Leaderboard github.com
Mintplex-Labs/anything-llm
Stop renting your intelligence. Own it with AnythingLLM. Everything you need for a powerful local-first agent experience
AI provenance
1%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
61/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
52/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
1% explicit
Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals.
How the score is built
- Explicitly attributed share1%
- Unattributed share in AI-pace bursts5%
- Estimated AI-generated share1%
- AI tool configuration files0
- Work sessions at AI pace7
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.11
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 10 | 2,562 | 2026-02-12 | 2026-10-19 |
| OpenAI Codex | 9 | 1,100 | 2026-04-23 | 2026-10-12 |
| Cursor agent | 1 | 332 | 2026-08-18 | 2026-08-18 |
| Devin | 1 | 2 | 2026-03-18 | 2026-03-18 |
Lines added per month all AI-attributed share
- 2023-0610,072 · 0% AI
- 2023-076,498 · 0% AI
- 2023-086,642 · 0% AI
- 2023-091,915 · 0% AI
- 2023-106,954 · 0% AI
- 2023-114,767 · 0% AI
- 2023-125,596 · 0% AI
- 2024-018,530 · 0% AI
- 2024-0214,028 · 0% AI
- 2024-033,724 · 0% AI
- 2024-0414,653 · 0% AI
- 2024-059,092 · 0% AI
- 2024-0611,497 · 0% AI
- 2024-079,040 · 0% AI
- 2024-087,155 · 0% AI
- 2024-093,775 · 0% AI
- 2024-103,505 · 0% AI
- 2024-119,937 · 0% AI
- 2024-123,795 · 0% AI
- 2025-013,412 · 0% AI
- 2025-0212,011 · 0% AI
- 2025-0322,440 · 0% AI
- 2025-048,666 · 0% AI
- 2025-058,896 · 0% AI
- 2025-067,610 · 0% AI
- 2025-076,444 · 0% AI
- 2025-085,028 · 0% AI
- 2025-092,531 · 0% AI
- 2025-105,118 · 0% AI
- 2025-114,328 · 0% AI
- 2025-123,402 · 0% AI
- 2026-0113,067 · 0% AI
- 2026-026,056 · 0% AI
- 2026-0331,709 · 1% AI
- 2026-0438,969 · 0% AI
- 2026-0517,878 · 1% AI
- 2026-069,679 · 0% AI
- 2026-0725,961 · 0% AI
- 2026-0824,885 · 4% AI
- 2026-0916,081 · 2% AI
- 2026-1021,937 · 10% AI
- 2026-1117,971 · 0% AI
Findings in AI-attributed lines vs the rest
From git blame: 2,782 lines trace to AI-attributed commits, 274,040 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.73 | 0.00× |
| Security | 0.00 | 1.09 | 0.00× |
Evidence by analyzer
Explicit AI attributionok25 items
- Claude Code: 10 attributed commits, 2,562 lines added
- OpenAI Codex: 9 attributed commits, 1,100 lines added
- Devin: 1 attributed commits, 2 lines added
- Cursor agent: 1 attributed commits, 332 lines added
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: PR description attribution
- OpenAI Codex: PR branch 'codex/fix-cancel-queued-scheduled-jobs'
- OpenAI Codex: PR branch 'codex/fix-pgvector-rollback'
- OpenAI Codex: PR branch 'codex/fix-anthropic-serial-tools'
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- OpenAI Codex: PR branch 'codex/fix-generic-openai-agent-max-tokens'
- OpenAI Codex: PR branch 'codex/enforce-workspace-memory-limit'
- Cursor agent: trailer 'Co-authored-by: Cursor'
- OpenAI Codex: PR branch 'codex/fix-zh-tw-scheduled-jobs'
- OpenAI Codex: PR branch 'codex/add-datetime-prompt'
- Claude Code: trailer 'Co-Authored-By: Claude'
- OpenAI Codex: PR branch 'codex/terms-wording-20260601'
- Claude Code: PR description attribution
- OpenAI Codex: PR branch 'codex/add-baidu-search-provider'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Devin: trailer 'Co-authored-by: Devin'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- attributed_commit_share
- 0.8%
- attributed_commits
- 21
- attributed_loc
- 3,996
- attributed_loc_share
- 0.9%
- commits
- 2,558
- effective_loc
- 455,254
- tools_detected
- 4
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok7 items
- 2,142 lines of first-party code in ~0.5h (4,284 lines/hour, PR #1923)
- 1,471 lines of first-party code in ~0.5h (2,855 lines/hour, PR #3678)
- 9,547 lines of first-party code in ~4.0h (2,387 lines/hour, 1 commit session)
- 1,171 lines of first-party code in ~0.5h (2,342 lines/hour, PR #5783)
- 1,103 lines of first-party code in ~0.5h (2,206 lines/hour, PR #4100)
- 4,238 lines of first-party code in ~4.1h (1,035 lines/hour, PR #4907)
- 1,560 lines of first-party code in ~2.5h (613 lines/hour, PR #3699)
- excluded_import_loc
- 94,779
- flagged_loc
- 21,232
- flagged_loc_share
- 5.9%
- flagged_units
- 7
- max_loc_per_hour
- 4,284
- measured_loc
- 360,475
- median_loc_per_hour
- 22.30
- pr_timed_units
- 1,611
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 2,005
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 2,781.40
- releases
- 38
Coding styleok6 items
- step-by-step narration comment: // Step 1: Calculated rules (always re-evaluated, they're instant)
- step-by-step narration comment: // Step 2: LLM rules (cached to avoid expensive re-classification)
- step-by-step narration comment: // Step 3: No rule matched — check sticky route
- step-by-step narration comment: // Step 4: Sticky expired — use fallback
- step-by-step narration comment: // First, fallback to the workspace chat provider and model if they exist
- step-by-step narration comment: // First, fallback to the workspace chat provider and model if they exist
- count:assistant_voice
- 0
- count:emoji_in_code
- 50
- count:narrated_steps
- 6
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 25
- files:narrated_steps
- 3
- files:placeholder
- 0
- index
- 0.11
- lines_scanned
- 276,822
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.18
- per_kloc:narrated_steps
- 0.02
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 2,782
- blame_failures
- 0
- files_blamed
- 1,241
- other_lines
- 274,040
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 200
- quality:other_per_kloc
- 0.73
- quality:ratio
- 0
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 300
- security:other_per_kloc
- 1.09
- security:ratio
- 0
Code quality
61 weak
Code quality is weak: test-to-source ratio 0.10, CI runs tests; 16% of function code in complex or long functions; 17% duplicated lines. Weakest area: duplication.
How the score is built
- Complexity62
- Duplication36
- Lint and smells39
- Tests and CI80
- Documentation80
- Type safetynot measured
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- checkSetup in server/utils/agents/index.js: complexity 80, 185 lines
- providerDefault in server/utils/agents/index.js: complexity 79, 89 lines
- LangChainChatModel in server/utils/agents/aibitat/providers/ai-provider.js: complexity 69, 328 lines
- getCustomModels in server/utils/helpers/customModels.js: complexity 64, 139 lines
- reducer in frontend/src/components/Modals/ManageWorkspace/Documents/hooks/useDocumentPicker.js: complexity 62, 245 lines
- renderChart in frontend/src/components/WorkspaceChat/ChatContainer/ChatHistory/Chartable/index.jsx: complexity 47, 247 lines
- getLLMProviderConnector in server/utils/helpers/index.js: complexity 46, 133 lines
- #buildProviderForConfig in server/utils/agents/aibitat/index.js: complexity 44, 127 lines
- getLLMProviderClass in server/utils/helpers/index.js: complexity 43, 128 lines
- getBaseLLMProviderModel in server/utils/helpers/index.js: complexity 43, 84 lines
- complex_functions
- 142
- function_nloc
- 140,384
- functions
- 11,605
- long_functions
- 118
- many_param_functions
- 2
- mean_ccn
- 2.81
- p90_ccn
- 6
- risky_nloc_share
- 15.9%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: cloud-deployments/openshift/docker-entrypoint.sh:13 and docker/docker-entrypoint.sh:3
- 6+ duplicated lines: collector/eslint.config.mjs:11 and server/eslint.config.mjs:11
- 6+ duplicated lines: collector/extensions/index.js:82 and collector/extensions/index.js:108
- 6+ duplicated lines: collector/extensions/resync/index.js:27 and collector/extensions/resync/index.js:55
- 6+ duplicated lines: collector/index.js:1 and server/index.js:1
- 6+ duplicated lines: collector/index.js:50 and collector/index.js:80
- 6+ duplicated lines: collector/middleware/httpLogger.js:1 and server/middleware/httpLogger.js:1
- 6+ duplicated lines: collector/processLink/convert/generic.js:87 and collector/utils/extensions/WebsiteDepth/index.js:189
- 6+ duplicated lines: collector/processSingleFile/convert/asAudio.js:2 and collector/processSingleFile/convert/asDocx.js:3
- 6+ duplicated lines: collector/processSingleFile/convert/asAudio.js:47 and collector/processSingleFile/convert/asEPub.js:26
- compared_lines
- 210,080
- duplicated_lines
- 36,110
- duplicated_share
- 17.2%
- files
- 1,241
Lintok
- category:best-practice
- 602
- category:correctness
- 1,412
- findings
- 2,014
- scanned_lines
- 276,248
- weighted_findings
- 1,042.75
Tests and CIok11 items
- CI config: .github/workflows/build-and-push-image-semver.yaml
.github/workflows/build-and-push-image-semver.yaml - CI config: .github/workflows/build-and-push-image.yaml
.github/workflows/build-and-push-image.yaml - CI config: .github/workflows/build-qa-tag.yaml
.github/workflows/build-qa-tag.yaml - CI config: .github/workflows/check-package-versions.yaml
.github/workflows/check-package-versions.yaml - CI config: .github/workflows/check-translations.yaml
.github/workflows/check-translations.yaml - CI config: .github/workflows/cleanup-qa-tag.yaml
.github/workflows/cleanup-qa-tag.yaml - CI config: .github/workflows/lint.yaml
.github/workflows/lint.yaml - CI config: .github/workflows/run-tests.yaml
.github/workflows/run-tests.yaml - CI config: .github/workflows/sponsors.yaml
.github/workflows/sponsors.yaml - CI runs tests (yarn test)
- CI runs linters (eslint)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- yes
- ci_files
- 9
- cochange_commits
- 284
- cochange_share
- 32.0%
- source_lines
- 276,822
- test_lines
- 27,393
- test_ratio
- 0.10
Documentationok3 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 249
Type safetyskipped
Security
52 weak
Security posture is weak: 503 known vulnerabilities in 131 dependencies; 8 high-severity SAST findings; 36 high-severity workflow issues. Weakest area: dependencies.
