Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

activepieces/activepieces

https://github.com/activepieces/activepieces · scanned 2026-06-26 22:34 UTC (1 month ago)

1541 raw signals (0 security + 1541 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month ago · v3 · 1460 actionable findings from 1 signal source. 81 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
42.1
/100
Security checks
42
0 findings
System graph
42
100.0% cov · 1460 findings
Critical
18
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 18 High 104 Medium 224 Low 976 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 1460 Crowd 0 Layer: Frontend 213 Security 255 Quality 906 Network 2 Hardware 6 Cicd 4 Api 74
Scan summary Repository scanned at 42.1/100 with 100.0% coverage. It contains 37437 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 1541 findings — concentrated in quality (906), security (265), frontend (213). Risk profile is high: 20 critical, 105 high, 258 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 1317 of 1460 actionable findings. 1541 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Trivy conf 1.00 CVE-2026-25896: fast-xml-parser 5.3.4 — packages/pieces/community/amazon-bedrock/bun.lock
fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE en…
VulnCve 2026 25896
critical System graph security Trivy conf 1.00 CVE-2026-41242: protobufjs 6.11.5 — bun.lock
protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will …
VulnCve 2026 41242
critical System graph security Semgrep conf 1.00 detect child process — tools/scripts/pieces/bump-translated-pieces.ts:108
Detected calls to child_process from a function argument `piecePath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-chil…
SecurityJavascript
critical System graph security Semgrep conf 1.00 detect child process — tools/scripts/pieces/bump-translated-pieces.ts:60
Detected calls to child_process from a function argument `piecePath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-chil…
SecurityJavascript
critical System graph security Semgrep conf 1.00 detect child process — tools/scripts/pieces/bump-translated-pieces.ts:80
Detected calls to child_process from a function argument `piecePath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-chil…
SecurityJavascript
critical System graph security Trivy conf 1.00 GHSA-vjh7-7g9h-fjfh: elliptic 6.5.4 — bun.lock
Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) ### Summary Private key can be extracted from ECDSA signature upon signing a malformed input (e.g. a string or a number), which could e.g. come from JSON network input Note that `elliptic` by design accepts…
VulnGhsa vjh7 7g9h fjfh
critical System graph security security conf 1.00 Insecure pattern 'private_key_in_repo' in packages/pieces/community/snowflake/src/lib/auth.ts:15
Found a known-risky pattern (private_key_in_repo). Review and replace if possible.
packages/pieces/community/snowflake/src/lib/auth.ts:15 Private key in repo
critical System graph security security conf 1.00 Insecure pattern 'private_key_in_repo' in packages/pieces/community/snowflake/src/lib/common/index.ts:40
Found a known-risky pattern (private_key_in_repo). Review and replace if possible.
packages/pieces/community/snowflake/src/lib/common/index.ts:40 Private key in repo
critical System graph security Secrets conf 1.00 Possible secret in packages/pieces/community/cal-com/src/lib/triggers/index.ts
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
packages/pieces/community/cal-com/src/lib/triggers/index.ts:99
critical System graph security Secrets conf 1.00 Possible secret in packages/pieces/community/hashi-corp-vault/src/lib/actions/write-secret.ts
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
packages/pieces/community/hashi-corp-vault/src/lib/actions/write-secret.ts:34
critical System graph security Secrets conf 1.00 2 occurrences Possible secret in packages/pieces/community/shippo/src/lib/triggers/new-shipping-label.ts
Detected pattern matching aws_access_key. Rotate the credential and move to a secret manager.
lines 76, 86
packages/pieces/community/shippo/src/lib/triggers/new-shipping-label.ts:76, 86 (2 hits)
critical System graph security Secrets conf 1.00 Possible secret in packages/pieces/community/tableau/src/lib/common/index.ts
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
packages/pieces/community/tableau/src/lib/common/index.ts:49
critical System graph security Secrets conf 1.00 Possible secret in packages/shared/src/lib/ee/secret-managers/dto.ts
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
packages/shared/src/lib/ee/secret-managers/dto.ts:8
critical System graph security Secrets conf 1.00 Runtime dotenv file present in repo: .env.dev
`.env.dev` looks like a runtime dotenv file. It contains secret-looking assignments for AP_JWT_SECRET, AP_WORKER_TOKEN. Move real values to a secret manager and keep only `.env.example` style templates in source control.
