MalDet · Static Security Report
This repository has a critical vulnerability score of 485.0, which means there are serious insecure coding patterns that an attacker could exploit to break into your system. While the code does not appear to be intentionally malicious, it contains many instances of unsafe commands like child_process and shell execution that could lead to command injection attacks if used incorrectly. You should avoid using these dangerous functions unless you have a very specific reason and implement strict input validation to prevent them from being abused. Additionally, there are several medium-priority issues related to Regular Expression Denial-of-Service (ReDoS) risks in your codebase that could slow down or crash applications if exploited. Overall, the repository is not safe for production use without a thorough security review and refactoring of these specific patterns before deployment.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 19 | 229 | 0 | 248 |
| yara | Signatures of malicious behaviour in source files | 1 | 0 | 7 | 8 |
| guarddog | Malicious package and install-time behaviour | 0 | 0 | 3 | 3 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 2 | 2 |
214 of 261 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Detected calls to child_process from a function argument `answers`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | 1 | /project-base/storefront/cypress/runSelectedTests.js:41 |
| high | semgrep | Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. | 1 | /project-base/storefront/cypress/runSelectedTests.js:41 |
| high | semgrep | This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised | 2 | /.github/workflows/ai-acceptance-criteria-ready-for-review.yaml:34 |
| high | semgrep | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use | 9 | /.github/workflows/monorepo-force-split-branch.yaml:31 |
| high | semgrep | Executing non-constant commands. This can lead to command injection. | 3 | /packages/framework/src/Command/DatabaseDumpCommand.php:62 |
| high | semgrep | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. | 3 | /docker/mkdocs/Dockerfile:11 |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 1 | /packages/php-image/Dockerfile |
| medium | semgrep | RegExp() called with a `route` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle | 1 | /project-base/storefront/utils/skeleton/getSkeletonTypeFromRouteUrl.ts:65 |
| medium | semgrep | RegExp() called with a `graphqlEndpoint` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user | 1 | /project-base/storefront/utils/sentry/tracePropagationTargets.ts:30 |
| medium | semgrep | RegExp() called with a `directiveRegexps` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on use | 1 | /project-base/storefront/urql/fetcher.ts:108 |
| medium | semgrep | RegExp() called with a `parameterName` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-c | 1 | /project-base/app/assets/js/admin/grapesjs/plugins/web/video.js:96 |
| medium | semgrep | RegExp() called with a `internalEndpoint` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on use | 1 | /project-base/storefront/utils/sentry/tracePropagationTargets.ts:44 |
| medium | semgrep | `$queryBuilder` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. | 2 | /packages/framework/src/Model/Product/Parameter/ParameterGridFactory.php:100 |
| medium | semgrep | `$this->em->createQueryBuilder()->select($tmpTableAlias . '.id')` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parame | 1 | /packages/framework/src/Component/Router/FriendlyUrl/FriendlyUrlRepository.php:221 |
| medium | semgrep | `$this->em->createQueryBuilder()->select($tmpTableAlias . '.id') ->from($entity, $tmpTableAlias)` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not prope | 1 | /packages/framework/src/Component/Router/FriendlyUrl/FriendlyUrlRepository.php:222 |
| medium | semgrep | `$queryBuilder ->addSelect('pt_' . $locale)` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use paramet | 2 | /packages/framework/src/Model/Product/Parameter/ParameterGridFactory.php:105 |
| medium | semgrep | `$this->em->createQueryBuilder()` Detected string concatenation with a non-literal variable in a Doctrine QueryBuilder method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared stat | 1 | /packages/framework/src/Component/Router/FriendlyUrl/FriendlyUrlRepository.php:220 |
| medium | semgrep | `pattern.replace` method will only replace the first occurrence when used with a string argument ('*'). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. | 1 | /project-base/storefront/cypress/cypress.config.ts:161 |
| medium | semgrep | This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' | 1 | /project-base/docker/nginx/nginx.conf:38 |
| medium | semgrep | This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: | 2 | /.github/dependabot.yml:8 |
| medium | semgrep | CSRF protection is disabled for this configuration. This is a security risk. Make sure that it is safe or consider setting `csrf_protection` property to `true`. | 1 | /packages/framework/src/Form/Admin/QuickSearch/QuickSearchFormType.php:30 |
| medium | semgrep | Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mit | 1 | /project-base/docker/nginx/nginx.conf:174 |
| medium | semgrep | RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control | 1 | /project-base/storefront/cypress/cypress.config.ts:161 |
| medium | semgrep | Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. | 2 | /packages/mcp/src/Component/Database/Query/SqlExecutor.php:64 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 177 | /.github/workflows/docker-build.yaml:729 |
| medium | semgrep | The `redirect()` method does not check its destination in any way. If you redirect to a URL provided by end-users, your application may be open to the unvalidated redirects security vulnerability. Consider using literal values or an allowlist to validate URLs. | 11 | /packages/administration/src/Controller/AbstractCrudController.php:330 |
| medium | semgrep | Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. | 1 | /project-base/storefront/cypress/generateSnapshotsInfoTable.js:29 |
| medium | semgrep | Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HT | 13 | /project-base/storefront/components/Blocks/StoreList/StoreExpandedInfo.tsx:33 |
| medium | semgrep | Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). | 1 | /packages/framework/src/Model/Administrator/Security/AdministratorFrontSecurityFacade.php:77 |
| medium | semgrep | Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. | 5 | /packages/framework/src/Component/Filesystem/Flysystem/VolumeDriver.php:135 |
| low | guarddog | Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] | 3 | /project-base/storefront/buildPublicEnvConfig.ts:23 |
| low | dep_checker | Loose version constraint: 'fs-extra^11.2.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'globby^14.0.2' — attacker could push malicious update | 1 | package.json |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 7 | /docker/conf/docker-compose-mac.yml.dist |