How the score is built
- Secrets97
- Static analysis (SAST)85
- Vulnerable dependencies0
- CI workflows0
- Security posture60
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 161
- declared
- 161
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 1
Static analysis (opengrep)ok
- findings
- 599
- findings_high
- 8
- findings_low
- 149
- findings_medium
- 442
- parse_errors
- 1
- scanned_lines
- 276,248
- weighted_findings
- 127.56
Dependencies (osv-scanner)ok
- penalty
- 913
- vulnerabilities
- 503
- vulnerable_packages
- 131
- vulns_critical
- 10
- vulns_high
- 230
- vulns_low
- 38
- vulns_medium
- 218
- vulns_unknown
- 7
CI workflows (zizmor)ok
- findings
- 53
- findings_high
- 36
- findings_low
- 0
- findings_medium
- 17
- penalty
- 435.60
- workflows
- 9
Security postureok2 items
- Security policy: SECURITY.md
SECURITY.md - package.json has no lockfile alongside it (unpinned dependencies)
package.json
- check:dependency_updates
- no
- check:lockfiles
- no
- check:security_policy
- yes
- check:signed_commits
- yes
- signed_commit_share
- 94.5%
- unpinned_manifests
- 1
Release downloadsok5 items
- release v1.19.0 ships AnythingLLMDesktop-Arm64.AppImage (332 downloads)
- release v1.19.0 ships AnythingLLMDesktop-Arm64.exe (485 downloads)
- release v1.19.0 ships AnythingLLMDesktop-Silicon.dmg (1100 downloads)
- release v1.19.0 ships AnythingLLMDesktop.AppImage (1496 downloads)
- release v1.19.0 ships AnythingLLMDesktop.dmg (343 downloads)
- binary_assets
- 55
- signals
- 1
- suspicious
- 0
Findings
10 critical298 high545 medium1 low
854 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-5rq4-664w-9x2c |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-5rq4-664w-9x2c | Dependencies (osv-scanner) |
| critical | osv/GHSA-hrh2-vp3x-79xf |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-hrh2-vp3x-79xf | Dependencies (osv-scanner) |
| critical | osv/GHSA-jqcg-44mw-7w3h |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h; also in server/yarn.lock | Dependencies (osv-scanner) |
| critical | osv/GHSA-mp2f-45pm-3cg9 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-mp2f-45pm-3cg9 | Dependencies (osv-scanner) |
| critical | osv/GHSA-q9v2-7m5w-4693 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-q9v2-7m5w-4693; also in server/yarn.lock | Dependencies (osv-scanner) |
| critical | osv/GHSA-xq3m-2v4x-88gg |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-xq3m-2v4x-88gg; also in server/yarn.lock | Dependencies (osv-scanner) |
| critical | osv/GHSA-xq3m-2v4x-88gg |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-xq3m-2v4x-88gg | Dependencies (osv-scanner) |
| critical | osv/GHSA-h755-8qp9-cq85 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-h755-8qp9-cq85 | Dependencies (osv-scanner) |
| critical | osv/GHSA-m7jm-9gc2-mpf2 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-m7jm-9gc2-mpf2 | Dependencies (osv-scanner) |
| critical | osv/GHSA-xq3m-2v4x-88gg |
server/yarn.lock | [email protected] (npm) is affected by GHSA-xq3m-2v4x-88gg | Dependencies (osv-scanner) |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/LogoContext.jsx:29 | Calling setState on the current state is always a no-op. Did you mean to change the state like setIsCustomLogo(!isCustomLogo) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/components/CanViewChatHistory/index.jsx:43 | Calling setState on the current state is always a no-op. Did you mean to change the state like setViewable(!viewable) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/components/Footer/index.jsx:40 | Calling setState on the current state is always a no-op. Did you mean to change the state like setFooterData(!footerData) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/components/LLMSelection/AnthropicAiOptions/index.jsx:104 | Calling setState on the current state is always a no-op. Did you mean to change the state like setModels(!models) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/components/LLMSelection/NvidiaNimOptions/remote.jsx:83 | Calling setState on the current state is always a no-op. Did you mean to change the state like setModels(!models) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/components/LLMSelection/PrivateModeOptions/index.jsx:28 | Calling setState on the current state is always a no-op. Did you mean to change the state like setModels(!models) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/components/Modals/Password/MultiUserAuth.jsx:202 | Calling setState on the current state is always a no-op. Did you mean to change the state like setUser(!user) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/components/Modals/Password/MultiUserAuth.jsx:203 | Calling setState on the current state is always a no-op. Did you mean to change the state like setToken(!token) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/components/Modals/Password/MultiUserAuth.jsx:206 | Calling setState on the current state is always a no-op. Did you mean to change the state like setRecoveryCodes(!recoveryCodes) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/components/Modals/Password/SingleUserAuth.jsx:36 | Calling setState on the current state is always a no-op. Did you mean to change the state like setToken(!token) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/components/Modals/Password/SingleUserAuth.jsx:38 | Calling setState on the current state is always a no-op. Did you mean to change the state like setRecoveryCodes(!recoveryCodes) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/components/Sidebar/ActiveWorkspaces/ThreadContainer/index.jsx:68 | Calling setState on the current state is always a no-op. Did you mean to change the state like setThreads(!threads) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/Admin/DefaultSystemPrompt/index.jsx:40 | Calling setState on the current state is always a no-op. Did you mean to change the state like setSaneDefaultSystemPrompt(!saneDefaultSystemPrompt) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/Admin/Invitations/NewInviteModal/index.jsx:35 | Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/Admin/Users/NewUserModal/index.jsx:41 | Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/Admin/Users/UserRow/EditUserModal/index.jsx:58 | Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/Admin/Workspaces/NewWorkspaceModal/index.jsx:22 | Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/GeneralSettings/ApiKeys/NewApiKeyModal/index.jsx:37 | Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/GeneralSettings/BrowserExtensionApiKey/NewBrowserExtensionApiKeyModal/index.jsx:37 | Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/GeneralSettings/ChatEmbedWidgets/EmbedConfigs/EmbedRow/EditEmbedModal/index.jsx:36 | Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/GeneralSettings/ChatEmbedWidgets/EmbedConfigs/NewEmbedModal/index.jsx:46 | Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/GeneralSettings/CommunityHub/ImportItem/Steps/PullAndReview/index.jsx:18 | Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/GeneralSettings/CommunityHub/ImportItem/Steps/PullAndReview/index.jsx:19 | Calling setState on the current state is always a no-op. Did you mean to change the state like setItem(!item) instead? | Lint |
| high | opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state |
frontend/src/pages/Invite/NewUserModal/index.jsx:44 | Calling setState on the current state is always a no-op. Did you mean to change the state like setError(!error) instead? | Lint |
| high | zizmor/unpinned-uses |
.github/workflows/build-and-push-image-semver.yaml:20 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/build-and-push-image-semver.yaml:36 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build-and-push-image-semver.yaml:36 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build-and-push-image-semver.yaml:67 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build-and-push-image.yaml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/build-and-push-image.yaml:55 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build-and-push-image.yaml:55 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build-and-push-image.yaml:88 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build-qa-tag.yaml:41 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/build-qa-tag.yaml:44 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build-qa-tag.yaml:44 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build-qa-tag.yaml:49 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build-qa-tag.yaml:59 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check-package-versions.yaml:23 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check-package-versions.yaml:26 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check-translations.yaml:23 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check-translations.yaml:26 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/lint.yaml:31 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/lint.yaml:51 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/lint.yaml:52 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/lint.yaml:55 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/lint.yaml:69 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/lint.yaml:70 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/lint.yaml:73 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/lint.yaml:87 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/lint.yaml:88 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/lint.yaml:91 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/run-tests.yaml:20 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/run-tests.yaml:23 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/run-tests.yaml:28 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/run-tests.yaml:38 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/run-tests.yaml:48 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/sponsors.yaml:14 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/sponsors.yaml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/sponsors.yaml:27 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/sponsors.yaml:34 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/javascript.lang.security.detect-child-process |
collector/utils/WhisperProviders/ffmpeg/index.js:65 | Detected calls to child_process from a function argument `pathToTest`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly... | Static analysis (opengrep) |
| high | osv/GHSA-22p9-wv53-3rq4 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-22p9-wv53-3rq4 | Dependencies (osv-scanner) |
| high | osv/GHSA-23c5-xmqv-rm74 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-23c5-xmqv-rm74 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74; also in frontend/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-25h7-pfq9-p65f |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-25h7-pfq9-p65f | Dependencies (osv-scanner) |
| high | osv/GHSA-27p8-2357-5qqv |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-27p8-2357-5qqv | Dependencies (osv-scanner) |
| high | osv/GHSA-27r3-jxmh-p828 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-27r3-jxmh-p828; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-2883-xcg3-v3hh |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-2m5v-pch6-74hx |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx | Dependencies (osv-scanner) |
| high | osv/GHSA-2v35-w6hq-6mfw |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-2v35-w6hq-6mfw | Dependencies (osv-scanner) |
| high | osv/GHSA-2x7j-588g-ccc2 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-2x7j-588g-ccc2 | Dependencies (osv-scanner) |
| high | osv/GHSA-3644-q5cj-c5c7 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-3644-q5cj-c5c7 | Dependencies (osv-scanner) |
| high | osv/GHSA-37ch-88jc-xwx2 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-37ch-88jc-xwx2; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-3h5v-q93c-6h6q |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-3h5v-q93c-6h6q | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp | Dependencies (osv-scanner) |
| high | osv/GHSA-3ppc-4f35-3m26 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-3ppc-4f35-3m26 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26; also in frontend/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-4r6h-8v6p-xvw6 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-4r6h-8v6p-xvw6 | Dependencies (osv-scanner) |
| high | osv/GHSA-4w3w-2rp5-g8jm |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-4w3w-2rp5-g8jm | Dependencies (osv-scanner) |
| high | osv/GHSA-52cp-r559-cp3m |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-52cp-r559-cp3m; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-5p4m-2wfm-xmqj |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-5pgg-2g8v-p4x9 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-5pgg-2g8v-p4x9 | Dependencies (osv-scanner) |
| high | osv/GHSA-66ff-xgx4-vchm |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-66ff-xgx4-vchm; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-685m-2w69-288q |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-685m-2w69-288q; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-6v7q-wjvx-w8wg |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-6v7q-wjvx-w8wg | Dependencies (osv-scanner) |
| high | osv/GHSA-75px-5xx7-5xc7 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-75px-5xx7-5xc7; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-7pqw-9j4j-h8q3 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-7pqw-9j4j-h8q3 | Dependencies (osv-scanner) |
| high | osv/GHSA-7q85-xj36-vmfc |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-7q85-xj36-vmfc; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-7r86-cg39-jmmj |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-7r86-cg39-jmmj |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj; also in frontend/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-8238-w5pm-2374 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-8238-w5pm-2374; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-8344-3jmq-59r6 |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-8344-3jmq-59r6 | Dependencies (osv-scanner) |
| high | osv/GHSA-8cj5-5rvv-wf4v |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-8cj5-5rvv-wf4v | Dependencies (osv-scanner) |
| high | osv/GHSA-8gw3-rxh4-v6jx |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-8gw3-rxh4-v6jx; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-93r5-fhx6-vmg9 |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-93r5-fhx6-vmg9 | Dependencies (osv-scanner) |
| high | osv/GHSA-965w-775f-mr7g |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-965w-775f-mr7g | Dependencies (osv-scanner) |
| high | osv/GHSA-96hv-2xvq-fx4p |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-96hv-2xvq-fx4p | Dependencies (osv-scanner) |