.env.dev ConfigEnv fileRuntime env
critical System graph security Trivy conf 1.00 2 occurrences Secret leak: AWS Access Key ID — packages/pieces/community/shippo/src/lib/triggers/new-shipping-label.ts
Trivy detected a possible secret in `packages/pieces/community/shippo/src/lib/triggers/new-shipping-label.ts`. Rule: aws-access-key-id Severity: CRITICAL Match (redacted): res=1437093830&AWSAccessKeyId=********************', Action: rotate the credential and remove it from the repo. Use a secrets…
2 occurrences
repo-level (2 hits)
Secret
high System graph security Trivy conf 1.00 CVE-2023-30533: xlsx 0.18.5 — bun.lock
Prototype Pollution in sheetJS SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected. Package: xlsx Installed: 0.18.5 Fixed in: 0.19.3 Severity: HIGH Fix: Upgrade xlsx to 0.19…
VulnCve 2023 30533
high System graph security Trivy conf 1.00 CVE-2024-22363: xlsx 0.18.5 — bun.lock
SheetJS Regular Expression Denial of Service (ReDoS) SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS). Package: xlsx Installed: 0.18.5 Fixed in: 0.20.2 Severity: HIGH Fix: Upgrade xlsx to 0.20.2
VulnCve 2024 22363
high System graph security Trivy conf 1.00 CVE-2025-12735: expr-eval 2.0.2 — bun.lock
expr-eval: The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER of the context object into t…
VulnCve 2025 12735
high System graph security Trivy conf 1.00 CVE-2025-13204: expr-eval 2.0.2 — bun.lock
expr-eval: expr-eval: Prototype Pollution npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue. P…
VulnCve 2025 13204
high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 4.0.4 — bun.lock
form-data is a library for creating readable multipart/form-data strea ... form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Dispositio…
VulnCve 2026 12143
high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 4.0.5 — packages/pieces/community/base44/bun.lock
form-data is a library for creating readable multipart/form-data strea ... form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Dispositio…
VulnCve 2026 12143
high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 4.0.5 — packages/pieces/community/contextual-ai/bun.lock
form-data is a library for creating readable multipart/form-data strea ... form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Dispositio…
VulnCve 2026 12143
high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 4.0.5 — packages/pieces/community/couchbase/bun.lock
form-data is a library for creating readable multipart/form-data strea ... form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Dispositio…
VulnCve 2026 12143
high System graph security Trivy conf 1.00 CVE-2026-12151: undici 7.24.6 — bun.lock
undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream …
VulnCve 2026 12151
high System graph security Trivy conf 1.00 CVE-2026-22029: @remix-run/router 1.6.2 — bun.lock
@remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or action…
VulnCve 2026 22029
high System graph security Trivy conf 1.00 CVE-2026-23745: tar 6.2.1 — packages/pieces/community/couchbase/bun.lock
node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure be…
VulnCve 2026 23745
high System graph security Trivy conf 1.00 CVE-2026-23950: tar 6.2.1 — packages/pieces/community/couchbase/bun.lock
node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On c…
VulnCve 2026 23950
high System graph security Trivy conf 1.00 CVE-2026-24842: tar 6.2.1 — packages/pieces/community/couchbase/bun.lock
node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink crea…
VulnCve 2026 24842
high System graph security Trivy conf 1.00 CVE-2026-25639: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ a…
VulnCve 2026 25639
high System graph security Trivy conf 1.00 CVE-2026-25639: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ a…
VulnCve 2026 25639
high System graph security Trivy conf 1.00 CVE-2026-26278: fast-xml-parser 5.3.4 — packages/pieces/community/amazon-bedrock/bun.lock
fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to d…
VulnCve 2026 26278
high System graph security Trivy conf 1.00 CVE-2026-26960: tar 6.2.1 — packages/pieces/community/couchbase/bun.lock
node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outs…
VulnCve 2026 26960
high System graph security Trivy conf 1.00 CVE-2026-29786: tar 6.2.1 — packages/pieces/community/couchbase/bun.lock
node-tar: hardlink path traversal via drive-relative linkpath node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables …
VulnCve 2026 29786
high System graph security Trivy conf 1.00 CVE-2026-31802: tar 6.2.1 — packages/pieces/community/couchbase/bun.lock
tar: tar: File overwrite via drive-relative symlink traversal node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, …
VulnCve 2026 31802
high System graph security Trivy conf 1.00 CVE-2026-33036: fast-xml-parser 5.3.4 — packages/pieces/community/amazon-bedrock/bun.lock
fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, …
VulnCve 2026 33036
high System graph security Trivy conf 1.00 CVE-2026-33151: socket.io-parser 4.2.4 — packages/pieces/community/base44/bun.lock
socket.io: Socket.IO: Denial of Service due to excessive buffering of specially crafted packets Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for …
VulnCve 2026 33151
high System graph security Trivy conf 1.00 CVE-2026-42033: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: HTTP Transport Hijacking via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) s…
VulnCve 2026 42033
high System graph security Trivy conf 1.00 CVE-2026-42033: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: HTTP Transport Hijacking via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) s…
VulnCve 2026 42033
high System graph security Trivy conf 1.00 CVE-2026-42035: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Arbitrary HTTP header injection via prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP …
VulnCve 2026 42035
high System graph security Trivy conf 1.00 CVE-2026-42035: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Arbitrary HTTP header injection via prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP …
VulnCve 2026 42035
high System graph security Trivy conf 1.00 CVE-2026-42043: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: NO_PROXY bypass via crafted URL Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the …
VulnCve 2026 42043
high System graph security Trivy conf 1.00 CVE-2026-42043: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: NO_PROXY bypass via crafted URL Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the …
VulnCve 2026 42043
high System graph security Trivy conf 1.00 CVE-2026-42264: axios 1.13.2 — packages/pieces/community/base44/bun.lock
Axios is a promise based HTTP client for the browser and Node.js. From ... Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter …
VulnCve 2026 42264
high System graph security Trivy conf 1.00 CVE-2026-42264: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
Axios is a promise based HTTP client for the browser and Node.js. From ... Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter …
VulnCve 2026 42264
high System graph security Trivy conf 1.00 CVE-2026-44289: protobufjs 6.11.5 — bun.lock
protobuf.js: Denial of service through unbounded protobuf recursion protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group field…
VulnCve 2026 44289
