | dep_checker | Loose version constraint: 'typeguard>=2.13.3,<3' — attacker could push malicious update | 1 | pyproject.toml |
| low | dep_checker | Loose version constraint: 'typing-extensions>=4.4.0' — attacker could push malicious update | 1 | pyproject.toml |