| high | osv/GHSA-c2c7-rcm5-vvqj |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-c2qf-rxjj-qqgw |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-c2qf-rxjj-qqgw; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-c475-qrg2-pj4r |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-c475-qrg2-pj4r | Dependencies (osv-scanner) |
| high | osv/GHSA-c7q8-3ch8-vqpv |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-c7q8-3ch8-vqpv | Dependencies (osv-scanner) |
| high | osv/GHSA-f6ww-3ggp-fr8h |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-f6ww-3ggp-fr8h | Dependencies (osv-scanner) |
| high | osv/GHSA-f88m-g3jw-g9cj |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-f88m-g3jw-g9cj; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-f88m-g3jw-g9cj |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-f88m-g3jw-g9cj | Dependencies (osv-scanner) |
| high | osv/GHSA-hmw2-7cc7-3qxx |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-hmw2-7cc7-3qxx | Dependencies (osv-scanner) |
| high | osv/GHSA-j5f4-cc29-5x44 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-j5f4-cc29-5x44; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-j759-j44w-7fr8 |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-j759-j44w-7fr8 | Dependencies (osv-scanner) |
| high | osv/GHSA-jc85-fpwf-qm7x |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-jc85-fpwf-qm7x; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-jmr9-qjv8-65gv |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-jmr9-qjv8-65gv | Dependencies (osv-scanner) |
| high | osv/GHSA-jvwf-75h9-cwgg |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-jvwf-75h9-cwgg; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-mwp4-54f8-5fhr |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-mwp4-54f8-5fhr | Dependencies (osv-scanner) |
| high | osv/GHSA-p6gq-j5cr-w38f |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-p6gq-j5cr-w38f | Dependencies (osv-scanner) |
| high | osv/GHSA-pq67-2wwv-3xjx |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-pq67-2wwv-3xjx | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-qpx9-hpmf-5gmw |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-qpx9-hpmf-5gmw | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm | Dependencies (osv-scanner) |
| high | osv/GHSA-r399-636x-v7f6 |
collector/yarn.lock | @langchain/[email protected] (npm) is affected by GHSA-r399-636x-v7f6 | Dependencies (osv-scanner) |
| high | osv/GHSA-r399-636x-v7f6 |
collector/yarn.lock | @langchain/[email protected] (npm) is affected by GHSA-r399-636x-v7f6 | Dependencies (osv-scanner) |
| high | osv/GHSA-r399-636x-v7f6 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-r399-636x-v7f6; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-r399-636x-v7f6 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-r399-636x-v7f6 | Dependencies (osv-scanner) |
| high | osv/GHSA-r5fr-rjxr-66jc |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-r5fr-rjxr-66jc; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-r7g4-qg5f-qqm2 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-r7g4-qg5f-qqm2 | Dependencies (osv-scanner) |
| high | osv/GHSA-rcmh-qjqh-p98v |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rcmh-qjqh-p98v | Dependencies (osv-scanner) |
| high | osv/GHSA-rcw4-f5rp-g42v |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rcw4-f5rp-g42v; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-rf6f-7fwh-wjgh |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rf6f-7fwh-wjgh | Dependencies (osv-scanner) |
| high | osv/GHSA-rgj7-g3m4-5g8c |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rgj7-g3m4-5g8c; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-rgj7-g3m4-5g8c |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rgj7-g3m4-5g8c | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 | Dependencies (osv-scanner) |
| high | osv/GHSA-rp42-5vxx-qpwr |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rp42-5vxx-qpwr | Dependencies (osv-scanner) |
| high | osv/GHSA-rpmf-866q-6p89 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rpmf-866q-6p89 | Dependencies (osv-scanner) |
| high | osv/GHSA-v245-v573-v5vm |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-v245-v573-v5vm | Dependencies (osv-scanner) |
| high | osv/GHSA-v53p-9fqp-m79j |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-v53p-9fqp-m79j | Dependencies (osv-scanner) |
| high | osv/GHSA-v9p9-hfj2-hcw8 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-v9p9-hfj2-hcw8 | Dependencies (osv-scanner) |
| high | osv/GHSA-vj76-c3g6-qr5v |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-vj76-c3g6-qr5v | Dependencies (osv-scanner) |
| high | osv/GHSA-vrm6-8vpv-qv8q |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-vrm6-8vpv-qv8q | Dependencies (osv-scanner) |
| high | osv/GHSA-vxpw-j846-p89q |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-vxpw-j846-p89q | Dependencies (osv-scanner) |
| high | osv/GHSA-w2rr-34g9-rvrj |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-w2rr-34g9-rvrj | Dependencies (osv-scanner) |
| high | osv/GHSA-w5hq-g745-h8pq |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq | Dependencies (osv-scanner) |
| high | osv/GHSA-w5hq-g745-h8pq |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-wcpc-wj8m-hjx6 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-wcpc-wj8m-hjx6; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-wh4c-j3r5-mjhp |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-wh4c-j3r5-mjhp | Dependencies (osv-scanner) |
| high | osv/GHSA-wq5f-xc86-pv6w |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-wq5f-xc86-pv6w; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-wq5f-xc86-pv6w |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-wq5f-xc86-pv6w | Dependencies (osv-scanner) |
| high | osv/GHSA-x4fp-j954-r2f4 |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-x4fp-j954-r2f4 | Dependencies (osv-scanner) |
| high | osv/GHSA-x6wf-f3px-wcqx |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-x6wf-f3px-wcqx | Dependencies (osv-scanner) |
| high | osv/GHSA-x8mw-p69m-v3mx |
collector/yarn.lock | @fastify/[email protected] (npm) is affected by GHSA-x8mw-p69m-v3mx | Dependencies (osv-scanner) |
| high | osv/GHSA-xcpc-8h2w-3j85 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-xcpc-8h2w-3j85; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | opengrep/javascript.browser.security.insecure-document-method |
frontend/src/components/WorkspaceChat/index.jsx:200 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
frontend/src/components/WorkspaceChat/index.jsx:200 | User controlled data in a `target.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | osv/GHSA-22p9-wv53-3rq4 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-22p9-wv53-3rq4 | Dependencies (osv-scanner) |
| high | osv/GHSA-25h7-pfq9-p65f |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-25h7-pfq9-p65f; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-28wg-ghj8-5hjv |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv | Dependencies (osv-scanner) |
| high | osv/GHSA-2v37-7h3g-55p8 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 | Dependencies (osv-scanner) |
| high | osv/GHSA-2w69-qvjg-hvjx |
frontend/yarn.lock | @remix-run/[email protected] (npm) is affected by GHSA-2w69-qvjg-hvjx | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp | Dependencies (osv-scanner) |
| high | osv/GHSA-3xgq-45jj-v275 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-3xgq-45jj-v275 | Dependencies (osv-scanner) |
| high | osv/GHSA-587h-7wmj-h5pm |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm | Dependencies (osv-scanner) |
| high | osv/GHSA-5j98-mcp5-4vw2 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-5j98-mcp5-4vw2 | Dependencies (osv-scanner) |
| high | osv/GHSA-66ff-xgx4-vchm |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-66ff-xgx4-vchm | Dependencies (osv-scanner) |
| high | osv/GHSA-685m-2w69-288q |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-685m-2w69-288q | Dependencies (osv-scanner) |
| high | osv/GHSA-68fv-2mgg-jv7q |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q | Dependencies (osv-scanner) |
| high | osv/GHSA-6g55-p6wh-862q |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-6g55-p6wh-862q | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-73wf-gq98-2v4g |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g | Dependencies (osv-scanner) |
| high | osv/GHSA-73wf-gq98-2v4g |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g | Dependencies (osv-scanner) |
| high | osv/GHSA-75px-5xx7-5xc7 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-75px-5xx7-5xc7 | Dependencies (osv-scanner) |
| high | osv/GHSA-c27g-q93r-2cwf |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-c27g-q93r-2cwf | Dependencies (osv-scanner) |
| high | osv/GHSA-c83g-rgw3-j3cx |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx | Dependencies (osv-scanner) |
| high | osv/GHSA-c83g-rgw3-j3cx |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx | Dependencies (osv-scanner) |
| high | osv/GHSA-gcx4-mw62-g8wm |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-gcx4-mw62-g8wm | Dependencies (osv-scanner) |
| high | osv/GHSA-jvwf-75h9-cwgg |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-jvwf-75h9-cwgg | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-mrv2-3pqr-j5jr |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr | Dependencies (osv-scanner) |
| high | osv/GHSA-mw96-cpmx-2vgc |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-mw96-cpmx-2vgc | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-r28c-9q8g-f849 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-r28c-9q8g-f849 | Dependencies (osv-scanner) |
| high | osv/GHSA-r7fv-28h4-cvq7 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-r7fv-28h4-cvq7 | Dependencies (osv-scanner) |
| high | osv/GHSA-rf6f-7fwh-wjgh |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-rf6f-7fwh-wjgh; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895; also in server/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 | Dependencies (osv-scanner) |
| high | osv/GHSA-v245-v573-v5vm |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-v245-v573-v5vm | Dependencies (osv-scanner) |
| high | osv/GHSA-wcpc-wj8m-hjx6 |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-wcpc-wj8m-hjx6 | Dependencies (osv-scanner) |
| high | osv/GHSA-xwg4-73v4-xw9w |
frontend/yarn.lock | [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w | Dependencies (osv-scanner) |
| high | opengrep/javascript.browser.security.insecure-document-method |
server/swagger/index.js:24 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
server/swagger/index.js:24 | User controlled data in a `elm.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
server/swagger/index.js:26 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
server/swagger/index.js:26 | User controlled data in a `elm.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.lang.security.detect-child-process |
server/utils/files/index.js:589 | Detected calls to child_process from a function argument `rgPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly... | Static analysis (opengrep) |
| high | osv/GHSA-22jm-h49p-29qw |
server/yarn.lock | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-22jm-h49p-29qw | Dependencies (osv-scanner) |
| high | osv/GHSA-27r3-jxmh-p828 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 | Dependencies (osv-scanner) |
| high | osv/GHSA-2883-xcg3-v3hh |
server/yarn.lock | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh | Dependencies (osv-scanner) |
| high | osv/GHSA-28wg-ghj8-5hjv |
server/yarn.lock | [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv | Dependencies (osv-scanner) |
| high | osv/GHSA-2m5v-pch6-74hx |
server/yarn.lock | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx | Dependencies (osv-scanner) |
| high | osv/GHSA-2m5v-pch6-74hx |
server/yarn.lock | [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx | Dependencies (osv-scanner) |
| high | osv/GHSA-2p57-rm9w-gvfp |
server/yarn.lock | [email protected] (npm) is affected by GHSA-2p57-rm9w-gvfp | Dependencies (osv-scanner) |
| high | osv/GHSA-345p-7cg4-v4c7 |
server/yarn.lock | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-345p-7cg4-v4c7 | Dependencies (osv-scanner) |
| high | osv/GHSA-35jp-ww65-95wh |
server/yarn.lock | [email protected] (npm) is affected by GHSA-35jp-ww65-95wh | Dependencies (osv-scanner) |
| high | osv/GHSA-3644-q5cj-c5c7 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-3644-q5cj-c5c7 | Dependencies (osv-scanner) |
| high | osv/GHSA-3f6p-5ww8-9rcr |
server/yarn.lock | [email protected] (npm) is affected by GHSA-3f6p-5ww8-9rcr | Dependencies (osv-scanner) |
| high | osv/GHSA-3g43-6gmg-66jw |
server/yarn.lock | [email protected] (npm) is affected by GHSA-3g43-6gmg-66jw | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
server/yarn.lock | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp | Dependencies (osv-scanner) |
| high | osv/GHSA-43fc-jf86-j433 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-43fc-jf86-j433 | Dependencies (osv-scanner) |
| high | osv/GHSA-4528-x5fx-h6hg |
server/yarn.lock | [email protected] (npm) is affected by GHSA-4528-x5fx-h6hg | Dependencies (osv-scanner) |
| high | osv/GHSA-46jr-4wx8-v453 |
server/yarn.lock | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-46jr-4wx8-v453 | Dependencies (osv-scanner) |
| high | osv/GHSA-4c8g-83qw-93j6 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-4c8g-83qw-93j6 | Dependencies (osv-scanner) |
| high | osv/GHSA-4hjh-wcwx-xvwj |
server/yarn.lock | [email protected] (npm) is affected by GHSA-4hjh-wcwx-xvwj | Dependencies (osv-scanner) |
| high | osv/GHSA-52cp-r559-cp3m |
server/yarn.lock | [email protected] (npm) is affected by GHSA-52cp-r559-cp3m | Dependencies (osv-scanner) |
| high | osv/GHSA-535w-7cp7-47q4 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-535w-7cp7-47q4 | Dependencies (osv-scanner) |
| high | osv/GHSA-5375-pq7m-f5r2 |
server/yarn.lock | @grpc/[email protected] (npm) is affected by GHSA-5375-pq7m-f5r2 | Dependencies (osv-scanner) |
| high | osv/GHSA-5528-5vmv-3xc2 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-5528-5vmv-3xc2 | Dependencies (osv-scanner) |
| high | osv/GHSA-5p2g-fcmc-qvqq |
server/yarn.lock | [email protected] (npm) is affected by GHSA-5p2g-fcmc-qvqq | Dependencies (osv-scanner) |
| high | osv/GHSA-5p4m-2wfm-xmqj |
server/yarn.lock | [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj | Dependencies (osv-scanner) |
| high | osv/GHSA-62hf-57xw-28j9 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-62hf-57xw-28j9 | Dependencies (osv-scanner) |
| high | osv/GHSA-66ff-xgx4-vchm |
server/yarn.lock | [email protected] (npm) is affected by GHSA-66ff-xgx4-vchm | Dependencies (osv-scanner) |
| high | osv/GHSA-685m-2w69-288q |
server/yarn.lock | [email protected] (npm) is affected by GHSA-685m-2w69-288q | Dependencies (osv-scanner) |
| high | osv/GHSA-6chq-wfr3-2hj9 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-6chq-wfr3-2hj9 | Dependencies (osv-scanner) |