high System graph security Trivy conf 1.00 CVE-2026-44290: protobufjs 6.11.5 — bun.lock
protobuf.js: Process-wide denial of service through unsafe option paths protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafte…
VulnCve 2026 44290
high System graph security Trivy conf 1.00 CVE-2026-44291: protobufjs 6.11.5 — bun.lock
protobuf.js: Code generation gadget after prototype pollution protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If…
VulnCve 2026 44291
high System graph security Trivy conf 1.00 CVE-2026-44293: protobufjs 6.11.5 — bun.lock
protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe …
VulnCve 2026 44293
high System graph security Trivy conf 1.00 CVE-2026-44486: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Information disclosure of proxy credentials via HTTP redirects Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent throug…
VulnCve 2026 44486
high System graph security Trivy conf 1.00 CVE-2026-44486: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Information disclosure of proxy credentials via HTTP redirects Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent throug…
VulnCve 2026 44486
high System graph security Trivy conf 1.00 CVE-2026-44486: axios 1.15.2 — bun.lock
axios: Axios: Information disclosure of proxy credentials via HTTP redirects Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent throug…
VulnCve 2026 44486
high System graph security Trivy conf 1.00 CVE-2026-44487: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Information disclosure of proxy credentials via redirect flows Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct re…
VulnCve 2026 44487
high System graph security Trivy conf 1.00 CVE-2026-44487: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Information disclosure of proxy credentials via redirect flows Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct re…
VulnCve 2026 44487
high System graph security Trivy conf 1.00 CVE-2026-44487: axios 1.15.2 — bun.lock
axios: Axios: Information disclosure of proxy credentials via redirect flows Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct re…
VulnCve 2026 44487
high System graph security Trivy conf 1.00 CVE-2026-44488: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Denial of Service due to unenforced request and response size limits Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Appli…
VulnCve 2026 44488
high System graph security Trivy conf 1.00 CVE-2026-44488: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Denial of Service due to unenforced request and response size limits Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Appli…
VulnCve 2026 44488
high System graph security Trivy conf 1.00 CVE-2026-44488: axios 1.15.2 — bun.lock
axios: Axios: Denial of Service due to unenforced request and response size limits Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Appli…
VulnCve 2026 44488
high System graph security Trivy conf 1.00 CVE-2026-44492: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a r…
VulnCve 2026 44492
high System graph security Trivy conf 1.00 CVE-2026-44492: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a r…
VulnCve 2026 44492
high System graph security Trivy conf 1.00 CVE-2026-44492: axios 1.15.2 — bun.lock
axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a r…
VulnCve 2026 44492
high System graph security Trivy conf 1.00 CVE-2026-44494: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the applicatio…
VulnCve 2026 44494
high System graph security Trivy conf 1.00 CVE-2026-44494: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the applicatio…
VulnCve 2026 44494
high System graph security Trivy conf 1.00 CVE-2026-44494: axios 1.15.2 — bun.lock
axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the applicatio…
VulnCve 2026 44494
high System graph security Trivy conf 1.00 CVE-2026-44495: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Information disclosure due to prototype pollution vulnerability Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same Jav…
VulnCve 2026 44495
high System graph security Trivy conf 1.00 CVE-2026-44495: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Information disclosure due to prototype pollution vulnerability Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same Jav…
VulnCve 2026 44495
high System graph security Trivy conf 1.00 CVE-2026-44496: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF co…
VulnCve 2026 44496
high System graph security Trivy conf 1.00 CVE-2026-44496: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF co…
VulnCve 2026 44496
high System graph security Trivy conf 1.00 CVE-2026-44496: axios 1.15.2 — bun.lock
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF co…
VulnCve 2026 44496
high System graph security Trivy conf 1.00 CVE-2026-44665: fast-xml-builder 1.1.5 — bun.lock
fast-xml-builder: fast-xml-builder: Attribute injection leading to information disclosure or content manipulation fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multipl…
VulnCve 2026 44665
high System graph security Trivy conf 1.00 CVE-2026-44705: tmp 0.2.5 — bun.lock
tmp is a temporary file and directory creator for node.js. Prior to 0. ... tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the…
VulnCve 2026 44705
high System graph security Trivy conf 1.00 CVE-2026-46490: samlify 2.10.0 — bun.lock
samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., <saml:AttributeVal…
VulnCve 2026 46490
high System graph security Trivy conf 1.00 CVE-2026-46625: js-cookie 2.2.1 — bun.lock
JavaScript Cookie is a JavaScript API for handling cookies, client-sid ... JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by…
VulnCve 2026 46625
high System graph security Trivy conf 1.00 CVE-2026-48068: @grpc/grpc-js 1.14.3 — bun.lock
@grpc/grpc-js: A malformed request can cause a server crash ### Impact An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. ### Patches The following version have fixes for this vulnerability: - 1.9.16 - 1.10.12…
VulnCve 2026 48068
high System graph security Trivy conf 1.00 CVE-2026-48069: @grpc/grpc-js 1.14.3 — bun.lock
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash ### Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js ### Patches The following version have fixes for …
VulnCve 2026 48069
high System graph security Trivy conf 1.00 CVE-2026-48712: protobufjs 6.11.5 — bun.lock
protobufjs: Denial of service through unbounded Any expansion during JSON conversion protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This af…
VulnCve 2026 48712
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.17.1 — packages/pieces/community/base44/bun.lock
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.18.3 — packages/pieces/community/hume-ai/bun.lock
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.20.0 — bun.lock
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-54290: hono 4.12.16 — bun.lock
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflec…
VulnCve 2026 54290
high System graph security Trivy conf 1.00 CVE-2026-6321: fast-uri 3.1.0 — bun.lock
fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory r…
VulnCve 2026 6321
high System graph security Trivy conf 1.00 CVE-2026-6322: fast-uri 3.1.0 — bun.lock
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a…
VulnCve 2026 6322
high System graph security Trivy conf 1.00 CVE-2026-6734: undici 7.24.6 — bun.lock
undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requ…