| high | osv/GHSA-6h2x-m376-mqjq |
server/yarn.lock | [email protected] (npm) is affected by GHSA-6h2x-m376-mqjq | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
server/yarn.lock | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-6qxp-vccf-f47h |
server/yarn.lock | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-6qxp-vccf-f47h | Dependencies (osv-scanner) |
| high | osv/GHSA-72gw-mp4g-v24j |
server/yarn.lock | [email protected] (npm) is affected by GHSA-72gw-mp4g-v24j | Dependencies (osv-scanner) |
| high | osv/GHSA-75px-5xx7-5xc7 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-75px-5xx7-5xc7 | Dependencies (osv-scanner) |
| high | osv/GHSA-7p8r-x3mc-p8w7 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-7p8r-x3mc-p8w7 | Dependencies (osv-scanner) |
| high | osv/GHSA-869p-cjfg-cm3x |
server/yarn.lock | [email protected] (npm) is affected by GHSA-869p-cjfg-cm3x | Dependencies (osv-scanner) |
| high | osv/GHSA-869p-cjfg-cm3x |
server/yarn.lock | [email protected] (npm) is affected by GHSA-869p-cjfg-cm3x | Dependencies (osv-scanner) |
| high | osv/GHSA-8cj5-5rvv-wf4v |
server/yarn.lock | [email protected] (npm) is affected by GHSA-8cj5-5rvv-wf4v | Dependencies (osv-scanner) |
| high | osv/GHSA-8cj5-5rvv-wf4v |
server/yarn.lock | [email protected] (npm) is affected by GHSA-8cj5-5rvv-wf4v | Dependencies (osv-scanner) |
| high | osv/GHSA-8gc5-j5rx-235r |
server/yarn.lock | [email protected] (npm) is affected by GHSA-8gc5-j5rx-235r | Dependencies (osv-scanner) |
| high | osv/GHSA-8r9q-7v3j-jr4g |
server/yarn.lock | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-8r9q-7v3j-jr4g | Dependencies (osv-scanner) |
| high | osv/GHSA-96hv-2xvq-fx4p |
server/yarn.lock | [email protected] (npm) is affected by GHSA-96hv-2xvq-fx4p | Dependencies (osv-scanner) |
| high | osv/GHSA-96hv-2xvq-fx4p |
server/yarn.lock | [email protected] (npm) is affected by GHSA-96hv-2xvq-fx4p | Dependencies (osv-scanner) |
| high | osv/GHSA-99f4-grh7-6pcq |
server/yarn.lock | @grpc/[email protected] (npm) is affected by GHSA-99f4-grh7-6pcq | Dependencies (osv-scanner) |
| high | osv/GHSA-f269-vfmq-vjvj |
server/yarn.lock | [email protected] (npm) is affected by GHSA-f269-vfmq-vjvj | Dependencies (osv-scanner) |
| high | osv/GHSA-f65p-4m7j-42xc |
server/yarn.lock | [email protected] (npm) is affected by GHSA-f65p-4m7j-42xc | Dependencies (osv-scanner) |
| high | osv/GHSA-f897-62hf-6gxq |
server/yarn.lock | @modelcontextprotocol/[email protected] (npm) is affected by GHSA-f897-62hf-6gxq | Dependencies (osv-scanner) |
| high | osv/GHSA-fjgf-rc76-4x9p |
server/yarn.lock | [email protected] (npm) is affected by GHSA-fjgf-rc76-4x9p | Dependencies (osv-scanner) |
| high | osv/GHSA-g5hg-p3ph-g8qg |
server/yarn.lock | [email protected] (npm) is affected by GHSA-g5hg-p3ph-g8qg | Dependencies (osv-scanner) |
| high | osv/GHSA-grv7-fg5c-xmjg |
server/yarn.lock | [email protected] (npm) is affected by GHSA-grv7-fg5c-xmjg | Dependencies (osv-scanner) |
| high | osv/GHSA-hfxv-24rg-xrqf |
server/yarn.lock | [email protected] (npm) is affected by GHSA-hfxv-24rg-xrqf | Dependencies (osv-scanner) |
| high | osv/GHSA-hmw2-7cc7-3qxx |
server/yarn.lock | [email protected] (npm) is affected by GHSA-hmw2-7cc7-3qxx | Dependencies (osv-scanner) |
| high | osv/GHSA-hmw2-7cc7-3qxx |
server/yarn.lock | [email protected] (npm) is affected by GHSA-hmw2-7cc7-3qxx | Dependencies (osv-scanner) |
| high | osv/GHSA-j3q9-mxjg-w52f |
server/yarn.lock | [email protected] (npm) is affected by GHSA-j3q9-mxjg-w52f | Dependencies (osv-scanner) |
| high | osv/GHSA-j5f8-grm9-p9fc |
server/yarn.lock | [email protected] (npm) is affected by GHSA-j5f8-grm9-p9fc | Dependencies (osv-scanner) |
| high | osv/GHSA-jmr7-xgp7-cmfj |
server/yarn.lock | [email protected] (npm) is affected by GHSA-jmr7-xgp7-cmfj | Dependencies (osv-scanner) |
| high | osv/GHSA-jqff-g426-hqxp |
server/yarn.lock | [email protected] (npm) is affected by GHSA-jqff-g426-hqxp | Dependencies (osv-scanner) |
| high | osv/GHSA-jr5f-v2jv-69x6 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-jr5f-v2jv-69x6 | Dependencies (osv-scanner) |
| high | osv/GHSA-jvwf-75h9-cwgg |
server/yarn.lock | [email protected] (npm) is affected by GHSA-jvwf-75h9-cwgg | Dependencies (osv-scanner) |
| high | osv/GHSA-m9gg-hp2v-232j |
server/yarn.lock | @grpc/[email protected] (npm) is affected by GHSA-m9gg-hp2v-232j | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
server/yarn.lock | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-mrv2-3pqr-j5jr |
server/yarn.lock | [email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr | Dependencies (osv-scanner) |
| high | osv/GHSA-p92q-9vqr-4j8v |
server/yarn.lock | [email protected] (npm) is affected by GHSA-p92q-9vqr-4j8v | Dependencies (osv-scanner) |
| high | osv/GHSA-pf86-5x62-jrwf |
server/yarn.lock | [email protected] (npm) is affected by GHSA-pf86-5x62-jrwf | Dependencies (osv-scanner) |
| high | osv/GHSA-ph9p-34f9-6g65 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-ph9p-34f9-6g65 | Dependencies (osv-scanner) |
| high | osv/GHSA-ph9p-34f9-6g65 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-ph9p-34f9-6g65 | Dependencies (osv-scanner) |
| high | osv/GHSA-pmwg-cvhr-8vh7 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-pmwg-cvhr-8vh7 | Dependencies (osv-scanner) |
| high | osv/GHSA-pq67-2wwv-3xjx |
server/yarn.lock | [email protected] (npm) is affected by GHSA-pq67-2wwv-3xjx | Dependencies (osv-scanner) |
| high | osv/GHSA-pq67-2wwv-3xjx |
server/yarn.lock | [email protected] (npm) is affected by GHSA-pq67-2wwv-3xjx | Dependencies (osv-scanner) |
| high | osv/GHSA-q3j6-qgpj-74h6 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-q3j6-qgpj-74h6 | Dependencies (osv-scanner) |
| high | osv/GHSA-q7qp-rjg7-q26m |
server/yarn.lock | [email protected] (npm) is affected by GHSA-q7qp-rjg7-q26m | Dependencies (osv-scanner) |
| high | osv/GHSA-q8qp-cvcw-x6jj |
server/yarn.lock | [email protected] (npm) is affected by GHSA-q8qp-cvcw-x6jj | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
server/yarn.lock | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm | Dependencies (osv-scanner) |
| high | osv/GHSA-qrxm-fqhp-jwvm |
server/yarn.lock | [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm | Dependencies (osv-scanner) |
| high | osv/GHSA-qw65-cvwx-89v3 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-qw65-cvwx-89v3 | Dependencies (osv-scanner) |
| high | osv/GHSA-r399-636x-v7f6 |
server/yarn.lock | @langchain/[email protected] (npm) is affected by GHSA-r399-636x-v7f6 | Dependencies (osv-scanner) |
| high | osv/GHSA-r5fr-rjxr-66jc |
server/yarn.lock | [email protected] (npm) is affected by GHSA-r5fr-rjxr-66jc | Dependencies (osv-scanner) |
| high | osv/GHSA-r5fr-rjxr-66jc |
server/yarn.lock | [email protected] (npm) is affected by GHSA-r5fr-rjxr-66jc | Dependencies (osv-scanner) |
| high | osv/GHSA-rfgv-xxqx-mfg5 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-rfgv-xxqx-mfg5 | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 | Dependencies (osv-scanner) |
| high | osv/GHSA-v2hh-gcrm-f6hx |
server/yarn.lock | [email protected] (npm) is affected by GHSA-v2hh-gcrm-f6hx | Dependencies (osv-scanner) |
| high | osv/GHSA-v39h-62p7-jpjc |
server/yarn.lock | [email protected] (npm) is affected by GHSA-v39h-62p7-jpjc | Dependencies (osv-scanner) |
| high | osv/GHSA-v52c-386h-88mc |
server/yarn.lock | [email protected] (npm) is affected by GHSA-v52c-386h-88mc | Dependencies (osv-scanner) |
| high | osv/GHSA-v9p9-hfj2-hcw8 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-v9p9-hfj2-hcw8 | Dependencies (osv-scanner) |
| high | osv/GHSA-vj76-c3g6-qr5v |
server/yarn.lock | [email protected] (npm) is affected by GHSA-vj76-c3g6-qr5v | Dependencies (osv-scanner) |
| high | osv/GHSA-vj76-c3g6-qr5v |
server/yarn.lock | [email protected] (npm) is affected by GHSA-vj76-c3g6-qr5v | Dependencies (osv-scanner) |
| high | osv/GHSA-vrm6-8vpv-qv8q |
server/yarn.lock | [email protected] (npm) is affected by GHSA-vrm6-8vpv-qv8q | Dependencies (osv-scanner) |
| high | osv/GHSA-vxpw-j846-p89q |
server/yarn.lock | [email protected] (npm) is affected by GHSA-vxpw-j846-p89q | Dependencies (osv-scanner) |
| high | osv/GHSA-w3rx-r6r6-pgpr |
server/yarn.lock | [email protected] (npm) is affected by GHSA-w3rx-r6r6-pgpr | Dependencies (osv-scanner) |
| high | osv/GHSA-w5hq-g745-h8pq |
server/yarn.lock | [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq | Dependencies (osv-scanner) |
| high | osv/GHSA-wc9g-mqfw-jrwm |
server/yarn.lock | [email protected] (npm) is affected by GHSA-wc9g-mqfw-jrwm | Dependencies (osv-scanner) |
| high | osv/GHSA-wcpc-wj8m-hjx6 |
server/yarn.lock | [email protected] (npm) is affected by GHSA-wcpc-wj8m-hjx6 | Dependencies (osv-scanner) |
| high | osv/GHSA-xf7r-hgr6-v32p |
server/yarn.lock | [email protected] (npm) is affected by GHSA-xf7r-hgr6-v32p | Dependencies (osv-scanner) |
| high | osv/GHSA-xjj6-f33q-929c |
server/yarn.lock | [email protected] (npm) is affected by GHSA-xjj6-f33q-929c | Dependencies (osv-scanner) |
| high | osv/GHSA-xwg4-73v4-xw9w |
server/yarn.lock | [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/index.js:103 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/index.js:128 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/index.js:152 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/index.js:180 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/index.js:228 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/resync/index.js:120 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/resync/index.js:157 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/resync/index.js:212 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/resync/index.js:245 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/resync/index.js:280 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/resync/index.js:49 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/extensions/resync/index.js:79 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/processSingleFile/index.js:83 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/OCRLoader/index.js:111 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/OCRLoader/index.js:237 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/WhisperProviders/GenericOpenAiWhisper.js:5 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/WhisperProviders/OpenAiWhisper.js:5 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/WhisperProviders/localWhisper.js:66 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/WhisperProviders/localWhisper.js:67 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/downloadURIToFile/index.js:56 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/downloadURIToFile/index.js:64 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/extensions/DrupalWiki/DrupalWiki/index.js:335 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/extensions/RepoLoader/GithubRepo/RepoLoader/index.js:179 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/extensions/RepoLoader/index.js:11 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/extensions/RepoLoader/index.js:14 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/extensions/RepoLoader/index.js:17 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/extensions/RepoLoader/index.js:20 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/extensions/RepoLoader/index.js:34 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/extensions/RepoLoader/index.js:37 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/extensions/RepoLoader/index.js:40 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/extensions/RepoLoader/index.js:43 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
collector/utils/extensions/YoutubeTranscript/YoutubeLoader/index.js:67 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
frontend/src/components/WorkspaceChat/ChatContainer/PromptInput/SpeechToText/BrowserNative/index.jsx:33 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/hooks/useWebPushNotifications.js:74 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.correctness.no-replaceall |
frontend/src/utils/keyboardShortcuts.js:76 | The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:390 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:393 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:396 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:400 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:403 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:407 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:410 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:414 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:417 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:420 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:423 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:426 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:429 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:432 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:435 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:438 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:441 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:445 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:449 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:453 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/endpoints/admin.js:456 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/agentFileServer.js:102 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/agentFileServer.js:103 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/agentFileServer.js:107 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/agentSkillWhitelist.js:17 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/agentSkillWhitelist.js:35 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/api/document/index.js:1283 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/api/openai/index.js:250 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/api/openai/index.js:282 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/system.js:1571 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/system.js:1603 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/system.js:207 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils.js:104 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils.js:120 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils.js:276 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils.js:48 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils.js:49 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils.js:50 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils.js:89 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils.js:94 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils.js:97 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils/outlookAgentUtils.js:109 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils/outlookAgentUtils.js:139 