VulnCve 2026 6734
high System graph security Trivy conf 1.00 CVE-2026-8813: exifreader 4.20.0 — bun.lock
ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly pro…
VulnCve 2026 8813
high System graph security Trivy conf 1.00 CVE-2026-9697: undici 7.24.6 — bun.lock
undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default tr…
VulnCve 2026 9697
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${healthPort}/api/v1/health (packages/server/worker/test/lib/worker.test.ts:521)
`packages/server/worker/test/lib/worker.test.ts:521` calls `GET http://127.0.0.1:${healthPort}/api/v1/health` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/v1/health` If this points at an e…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${healthPort}/unknown (packages/server/worker/test/lib/worker.test.ts:528)
`packages/server/worker/test/lib/worker.test.ts:528` calls `GET http://127.0.0.1:${healthPort}/unknown` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/unknown` If this points at an external API,…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${healthPort}/v1/health (packages/server/worker/test/lib/worker.test.ts:494)
`packages/server/worker/test/lib/worker.test.ts:494` calls `GET http://127.0.0.1:${healthPort}/v1/health` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/v1/health` If this points at an external …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${healthPort}/v1/health (packages/server/worker/test/lib/worker.test.ts:507)
`packages/server/worker/test/lib/worker.test.ts:507` calls `GET http://127.0.0.1:${healthPort}/v1/health` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/v1/health` If this points at an external …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${healthPort}/worker/health (packages/server/worker/test/lib/worker.test.ts:514)
`packages/server/worker/test/lib/worker.test.ts:514` calls `GET http://127.0.0.1:${healthPort}/worker/health` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/worker/health` If this points at an e…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.chartly.dev/v1/chart/${chart_id.trim()} (packages/pieces/community/chartly/src/lib/actions/get-chart.ts:38)
`packages/pieces/community/chartly/src/lib/actions/get-chart.ts:38` calls `GET https://api.chartly.dev/v1/chart/${chart_id.trim()}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.chartly.dev/v1/chart/<p>`…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.chartly.dev/v1/status (packages/pieces/community/chartly/src/lib/common/auth.ts:13)
`packages/pieces/community/chartly/src/lib/common/auth.ts:13` calls `GET https://api.chartly.dev/v1/status` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.chartly.dev/v1/status` If this points at an exter…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.instacharts.io/v1/templates (packages/pieces/community/insta-charts/src/lib/actions/generate-chart-image.ts:32)
`packages/pieces/community/insta-charts/src/lib/actions/generate-chart-image.ts:32` calls `GET https://api.instacharts.io/v1/templates` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.instacharts.io/v1/tem…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://pastebin.com/raw/ (packages/pieces/community/pastebin/src/lib/common/client.ts:80)
`packages/pieces/community/pastebin/src/lib/common/client.ts:80` calls `GET https://pastebin.com/raw/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/https:/pastebin.com/raw` If this points at an external API, prefi…
Dangling fetchAxios
high System graph api Wiring conf 1.00 Dangling fetch: GET https://public.chainalysis.com/api/v1/address/${address} (packages/pieces/community/chainalysis-api/src/lib/actions/check-address-sanction.ts:24)
`packages/pieces/community/chainalysis-api/src/lib/actions/check-address-sanction.ts:24` calls `GET https://public.chainalysis.com/api/v1/address/${address}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/pub…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://secure.splitwise.com/api/v3.0/get_categories (packages/pieces/community/splitwise/src/lib/common/api.ts:3)
`packages/pieces/community/splitwise/src/lib/common/api.ts:3` calls `GET https://secure.splitwise.com/api/v3.0/get_categories` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/secure.splitwise.com/api/v3.0/get_…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://secure.splitwise.com/api/v3.0/get_current_user (packages/pieces/community/splitwise/src/lib/auth.ts:14)
`packages/pieces/community/splitwise/src/lib/auth.ts:14` calls `GET https://secure.splitwise.com/api/v3.0/get_current_user` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/secure.splitwise.com/api/v3.0/get_cur…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://secure.splitwise.com/api/v3.0/get_expenses?${params} (packages/pieces/community/splitwise/src/lib/common/api.ts:42)
`packages/pieces/community/splitwise/src/lib/common/api.ts:42` calls `GET https://secure.splitwise.com/api/v3.0/get_expenses?${params}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/secure.splitwise.com/api/…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://secure.splitwise.com/api/v3.0/get_groups (packages/pieces/community/splitwise/src/lib/common/api.ts:20)
`packages/pieces/community/splitwise/src/lib/common/api.ts:20` calls `GET https://secure.splitwise.com/api/v3.0/get_groups` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/secure.splitwise.com/api/v3.0/get_gro…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://www.googleapis.com/drive/v3/files/${fileId}?fields=mimeType&supportsAllDrives=true (packages/pieces/community/google-drive/src/lib/common/get-file-content.ts:13)
`packages/pieces/community/google-drive/src/lib/common/get-file-content.ts:13` calls `GET https://www.googleapis.com/drive/v3/files/${fileId}?fields=mimeType&supportsAllDrives=true` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used fo…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.chartly.dev/v1/chart (packages/pieces/community/chartly/src/lib/actions/create-chart.ts:153)
`packages/pieces/community/chartly/src/lib/actions/create-chart.ts:153` calls `POST https://api.chartly.dev/v1/chart` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.chartly.dev/v1/chart` If this points at…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.instacharts.io/v1/generate/image (packages/pieces/community/insta-charts/src/lib/actions/generate-chart-image.ts:159)
`packages/pieces/community/insta-charts/src/lib/actions/generate-chart-image.ts:159` calls `POST https://api.instacharts.io/v1/generate/image` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.instacharts.io…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.lusha.com/prospecting/company/enrich (packages/pieces/community/lusha/src/lib/actions/companies/enrich.ts:32)
`packages/pieces/community/lusha/src/lib/actions/companies/enrich.ts:32` calls `POST https://api.lusha.com/prospecting/company/enrich` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.lusha.com/prospecting/…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.lusha.com/prospecting/company/search (packages/pieces/community/lusha/src/lib/actions/companies/search.ts:69)
`packages/pieces/community/lusha/src/lib/actions/companies/search.ts:69` calls `POST https://api.lusha.com/prospecting/company/search` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.lusha.com/prospecting/…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST https://api.tinytalk.ai/v1/chat/completions (packages/pieces/community/tiny-talk-ai/src/lib/actions/ask-bot.ts:25)