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils/outlookAgentUtils.js:177 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils/outlookAgentUtils.js:178 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/utils/outlookAgentUtils.js:35 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/workspaces.js:1045 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/workspaces.js:1081 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/endpoints/workspaces.js:259 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/jobs/helpers/scheduled-job-helper.js:86 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/apiKeys.js:76 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/apiKeys.js:8 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/browserExtensionApiKey.js:13 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/communityHub.js:116 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/communityHub.js:126 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/communityHub.js:127 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/communityHub.js:77 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/documentSyncQueue.js:133 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/documentSyncQueue.js:251 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/documentSyncQueue.js:93 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/documents.js:210 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/documents.js:338 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/documents.js:343 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/documents.js:393 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/documents.js:89 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/documents.js:90 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/eventLogs.js:85 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/invite.js:121 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/invite.js:53 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/invite.js:54 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/invite.js:6 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/modelRouter.js:44 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/models/scheduledJob.js:114 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/models/scheduledJob.js:114 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
server/models/scheduledJob.js:116 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJob.js:285 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJob.js:286 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJob.js:287 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJob.js:288 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJob.js:291 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJob.js:294 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJob.js:297 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJob.js:300 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJobRun.js:331 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJobRun.js:332 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJobRun.js:333 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/scheduledJobRun.js:334 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:1083 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:127 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:142 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:203 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:224 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:274 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:313 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:356 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:463 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:466 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:467 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:824 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/systemSettings.js:845 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/telemetry.js:51 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/temporaryAuthToken.js:15 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/user.js:124 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/user.js:197 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/user.js:341 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/user.js:380 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/user.js:384 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/workspace.js:338 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/workspace.js:356 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/workspace.js:538 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/workspace.js:539 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/workspace.js:668 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/workspace.js:669 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/workspace.js:679 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/workspaceChats.js:244 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/workspaceChats.js:245 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/workspaceThread.js:159 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/models/workspaceThread.js:94 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/swagger/utils.js:29 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/swagger/utils.js:43 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/anthropic/index.js:100 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/anthropic/index.js:34 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/anthropic/index.js:411 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/apipie/index.js:30 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/apipie/index.js:337 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/azureOpenAi/index.js:15 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/azureOpenAi/index.js:241 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/bedrock/index.js:103 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/bedrock/index.js:437 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/cerebras/index.js:17 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/cerebras/index.js:296 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/cohere/index.js:16 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/cohere/index.js:203 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/cometapi/index.js:31 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/cometapi/index.js:385 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/deepseek/index.js:228 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/deepseek/index.js:23 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/embeddedLemonade/config.js:160 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/embeddedLemonade/config.js:46 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/embeddedLemonade/endpoints.js:22 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
server/utils/AiProviders/embeddedLemonade/endpoints.js:23 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | zizmor/artipacked |
.github/workflows/build-and-push-image-semver.yaml:19 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/build-and-push-image.yaml:38 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/build-qa-tag.yaml:40 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/check-package-versions.yaml:18 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/check-package-versions.yaml:22 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/check-translations.yaml:18 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/check-translations.yaml:22 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/lint.yaml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/lint.yaml:46 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/lint.yaml:51 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/lint.yaml:64 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/lint.yaml:69 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/lint.yaml:82 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/lint.yaml:87 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/run-tests.yaml:15 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/run-tests.yaml:19 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/sponsors.yaml:13 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/convertAudioToWav/index.js:21 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/convertAudioToWav/index.js:30 | Detected that function argument `filename` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/convertAudioToWav/index.js:40 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/processSingleFile/index.js:27 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/processSingleFile/index.js:49 | Detected that function argument `options` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/processSingleFile/index.js:49 | Detected that function argument `targetFilename` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-require |
collector/processSingleFile/index.js:83 | Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/OCRLoader/index.js:226 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/OCRLoader/index.js:227 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/OCRLoader/index.js:76 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/OCRLoader/index.js:77 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/OCRLoader/index.js:86 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/WhisperProviders/GenericOpenAiWhisper.js:25 | Detected that function argument `fullFilePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/WhisperProviders/OpenAiWhisper.js:23 | Detected that function argument `fullFilePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/WhisperProviders/ffmpeg/index.js:64 | Detected that function argument `pathToTest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/WhisperProviders/ffmpeg/index.js:82 | Detected that function argument `inputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/WhisperProviders/ffmpeg/index.js:85 | Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/WhisperProviders/ffmpeg/index.js:85 | Detected that function argument `outputPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/WhisperProviders/localWhisper.js:20 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/downloadURIToFile/index.js:75 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/downloadURIToFile/index.js:76 | Detected that function argument `url` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
collector/utils/extensions/Confluence/ConfluenceLoader/index.js:117 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/extensions/DrupalWiki/DrupalWiki/index.js:259 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/DrupalWiki/DrupalWiki/index.js:260 | Detected that function argument `baseUrl` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/DrupalWiki/DrupalWiki/index.js:260 | Detected that function argument `baseUrl` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/extensions/RepoLoader/GiteaRepo/index.js:45 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/extensions/RepoLoader/GiteaRepo/index.js:47 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/RepoLoader/GiteaRepo/index.js:49 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/RepoLoader/GiteaRepo/index.js:50 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/extensions/RepoLoader/GithubRepo/index.js:45 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/extensions/RepoLoader/GithubRepo/index.js:47 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/RepoLoader/GithubRepo/index.js:49 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/RepoLoader/GithubRepo/index.js:50 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/extensions/RepoLoader/GitlabRepo/index.js:45 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/extensions/RepoLoader/GitlabRepo/index.js:47 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/RepoLoader/GitlabRepo/index.js:49 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/RepoLoader/GitlabRepo/index.js:50 | Detected that function argument `args` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/extensions/WebsiteDepth/index.js:230 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/WebsiteDepth/index.js:235 | Detected that function argument `startUrl` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/WebsiteDepth/index.js:236 | Detected that function argument `startUrl` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/YoutubeTranscript/index.js:154 | Detected that function argument `{ url }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/extensions/YoutubeTranscript/index.js:155 | Detected that function argument `{ url }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/files/index.js:102 | Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/files/index.js:140 | Detected that function argument `{ data = {}, filename, destinationOverride = null, options = {}, }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/files/index.js:168 | Detected that function argument `files` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/files/index.js:168 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/files/index.js:183 | Detected that function argument `files` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/files/index.js:183 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/files/index.js:209 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
collector/utils/files/index.js:210 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/files/index.js:32 | Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/files/index.js:68 | Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/files/index.js:70 | Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/files/index.js:71 | Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/files/index.js:87 | Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/files/index.js:90 | Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
collector/utils/files/index.js:96 | Detected that function argument `filepath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | osv/GHSA-268h-hp4c-crq3 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-268h-hp4c-crq3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-2pr8-phx7-x9h3 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-2pr8-phx7-x9h3; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-39m8-27wv-hr27 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-39m8-27wv-hr27 | Dependencies (osv-scanner) |
| medium | osv/GHSA-3g3m-2fjr-6pw4 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-3v7f-55p6-f55p |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-3v7f-55p6-f55p; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-4ffr-jq9g-5ffx |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-4ffr-jq9g-5ffx | Dependencies (osv-scanner) |
| medium | osv/GHSA-4g23-2xm8-66gc |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-4g23-2xm8-66gc | Dependencies (osv-scanner) |
| medium | osv/GHSA-4mjr-xmp4-gh2g |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-4mjr-xmp4-gh2g; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-4p3w-j4w9-5jqw |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-4p3w-j4w9-5jqw; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-5pm8-86m8-9m6r |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-5pm8-86m8-9m6r | Dependencies (osv-scanner) |
| medium | osv/GHSA-5v7r-6r5c-r473 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-5v7r-6r5c-r473 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6gmq-8vp8-gcm6 |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-6gmq-8vp8-gcm6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6h8r-xr42-gp59 |
collector/yarn.lock | @xmldom/[email protected] (npm) is affected by GHSA-6h8r-xr42-gp59 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6m59-8fmv-m5f9 |
collector/yarn.lock | @langchain/[email protected] (npm) is affected by GHSA-6m59-8fmv-m5f9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6m59-8fmv-m5f9 |
collector/yarn.lock | @langchain/[email protected] (npm) is affected by GHSA-6m59-8fmv-m5f9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-6vj9-mwq6-2f5v |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-6vj9-mwq6-2f5v | Dependencies (osv-scanner) |
| medium | osv/GHSA-7gmj-h9xc-mcxc |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-7gmj-h9xc-mcxc | Dependencies (osv-scanner) |
| medium | osv/GHSA-85x2-q946-cp5h |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-85x2-q946-cp5h | Dependencies (osv-scanner) |
| medium | osv/GHSA-8c8m-p3m8-cjg8 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-8c8m-p3m8-cjg8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-8m3c-c648-2xjj |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-8m3c-c648-2xjj | Dependencies (osv-scanner) |
| medium | osv/GHSA-8vvx-rff5-p5rq |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-8vvx-rff5-p5rq | Dependencies (osv-scanner) |
| medium | osv/GHSA-c6fg-446q-cg94 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-c6fg-446q-cg94; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-cc9r-2j5m-2m83 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-cc9r-2j5m-2m83 | Dependencies (osv-scanner) |
| medium | osv/GHSA-f38q-mgvj-vph7 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-f38q-mgvj-vph7; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-f886-m6hf-6m8v |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-f886-m6hf-6m8v | Dependencies (osv-scanner) |
| medium | osv/GHSA-f886-m6hf-6m8v |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-f886-m6hf-6m8v | Dependencies (osv-scanner) |
| medium | osv/GHSA-fw9q-39r9-c252 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-fw9q-39r9-c252 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fx83-v9x8-x52w |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-fx83-v9x8-x52w; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-g3hv-75wg-m249 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-g3hv-75wg-m249; also in frontend/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-g73g-hqqh-jr95 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-g73g-hqqh-jr95 | Dependencies (osv-scanner) |
| medium | osv/GHSA-gcqx-w48m-w2h4 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-gcqx-w48m-w2h4; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-gf3v-fwqg-4vh7 |
collector/yarn.lock | @langchain/[email protected] (npm) is affected by GHSA-gf3v-fwqg-4vh7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-gf3v-fwqg-4vh7 |
collector/yarn.lock | @langchain/[email protected] (npm) is affected by GHSA-gf3v-fwqg-4vh7 | Dependencies (osv-scanner) |
| medium | osv/GHSA-gxm5-99cw-xjw9 |
collector/yarn.lock | @fastify/[email protected] (npm) is affected by GHSA-gxm5-99cw-xjw9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-h39j-r5qq-r9mm |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-h39j-r5qq-r9mm | Dependencies (osv-scanner) |
| medium | osv/GHSA-h3mg-xc3c-68pw |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-h3mg-xc3c-68pw | Dependencies (osv-scanner) |
| medium | osv/GHSA-h67p-54hq-rp68 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-h67p-54hq-rp68; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-hc5w-c9f8-9cc4 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-hc5w-c9f8-9cc4; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-j6r3-76f7-8jcv |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-j6r3-76f7-8jcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-jggg-4jg4-v7c6 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-jggg-4jg4-v7c6; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-jwp9-9v96-94mx |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-jwp9-9v96-94mx | Dependencies (osv-scanner) |
| medium | osv/GHSA-m943-m63m-w62w |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-m943-m63m-w62w | Dependencies (osv-scanner) |
| medium | osv/GHSA-mphv-75cg-56wg |
collector/yarn.lock | @langchain/[email protected] (npm) is affected by GHSA-mphv-75cg-56wg | Dependencies (osv-scanner) |
| medium | osv/GHSA-mphv-75cg-56wg |
collector/yarn.lock | @langchain/[email protected] (npm) is affected by GHSA-mphv-75cg-56wg | Dependencies (osv-scanner) |
| medium | osv/GHSA-p498-v437-472g |
collector/yarn.lock | @humanfs/[email protected] (npm) is affected by GHSA-p498-v437-472g; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-p634-w6r4-rjp2 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-p634-w6r4-rjp2; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | osv/GHSA-q6x5-8v7m-xcrf |
collector/yarn.lock | @protobufjs/[email protected] (npm) is affected by GHSA-q6x5-8v7m-xcrf; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-q6x5-8v7m-xcrf |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-q6x5-8v7m-xcrf; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-r4jh-29pc-gfqr |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-r4jh-29pc-gfqr | Dependencies (osv-scanner) |
| medium | osv/GHSA-rpw4-54j3-4h4q |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rpw4-54j3-4h4q | Dependencies (osv-scanner) |
| medium | osv/GHSA-rr7j-v2q5-chgv |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rr7j-v2q5-chgv | Dependencies (osv-scanner) |
| medium | osv/GHSA-rxp7-6hxx-x8q5 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-rxp7-6hxx-x8q5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-v2v4-37r5-5v8g |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-v2v4-37r5-5v8g | Dependencies (osv-scanner) |
| medium | osv/GHSA-vvjj-xcjg-gr5g |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-vvjj-xcjg-gr5g | Dependencies (osv-scanner) |
| medium | osv/GHSA-vwc7-r8mq-g2x9 |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-vwc7-r8mq-g2x9; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-wmmp-3585-3rmp |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-wmmp-3585-3rmp | Dependencies (osv-scanner) |
| medium | osv/GHSA-wqvq-jvpq-h66f |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-wqvq-jvpq-h66f | Dependencies (osv-scanner) |
| medium | osv/GHSA-xxjr-mmjv-4gpg |
collector/yarn.lock | [email protected] (npm) is affected by GHSA-xxjr-mmjv-4gpg; also in frontend/yarn.lock; also in server/yarn.lock | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop |
extras/translator/index.mjs:10 | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop |
extras/translator/index.mjs:21 | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
extras/translator/index.mjs:232 | Detected that function argument `langCode` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop |
frontend/src/locales/findUnusedTranslations.mjs:187 | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
frontend/src/locales/findUnusedTranslations.mjs:68 | Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/src/locales/findUnusedTranslations.mjs:69 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
frontend/src/locales/findUnusedTranslations.mjs:69 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.browser.security.wildcard-postmessage-configuration |
frontend/src/pages/GeneralSettings/BrowserExtensionApiKey/BrowserExtensionApiKeyRow/index.jsx:50 | The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/javascript.browser.security.wildcard-postmessage-configuration |
frontend/src/pages/GeneralSettings/BrowserExtensionApiKey/NewBrowserExtensionApiKeyModal/index.jsx:32 | The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
frontend/src/pages/GeneralSettings/ScheduledJobs/utils/cron.js:166 | Detected the use of a regular expression `^\d+(-\d+)?(,\d+(-\d+)?)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
frontend/src/pages/GeneralSettings/ScheduledJobs/utils/cron.js:356 | Detected the use of a regular expression `^\d+(,\d+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/src/utils/chat/markdown.js:27 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/src/utils/chat/markdown.js:45 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/src/utils/chat/markdown.js:66 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/src/utils/chat/markdown.js:76 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/src/utils/chat/plugins/markdown-katex.js:227 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/src/utils/chat/plugins/markdown-katex.js:228 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
frontend/src/utils/keyboardShortcuts.js:112 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/tailwind.config.js:10 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.express.security.audit.express-path-join-resolve-traversal |
server/endpoints/agentFileServer.js:123 | Possible writing outside of the destination, make sure that the target path is nested in the intended destination [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/agentFileServer.js:123 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/agentFileServer.js:126 | Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.express.security.audit.xss.direct-response-write |
server/endpoints/agentFileServer.js:84 | Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/api/document/index.js:1024 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/api/document/index.js:1025 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/api/document/index.js:1028 | Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/api/document/index.js:1036 | Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/api/document/index.js:1170 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/api/document/index.js:1171 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/api/document/index.js:1179 | Detected that function argument `{ from, to }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/api/document/index.js:1179 | Detected that function argument `{ from, to }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.express.security.audit.express-path-join-resolve-traversal |
server/endpoints/api/document/index.js:1285 | Possible writing outside of the destination, make sure that the target path is nested in the intended destination [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/api/document/index.js:1285 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/api/document/index.js:1288 | Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/api/document/index.js:1292 | Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/document.js:34 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/document.js:35 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/document.js:38 | Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/document.js:46 | Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/document.js:82 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/document.js:83 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/document.js:92 | Detected that function argument `{ from, to }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/document.js:92 | Detected that function argument `{ from, to }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/system.js:860 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/system.js:862 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/system.js:864 | Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/system.js:864 | Detected that function argument `response` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/system.js:864 | Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/system.js:864 | Detected that function argument `response` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/system.js:947 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/endpoints/system.js:949 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/system.js:951 | Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/system.js:951 | Detected that function argument `response` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/system.js:951 | Detected that function argument `request` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/endpoints/system.js:951 | Detected that function argument `response` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