`packages/pieces/community/tiny-talk-ai/src/lib/actions/ask-bot.ts:25` calls `POST https://api.tinytalk.ai/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.tinytalk.ai/v1/chat/completio…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST https://oauth2.googleapis.com/token (packages/server/api/src/app/ee/authentication/federated-authn/google-authn-provider.ts:57)
`packages/server/api/src/app/ee/authentication/federated-authn/google-authn-provider.ts:57` calls `POST https://oauth2.googleapis.com/token` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/oauth2.googleapis.co…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST https://pastebin.com/api/ (packages/pieces/community/pastebin/src/lib/common/client.ts:54)
`packages/pieces/community/pastebin/src/lib/common/client.ts:54` calls `POST https://pastebin.com/api/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/https:/pastebin.com/api` If this points at an external API, pref…
Dangling fetchAxios
high System graph api Wiring conf 1.00 Dangling fetch: POST https://secure.splitwise.com/api/v3.0/create_expense (packages/pieces/community/splitwise/src/lib/common/api.ts:59)
`packages/pieces/community/splitwise/src/lib/common/api.ts:59` calls `POST https://secure.splitwise.com/api/v3.0/create_expense` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/secure.splitwise.com/api/v3.0/cr…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST https://us-central1-activepieces-b3803.cloudfunctions.net/addContact (packages/server/api/src/app/authentication/authentication-utils.ts:222)
`packages/server/api/src/app/authentication/authentication-utils.ts:222` calls `POST https://us-central1-activepieces-b3803.cloudfunctions.net/addContact` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/us-cen…
Dangling fetchFetch
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — .devcontainer/Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: .devcontainer/Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — packages/server/worker/test/e2e/Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: packages/server/worker/test/e2e/Dockerfile
Misconfig
high System graph security Trivy conf 1.00 2 occurrences DS-0029: 'apt-get' missing '--no-install-recommends' — .devcontainer/Dockerfile
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y git' Rule: DS-0029 Severity: HIGH Target: .devcontainer/Dockerfile
2 occurrences
repo-level (2 hits)
Misconfig
high System graph security Trivy conf 1.00 GHSA-p6gq-j5cr-w38f: nodemailer 8.0.5 — bun.lock
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message # Message-level `raw` option bypasses `disableFileAccess` / `disableUrlAccess`, enabling arbitrary file read and full-response SSRF in the …
VulnGhsa p6gq j5cr w38f
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/cli/src/lib/commands/generate-translation-file-for-piece.ts:25
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/cli/src/lib/commands/generate-translation-file-for-piece.ts:25 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/cli/src/lib/utils/piece-utils.ts:60
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/cli/src/lib/utils/piece-utils.ts:60 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in tools/scripts/pieces/publish-piece.ts:22
Found a known-risky pattern (exec_used). Review and replace if possible.
tools/scripts/pieces/publish-piece.ts:22 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in tools/scripts/utils/package-pre-publish-checks.ts:46
Found a known-risky pattern (exec_used). Review and replace if possible.
tools/scripts/utils/package-pre-publish-checks.ts:46 Exec used
high System graph security security conf 1.00 Insecure pattern 'new_function_used' in packages/web/src/app/builder/piece-properties/custom-property.tsx:17
Found a known-risky pattern (new_function_used). Review and replace if possible.
packages/web/src/app/builder/piece-properties/custom-property.tsx:17 New function used
high System graph security Semgrep conf 1.00 use defused xml — .agents/skills/mcp-builder/scripts/evaluation.py:13
The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Rule: python.lang.security.use-defused-xml.use-d…
SecurityPython
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — packages/web/src/components/ui/chart.tsx:81
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/ee/embed-sdk/src/index.ts:612
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/ai/src/lib/common/ai-sdk.ts:138
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/aminos/src/lib/actions/createUser.ts:44
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/anyhook-graphql/src/lib/common/common.ts:21
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/anyhook-websocket/src/lib/common/common.ts:21
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/bluesky/src/lib/actions/create-post.ts:125
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/canny/src/lib/actions/list-posts.ts:76
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/canva/src/lib/common/index.ts:302
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/chartly/src/lib/actions/create-chart.ts:153
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/chartly/src/lib/actions/get-chart.ts:38
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/clickup/src/lib/actions/tasks/filter-workspace-tasks.ts:62
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/confluence/src/lib/actions/list-comments.ts:64
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/convertkit/src/lib/actions/purchases.ts:320
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/discord/src/lib/triggers/new-member.ts:65
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/enrichlayer/src/lib/actions/get-person-profile.ts:150
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/enrichlayer/src/lib/actions/get-school-profile.ts:38
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/eth-name-service/src/lib/common/common.ts:25
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/facebook-pages/src/lib/actions/create-video-post.ts:11
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/flowise/src/index.ts:71
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/goodmem/src/lib/actions/get-memory.ts:16
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/google-drive/src/lib/common/get-file-content.ts:13
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/imap/src/lib/common/imap.ts:134
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/invoiceninja/src/lib/actions/action-recurring.ts:72
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/invoiceninja/src/lib/actions/create-invoice.ts:193
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/invoiceninja/src/lib/actions/create-recurring.ts:264
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/kustomer/src/lib/actions/get-custom-objects.ts:23
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/linkedin/src/lib/common/index.ts:121
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/lusha/src/lib/actions/companies/enrich.ts:32
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/lusha/src/lib/actions/companies/search.ts:69
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/mailchimp/src/lib/actions/remove-subscriber-from-tag.ts:36
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/mindee/src/lib/actions/predict-document.ts:82
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/pinecone/src/lib/actions/get-vector.ts:30
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/reddit/src/lib/actions/retrieve-reddit-post.ts:39
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/sap-ariba/src/lib/actions/get-contract-workspace.ts:36
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/sap-ariba/src/lib/actions/search-contract-workspaces.ts:59
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/simplyprint/src/lib/actions/download-file.ts:11
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/simplyprint/src/lib/common/chunked-upload.ts:117
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/splitwise/src/lib/common/api.ts:3
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/supabase/src/lib/actions/delete-rows.ts:73
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/supabase/src/lib/actions/get-table-schema.ts:39
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/supabase/src/lib/actions/list-tables.ts:28
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/supabase/src/lib/actions/update-row.ts:65
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/supabase/src/lib/actions/upsert-row.ts:64
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/supabase/src/lib/common/props.ts:25
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/tiny-talk-ai/src/lib/actions/ask-bot.ts:25
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/pieces/community/youtrack/src/lib/actions/download-attachment.ts:34
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/api/src/app/ee/authentication/federated-authn/google-authn-provider.ts:57
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/api/src/app/ee/license-keys/license-keys-service.ts:21
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/api/src/app/ee/platform/platform-plan/openrouter/openrouter-api.ts:10
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/api/src/app/pieces/piece-sync-service.ts:82
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/api/src/app/template/community-templates.service.ts:15
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/api/src/app/template/template-telemetry/template-telemetry.service.ts:32
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/engine/src/lib/handler/context/engine-constants.ts:230
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/engine/src/lib/piece-context/connection-resolver.ts:11
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/engine/src/lib/piece-context/flows.ts:12
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/engine/src/lib/piece-context/store.ts:42
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/engine/src/lib/piece-context/variable-resolver.ts:10
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/engine/src/lib/piece-context/waitpoint-client.ts:5
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/engine/src/lib/variables/processors/file.ts:40
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/server/worker/test/lib/worker.test.ts:507
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — packages/web/src/app/builder/flow-canvas/utils/flow-screenshot-utils.ts:275
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — tools/scripts/pieces/find-changed-pieces.ts:48
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — tools/scripts/pieces/update-pieces-metadata.ts:21
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — tools/scripts/utils/piece-script-utils.ts:75
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/agents/changelog.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/agents/changelog.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/agents/server.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/agents/server.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/agents/web.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/agents/web.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .claude/settings.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.claude/settings.json VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: packages/pieces/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
packages/pieces/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: packages/server/engine/CLAUDE.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
packages/server/engine/CLAUDE.md VerificationClaude instruction
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph frontend Frontend quality conf 1.00 Custom React Flow node registered without explicit width/height — packages/pieces/community/zeplin/src/lib/triggers/new-note.ts:22
When you register a custom node type via `nodeTypes`, the RFNode object you build must include `width` and `height` props. Without them, MiniMap renders ZERO mini-nodes for that type and `fitView` underestimates the bounds (cuts off lane labels, etc.). Add `width: …, height: …` to the node object. …
Fq rfnode no dims
medium System graph frontend Frontend quality conf 1.00 Custom React Flow node registered without explicit width/height — packages/pieces/community/zeplin/src/lib/triggers/new-screen.ts:17
When you register a custom node type via `nodeTypes`, the RFNode object you build must include `width` and `height` props. Without them, MiniMap renders ZERO mini-nodes for that type and `fitView` underestimates the bounds (cuts off lane labels, etc.). Add `width: …, height: …` to the node object. …
Fq rfnode no dims
medium System graph security Trivy conf 1.00 CVE-2024-1899: showdown 2.1.0 — bun.lock
Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions. Package: showdown Installed: 2.1.0 Fixed in: — Severity: MEDIUM Fix: No…
VulnCve 2024 1899
medium System graph security Trivy conf 1.00 CVE-2024-28243: katex 0.12.0 — bun.lock
KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX ... KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\edef` that causes a near-infinite loop, despite setting `max…
VulnCve 2024 28243
medium System graph security Trivy conf 1.00 CVE-2024-28245: katex 0.12.0 — bun.lock
KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX ... KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\includegraphics` that runs arbitrary JavaScript, or generate…
VulnCve 2024 28245
medium System graph security Trivy conf 1.00 CVE-2024-28246: katex 0.12.0 — bun.lock
KaTeX is a JavaScript library for TeX math rendering on the web. Code ... KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's `trust` option, specifically that provides a function to blacklist certain URL protocols, can be fooled by URLs in malicious inputs tha…
VulnCve 2024 28246
medium System graph security Trivy conf 1.00 CVE-2025-23207: katex 0.12.0 — bun.lock
katex: \htmlData does not validate attribute names in KaTeX KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaS…
VulnCve 2025 23207
medium System graph security Trivy conf 1.00 CVE-2025-62718: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback …
VulnCve 2025 62718
medium System graph security Trivy conf 1.00 CVE-2025-62718: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback …
VulnCve 2025 62718
medium System graph security Trivy conf 1.00 CVE-2025-68470: react-router 6.11.2 — bun.lock
react-router: React Router unexpected external redirect React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Router application navigates to it via navigate(), <Link>, or redirect(), the app perf…