server/index.js:177 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/jobs/cleanup-generated-images.js:26 | Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/jobs/cleanup-generated-images.js:26 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/jobs/cleanup-orphan-documents.js:19 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/jobs/cleanup-orphan-documents.js:20 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/jobs/cleanup-orphan-documents.js:21 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/jobs/cleanup-orphan-documents.js:22 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/jobs/cleanup-orphan-documents.js:34 | Detected that function argument `batchSize` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/jobs/cleanup-orphan-documents.js:34 | Detected that function argument `filesToDelete` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/models/workspaceParsedFiles.js:125 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:126 | Detected that function argument `fileId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:126 | Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:126 | Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/models/workspaceParsedFiles.js:134 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:135 | Detected that function argument `fileId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:135 | Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:135 | Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:135 | Detected that function argument `fileId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:135 | Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:135 | Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:136 | Detected that function argument `fileId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:136 | Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:136 | Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/models/workspaceParsedFiles.js:248 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:250 | Detected that function argument `thread` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:250 | Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:250 | Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:252 | Detected that function argument `thread` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:252 | Detected that function argument `user` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/models/workspaceParsedFiles.js:252 | Detected that function argument `workspace` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/swagger/index.js:24 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/swagger/index.js:26 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/cerebras/index.js:180 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/deepseek/index.js:128 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/AiProviders/embeddedLemonade/engine.js:235 | Detected that function argument `destination` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/embeddedLemonade/index.js:229 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/AiProviders/embeddedLemonade/index.js:524 | Detected that function argument `modelId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/AiProviders/embeddedLemonade/index.js:571 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/AiProviders/embeddedLemonade/index.js:581 | Detected that function argument `repoDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/AiProviders/embeddedLemonade/index.js:584 | Detected that function argument `repoDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/AiProviders/embeddedLemonade/index.js:589 | Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/AiProviders/embeddedLemonade/index.js:590 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/AiProviders/embeddedLemonade/index.js:590 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/AiProviders/embeddedLemonade/index.js:592 | Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/foundry/index.js:471 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/foundry/index.js:475 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/foundry/index.js:503 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/genericOpenAi/index.js:219 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/genericOpenAi/index.js:359 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/genericOpenAi/index.js:363 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/genericOpenAi/index.js:389 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/giteeai/index.js:125 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/koboldCPP/index.js:168 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/lemonade/index.js:157 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/llmman/index.js:353 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/lmStudio/index.js:218 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/mistral/index.js:154 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/ollama/index.js:305 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/omlx/index.js:225 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/openAi/index.js:283 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/openRouter/index.js:234 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/openRouter/index.js:455 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/openRouter/index.js:459 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/AiProviders/openRouter/index.js:487 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/EmbeddingEngines/native/index.js:132 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/SpeechToText/helpers.js:18 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/SpeechToText/helpers.js:23 | Detected that function argument `extension` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/SpeechToText/helpers.js:28 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/SpeechToText/helpers.js:29 | Detected that function argument `extension` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/SpeechToText/helpers.js:31 | Detected that function argument `extension` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/TextSplitter/index.js:145 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop |
server/utils/agentFlows/executor.js:136 | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop |
server/utils/agentFlows/executor.js:139 | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop |
server/utils/agentFlows/executor.js:144 | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.jquery-insecure-selector |
server/utils/agentFlows/executors/web-scraping.js:104 | User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
server/utils/agentFlows/executors/web-scraping.js:104 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.jquery-insecure-selector |
server/utils/agentFlows/executors/web-scraping.js:92 | User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
server/utils/agentFlows/executors/web-scraping.js:98 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agentFlows/index.js:107 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agentFlows/index.js:123 | Detected that function argument `uuid` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agentFlows/index.js:158 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agentFlows/index.js:160 | Detected that function argument `uuid` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agentFlows/index.js:162 | Detected that function argument `uuid` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agentFlows/index.js:72 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agentFlows/index.js:76 | Detected that function argument `uuid` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agentFlows/index.js:80 | Detected that function argument `uuid` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/images.js:331 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/create-files/lib.js:135 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/create-files/lib.js:148 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/create-files/lib.js:217 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/create-files/lib.js:249 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/create-files/lib.js:87 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/create-files/lib.js:88 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/create-files/pptx/images.js:341 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/create-files/pptx/images.js:342 | Detected that function argument `storageFilename` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
server/utils/agents/aibitat/plugins/create-files/pptx/render.js:1304 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:130 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:147 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:151 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:157 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:171 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:211 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:212 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:218 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:246 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:253 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:275 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:52 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/plugins/create-files/pptx/thumbnail.js:54 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-redos |
server/utils/agents/aibitat/plugins/create-scheduled-job/cronUtils.js:118 | Detected the use of a regular expression `^\d+(-\d+)?(,\d+(-\d+)?)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/copy-file.js:12 | Detected that function argument `source` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/copy-file.js:21 | Detected that function argument `destination` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/copy-file.js:22 | Detected that function argument `destination` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/copy-file.js:23 | Detected that function argument `source` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/copy-file.js:25 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/copy-file.js:25 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/copy-file.js:27 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/copy-file.js:27 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/copy-file.js:30 | Detected that function argument `source` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/copy-file.js:30 | Detected that function argument `destination` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/create-directory.js:67 | Detected that function argument `{ path: dirPath = "" }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/lib.js:121 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/lib.js:162 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/lib.js:166 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/lib.js:179 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:212 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:213 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:213 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:216 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:265 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:322 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:327 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:387 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/lib.js:449 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:466 | Detected that function argument `requestedPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:486 | Detected that function argument `requestedPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:516 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:551 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:569 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/lib.js:68 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:705 | Detected that function argument `currentPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/lib.js:708 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/lib.js:708 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:77 | Detected that function argument `directories` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/lib.js:815 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/lib.js:96 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/list-directory.js:102 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
server/utils/agents/aibitat/plugins/filesystem/list-directory.js:102 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/list-directory.js:104 | Detected that function argument `entry` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/list-directory.js:104 | Detected that function argument `{ path: dirPath = "", includeSizes = false, sortBy = "name", }` has entered the fs module. An attacker could potentially control the location of this file,... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/filesystem/list-directory.js:78 | Detected that function argument `{ path: dirPath = "", includeSizes = false, sortBy = "name", }` has entered the fs module. An attacker could potentially control the location of this file,... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/gmail/lib.js:115 | Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/gmail/lib.js:117 | Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/gmail/lib.js:30 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/gmail/lib.js:34 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/gmail/lib.js:44 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/gmail/lib.js:85 | Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/gmail/lib.js:92 | Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/gmail/lib.js:93 | Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/outlook/lib.js:267 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/outlook/lib.js:271 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/outlook/lib.js:281 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/outlook/lib.js:322 | Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/outlook/lib.js:329 | Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/outlook/lib.js:330 | Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/outlook/lib.js:352 | Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
server/utils/agents/aibitat/plugins/outlook/lib.js:354 | Detected that function argument `attachment` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.sqli.node-mssql-sqli |
server/utils/agents/aibitat/plugins/sql-agent/SQLConnectors/MSSQL.js:77 | Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.sqli.node-mysql-sqli |
server/utils/agents/aibitat/plugins/sql-agent/SQLConnectors/MySQL.js:42 | Detected a `mysql2/promise` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.sqli.node-mysql-sqli |
server/utils/agents/aibitat/plugins/sql-agent/SQLConnectors/MySQL.js:43 | Detected a `mysql2/promise` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop |
server/utils/agents/aibitat/providers/helpers/dereferenceSchema.js:39 | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/providers/helpers/responsesTooled.js:203 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/providers/helpers/responsesTooled.js:267 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/providers/helpers/tooled.js:285 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/providers/helpers/tooled.js:385 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/providers/helpers/tooled.js:499 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/providers/helpers/untooled.js:263 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/providers/helpers/untooled.js:410 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/providers/helpers/untooled.js:484 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
server/utils/agents/aibitat/providers/llmman.js:468 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
server/utils/vectorDbProviders/pinecone/PINECONE_SETUP.md:22 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 200 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | skipped | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 53 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 300 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 300 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 1 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 4d09fa5f7306 | prov-5+qual-2+sec-2 | 1% | 61 | 52 |
Full text report
- Repository: https://github.com/Mintplex-Labs/anything-llm
- Commit:
4d09fa5f730698d39f1d783e47316744b260a700 - Generated: 2026-11-14T16:36:37+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 1 | explicit | 95% | 100% |
| Code quality | 61 | weak | 90% | 100% |
| Security | 52 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals.