VulnCve 2025 68470
medium System graph security Trivy conf 1.00 CVE-2026-33349: fast-xml-parser 5.3.4 — packages/pieces/community/amazon-bedrock/bun.lock
fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeRead…
VulnCve 2026 33349
medium System graph security Trivy conf 1.00 CVE-2026-40175: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Remote Code Execution via Prototype Pollution escalation Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leverag…
VulnCve 2026 40175
medium System graph security Trivy conf 1.00 CVE-2026-40175: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Remote Code Execution via Prototype Pollution escalation Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leverag…
VulnCve 2026 40175
medium System graph security Trivy conf 1.00 CVE-2026-40181: react-router 6.11.2 — bun.lock
react-router: React Router: Open redirect vulnerability via specially crafted URLs React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values start…
VulnCve 2026 40181
medium System graph security Trivy conf 1.00 CVE-2026-41650: fast-xml-parser 5.3.4 — packages/pieces/community/amazon-bedrock/bun.lock
fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or th…
VulnCve 2026 41650
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 10.0.0 — packages/pieces/community/fathom/bun.lock
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 13.0.0 — packages/pieces/community/base44/bun.lock
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 9.0.1 — packages/pieces/community/hume-ai/bun.lock
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-42034: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). …
VulnCve 2026 42034
medium System graph security Trivy conf 1.00 CVE-2026-42034: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). …
VulnCve 2026 42034
medium System graph security Trivy conf 1.00 CVE-2026-42036: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLe…
VulnCve 2026 42036
medium System graph security Trivy conf 1.00 CVE-2026-42036: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLe…
VulnCve 2026 42036
medium System graph security Trivy conf 1.00 CVE-2026-42037: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the…
VulnCve 2026 42037
medium System graph security Trivy conf 1.00 CVE-2026-42037: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the…
VulnCve 2026 42037
medium System graph security Trivy conf 1.00 CVE-2026-42038: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Information disclosure due to `no_proxy` bypass Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route t…
VulnCve 2026 42038
medium System graph security Trivy conf 1.00 CVE-2026-42038: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Information disclosure due to `no_proxy` bypass Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route t…
VulnCve 2026 42038
medium System graph security Trivy conf 1.00 CVE-2026-42039: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value pas…
VulnCve 2026 42039
medium System graph security Trivy conf 1.00 CVE-2026-42039: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value pas…
VulnCve 2026 42039
medium System graph security Trivy conf 1.00 CVE-2026-42041: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to…
VulnCve 2026 42041
medium System graph security Trivy conf 1.00 CVE-2026-42041: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to…
VulnCve 2026 42041
medium System graph security Trivy conf 1.00 CVE-2026-42042: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: XSRF token bypass leading to information disclosure Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXS…
VulnCve 2026 42042
medium System graph security Trivy conf 1.00 CVE-2026-42042: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: XSRF token bypass leading to information disclosure Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXS…
VulnCve 2026 42042
medium System graph security Trivy conf 1.00 CVE-2026-42044: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the ap…
VulnCve 2026 42044
medium System graph security Trivy conf 1.00 CVE-2026-42044: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the ap…
VulnCve 2026 42044
medium System graph security Trivy conf 1.00 CVE-2026-42338: ip-address 10.1.0 — bun.lock
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embeddi…
VulnCve 2026 42338
medium System graph security Trivy conf 1.00 CVE-2026-44288: protobufjs 6.11.5 — bun.lock
protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decode…
VulnCve 2026 44288
medium System graph security Trivy conf 1.00 CVE-2026-44292: protobufjs 6.11.5 — bun.lock
protobuf.js: Prototype injection in generated message constructors protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __pro…
VulnCve 2026 44292
medium System graph security Trivy conf 1.00 CVE-2026-44294: protobufjs 6.11.5 — bun.lock
protobuf.js: Denial of service from crafted field names in generated code protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters i…
VulnCve 2026 44294
medium System graph security Trivy conf 1.00 CVE-2026-44457: hono 4.12.16 — bun.lock
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Var…
VulnCve 2026 44457
medium System graph security Trivy conf 1.00 CVE-2026-44458: hono 4.12.16 — bun.lock
Hono has CSS Declaration Injection via Style Object Values in JSX SSR Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or …
VulnCve 2026 44458
medium System graph security Trivy conf 1.00 CVE-2026-44490: axios 1.13.2 — packages/pieces/community/base44/bun.lock
axios: Axios: Information disclosure and denial of service due to prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency i…
VulnCve 2026 44490
medium System graph security Trivy conf 1.00 CVE-2026-44490: axios 1.13.2 — packages/pieces/community/couchbase/bun.lock
axios: Axios: Information disclosure and denial of service due to prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency i…
VulnCve 2026 44490
medium System graph security Trivy conf 1.00 CVE-2026-44490: axios 1.15.2 — bun.lock
axios: Axios: Information disclosure and denial of service due to prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency i…
VulnCve 2026 44490
medium System graph security Trivy conf 1.00 CVE-2026-44664: fast-xml-builder 1.1.5 — bun.lock
fast-xml-builder: fast-xml-builder: Arbitrary XML/HTML injection via insufficient sanitization of XML comments fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the va…
VulnCve 2026 44664
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.17.1 — packages/pieces/community/base44/bun.lock
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.18.3 — packages/pieces/community/hume-ai/bun.lock
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.20.0 — bun.lock
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Trivy conf 1.00 CVE-2026-45740: protobufjs 6.11.5 — bun.lock
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Name…
VulnCve 2026 45740
medium System graph security Trivy conf 1.00 CVE-2026-47673: hono 4.12.16 — bun.lock
Hono: JWT middleware accepts any Authorization scheme, not only Bearer Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header va…
VulnCve 2026 47673
medium System graph security Trivy conf 1.00 CVE-2026-47674: hono 4.12.16 — bun.lock
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules…
VulnCve 2026 47674
medium System graph security Trivy conf 1.00 CVE-2026-47675: hono 4.12.16 — bun.lock