- Explicitly attributed share (lower bound): 0.9%
- Unattributed share in AI-consistent velocity bursts: 4.7%
- Estimated AI-generated share: 0.9%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 10 | 2,562 |
| OpenAI Codex | 9 | 1,100 |
| Devin | 1 | 2 |
| Cursor agent | 1 | 332 |
Current source lines last changed by AI-attributed commits: 2,782 of 276,822.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 0.73 | 0.0x |
| Security | 0.0 | 1.095 | 0.0x |
- Stylometry index: 0.11 per 1,000 lines (narrated steps 6, placeholders 0, assistant phrasing 0, emoji 50). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 3,402 | 0% |
| 2026-01 | 13,067 | 0% |
| 2026-02 | 6,056 | 0% |
| 2026-03 | 31,709 | 1% |
| 2026-04 | 38,969 | 0% |
| 2026-05 | 17,878 | 1% |
| 2026-06 | 9,679 | 0% |
| 2026-07 | 25,961 | 0% |
| 2026-08 | 24,885 | 4% |
| 2026-09 | 16,081 | 2% |
| 2026-10 | 21,937 | 10% |
| 2026-11 | 17,971 | 0% |
Evidence
- Claude Code: trailer 'Co-authored-by: Claude' (93623daa776c)
- Claude Code: PR description attribution (4949328c4529)
- OpenAI Codex: PR branch 'codex/fix-cancel-queued-scheduled-jobs' (ce48dbaa95d9)
- OpenAI Codex: PR branch 'codex/fix-pgvector-rollback' (2749f98ddb57)
- OpenAI Codex: PR branch 'codex/fix-anthropic-serial-tools' (7f5e2b5ce35b)
- Claude Code: PR description attribution (d5b7c87f3f05)
- Claude Code: PR description attribution (c09759673fa3)
- OpenAI Codex: PR branch 'codex/fix-generic-openai-agent-max-tokens' (effcf539e70c)
- OpenAI Codex: PR branch 'codex/enforce-workspace-memory-limit' (29713f29f6cc)
- Cursor agent: trailer 'Co-authored-by: Cursor' (88e19b6df19d)
- OpenAI Codex: PR branch 'codex/fix-zh-tw-scheduled-jobs' (6550b8c5f801)
- OpenAI Codex: PR branch 'codex/add-datetime-prompt' (24004334b3d4)
- Claude Code: trailer 'Co-Authored-By: Claude' (a9e3c0585fc9)
- OpenAI Codex: PR branch 'codex/terms-wording-20260601' (7c1e55c1d0c7)
- Claude Code: PR description attribution (7d884c7863c4)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.10, CI runs tests; 16% of function code in complex or long functions; 17% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 62 |
| Duplication | 36 |
| Code smells (Opengrep) | 39 |
| Tests and CI | 80 |
| Documentation | 80 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 11,605; mean complexity 2.8, 90th percentile 6; 142 complex and 118 long functions
- Duplicated lines: 17.2% of 210,080 compared
- Tests: 27,393 test lines for 276,822 source lines (ratio 0.10); CI test commands: yarn test; 32% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- checkSetup in server/utils/agents/index.js: complexity 80, 185 lines
- providerDefault in server/utils/agents/index.js: complexity 79, 89 lines
- LangChainChatModel in server/utils/agents/aibitat/providers/ai-provider.js: complexity 69, 328 lines
- getCustomModels in server/utils/helpers/customModels.js: complexity 64, 139 lines
- reducer in frontend/src/components/Modals/ManageWorkspace/Documents/hooks/useDocumentPicker.js: complexity 62, 245 lines
Security
Security posture is weak: 503 known vulnerabilities in 131 dependencies; 8 high-severity SAST findings; 36 high-severity workflow issues. Weakest area: dependencies.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 85 |
| Vulnerable dependencies (OSV) | 0 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 503 in 131 packages (critical 10, high 230, medium 218, low 38)
-
Posture checks passed: security policy, signed commits; missing: dependency updates, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-5rq4-664w-9x2c: [email protected] (npm) is affected by GHSA-5rq4-664w-9x2c |
collector/yarn.lock |
| critical | osv/GHSA-hrh2-vp3x-79xf: [email protected] (npm) is affected by GHSA-hrh2-vp3x-79xf |
collector/yarn.lock |
| critical | osv/GHSA-mp2f-45pm-3cg9: [email protected] (npm) is affected by GHSA-mp2f-45pm-3cg9 |
collector/yarn.lock |
| critical | osv/GHSA-q9v2-7m5w-4693: [email protected] (npm) is affected by GHSA-q9v2-7m5w-4693; also in server/yarn.lock |
collector/yarn.lock |
| critical | osv/GHSA-xq3m-2v4x-88gg: [email protected] (npm) is affected by GHSA-xq3m-2v4x-88gg; also in server/yarn.lock |
collector/yarn.lock |
| critical | osv/GHSA-jqcg-44mw-7w3h: [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h; also in server/yarn.lock |
collector/yarn.lock |
| critical | osv/GHSA-xq3m-2v4x-88gg: [email protected] (npm) is affected by GHSA-xq3m-2v4x-88gg |
frontend/yarn.lock |
| critical | osv/GHSA-m7jm-9gc2-mpf2: [email protected] (npm) is affected by GHSA-m7jm-9gc2-mpf2 |
server/yarn.lock |
| critical | osv/GHSA-h755-8qp9-cq85: [email protected] (npm) is affected by GHSA-h755-8qp9-cq85 |
server/yarn.lock |
| critical | osv/GHSA-xq3m-2v4x-88gg: [email protected] (npm) is affected by GHSA-xq3m-2v4x-88gg |
server/yarn.lock |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument pathToTest. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
collector/utils/WhisperProviders/ffmpeg/index.js:65 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
frontend/src/components/WorkspaceChat/index.jsx:200 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a target.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
frontend/src/components/WorkspaceChat/index.jsx:200 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
server/swagger/index.js:24 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a elm.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
server/swagger/index.js:24 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
server/swagger/index.js:26 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a elm.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
server/swagger/index.js:26 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument rgPath. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
server/utils/files/index.js:589 |
| high | osv/GHSA-x8mw-p69m-v3mx: @fastify/[email protected] (npm) is affected by GHSA-x8mw-p69m-v3mx |
collector/yarn.lock |
| high | osv/GHSA-r399-636x-v7f6: @langchain/[email protected] (npm) is affected by GHSA-r399-636x-v7f6 |
collector/yarn.lock |
| high | osv/GHSA-r399-636x-v7f6: @langchain/[email protected] (npm) is affected by GHSA-r399-636x-v7f6 |
collector/yarn.lock |
| high | osv/GHSA-27p8-2357-5qqv: @xmldom/[email protected] (npm) is affected by GHSA-27p8-2357-5qqv |
collector/yarn.lock |
| high | osv/GHSA-2v35-w6hq-6mfw: @xmldom/[email protected] (npm) is affected by GHSA-2v35-w6hq-6mfw |
collector/yarn.lock |
| high | osv/GHSA-4w3w-2rp5-g8jm: @xmldom/[email protected] (npm) is affected by GHSA-4w3w-2rp5-g8jm |
collector/yarn.lock |
| high | osv/GHSA-8344-3jmq-59r6: @xmldom/[email protected] (npm) is affected by GHSA-8344-3jmq-59r6 |
collector/yarn.lock |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v1.19.0 ships AnythingLLMDesktop-Arm64.AppImage (332 downloads)
- binary-release-asset: release v1.19.0 ships AnythingLLMDesktop-Arm64.exe (485 downloads)
- binary-release-asset: release v1.19.0 ships AnythingLLMDesktop-Silicon.dmg (1100 downloads)
- binary-release-asset: release v1.19.0 ships AnythingLLMDesktop.AppImage (1496 downloads)
- binary-release-asset: release v1.19.0 ships AnythingLLMDesktop.dmg (343 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 276,822; test lines: 27,393
| Language | Lines |
|---|---|
| JavaScript | 303,503 |
| SQL | 574 |
| Shell | 82 |
| HCL | 56 |