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corru…
VulnCve 2026 47675
medium System graph security Trivy conf 1.00 CVE-2026-47676: hono 4.12.16 — bun.lock
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw U…
VulnCve 2026 47676
medium System graph security Trivy conf 1.00 CVE-2026-48125: ua-parser-js 2.0.9 — bun.lock
UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()` ### Summary A regular expression denial-of-service (ReDoS) vulnerability has been discovered in `ua-parser-js` when using the Client Hints API. By sending a crafted `Sec-CH-UA-Model` header to an application…
VulnCve 2026 48125
medium System graph security Trivy conf 1.00 CVE-2026-48988: markdown-it 14.1.1 — bun.lock
markdown-it is a Markdown parser. Versions 14.1.1 and below contain a ... markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from rep…
VulnCve 2026 48988
medium System graph security Trivy conf 1.00 CVE-2026-53550: js-yaml 4.1.1 — bun.lock
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0, a craf ... js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence.…
VulnCve 2026 53550
medium System graph security Trivy conf 1.00 CVE-2026-53655: tar 6.2.1 — packages/pieces/community/couchbase/bun.lock
node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (nod ... node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata heade…
VulnCve 2026 53655
medium System graph security Trivy conf 1.00 CVE-2026-53655: tar 7.5.13 — bun.lock
node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (nod ... node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata heade…
VulnCve 2026 53655
medium System graph security Trivy conf 1.00 CVE-2026-54269: protobufjs 6.11.5 — bun.lock
protobufjs : Schema-derived names can shadow runtime-significant properties protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The…
VulnCve 2026 54269
medium System graph security Trivy conf 1.00 CVE-2026-54286: hono 4.12.16 — bun.lock
hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \, which the Windows path resolver tre…
VulnCve 2026 54286
medium System graph security Trivy conf 1.00 CVE-2026-54287: hono 4.12.16 — bun.lock
hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice …
VulnCve 2026 54287
medium System graph security Trivy conf 1.00 CVE-2026-54288: hono 4.12.16 — bun.lock
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within…
VulnCve 2026 54288
medium System graph security Trivy conf 1.00 CVE-2026-54289: hono 4.12.16 — bun.lock
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as severa…
VulnCve 2026 54289
medium System graph security Trivy conf 1.00 CVE-2026-8723: qs 6.14.2 — bun.lock
### Summary `qs.stringify` throws `TypeError` when called with `arr ... ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's nul…
VulnCve 2026 8723
medium System graph security Trivy conf 1.00 CVE-2026-8814: exifreader 4.20.0 — bun.lock
ExifReader is vulnerable to denial of service via unbounded decompression of image metadata Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximu…
VulnCve 2026 8814
medium System graph security Trivy conf 1.00 CVE-2026-9678: undici 7.24.6 — bun.lock
undici: Undici: Information disclosure due to improper cache-control header parsing Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" author…
VulnCve 2026 9678
medium System graph security Trivy conf 1.00 CVE-2026-9679: undici 7.24.6 — bun.lock
undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not spe…
VulnCve 2026 9679
medium System graph hardware Security conf 1.00 Dockerfile runs as root: .devcontainer/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: packages/server/worker/test/e2e/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph security Trivy conf 1.00 DS-0013: 'RUN cd ...' to change directory — .devcontainer/Dockerfile
'RUN cd ...' to change directory RUN should not be used to change directory: 'cd /usr/src && bun i [email protected]'. Use 'WORKDIR' statement instead. Rule: DS-0013 Severity: MEDIUM Target: .devcontainer/Dockerfile
Misconfig
medium System graph security Trivy conf 1.00 DS-0013: 'RUN cd ...' to change directory — Dockerfile
'RUN cd ...' to change directory RUN should not be used to change directory: 'cd /usr/src && bun install [email protected]'. Use 'WORKDIR' statement instead. Rule: DS-0013 Severity: MEDIUM Target: Dockerfile
Misconfig
medium System graph security Trivy conf 1.00 GHSA-268h-hp4c-crq3: nodemailer 8.0.5 — bun.lock
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection ### Summary Nodemailer constructs `List-*` headers from the caller-provided `list` message option using internally prepared header values. The `list.*.comment` field is inserted into those pr…
VulnGhsa 268h hp4c crq3
medium System graph security Trivy conf 1.00 GHSA-9ggv-8w38-r7pm: typeorm 0.3.28 — bun.lock
TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB) ### Impact Blind SQL injection vulnerability in `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` affecting MySQL and MariaDB users. `UpdateQueryBuilder` and `SoftDeleteQueryBuilder` (including their `add…
VulnGhsa 9ggv 8w38 r7pm
medium System graph security Trivy conf 1.00 GHSA-cmwh-pvxp-8882: dompurify 3.4.9 — bun.lock
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) ## Summary DOMPurify 3.4.7 shipped a security fix ("permanent hook pollution") that makes a registered `uponSanitizeAttribute` hook's mutation of `data…
VulnGhsa cmwh pvxp 8882
medium System graph security Trivy conf 1.00 GHSA-r4q5-vmmm-2653: follow-redirects 1.15.11 — packages/pieces/community/base44/bun.lock
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets ## Summary When an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-47…
VulnGhsa r4q5 vmmm 2653
medium System graph security Trivy conf 1.00 GHSA-r4q5-vmmm-2653: follow-redirects 1.15.11 — packages/pieces/community/couchbase/bun.lock
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets ## Summary When an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-47…
VulnGhsa r4q5 vmmm 2653
medium System graph security Trivy conf 1.00 GHSA-r7g4-qg5f-qqm2: nodemailer 8.0.5 — bun.lock
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception ### Summary Nodemailer disables TLS certificate verification in its internal HTTPS fetch client through the use of rejectUnauthorized: false inside lib/fetch/index.js. As a result, OAuth2 token r…
VulnGhsa r7g4 qg5f qqm2
medium System graph security Trivy conf 1.00 GHSA-wqvq-jvpq-h66f: nodemailer 8.0.5 — bun.lock
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization ### Summary Nodemailer's `disableFileAccess` and `disableUrlAccess` options are intended to prevent message content and attachments from reading local files or fetching URLs. The normal MIME stre…
VulnGhsa wqvq jvpq h66f
medium System graph security Trivy conf 1.00 GHSA-x3ff-w252-2g7j: @stablelib/ed25519 1.0.3 — bun.lock
StableLib Ed25519 Signature Malleability via Missing S < L Check # Ed25519 Signature Malleability via Missing S < L Check -- Same Class as node-forge CVE-2026-33895 (CWE-347) ## Target - Repository: StableLib/stablelib (package: @stablelib/ed25519) - Platform: GitHub PVR - Bounty: CVE credit - CW…
VulnGhsa x3ff w252 2g7j
medium System graph cicd CI/CD security conf 1.00 25 occurrences GitHub Action is tag-pinned rather than SHA-pinned
docker/login-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
12 files, 21 locations
.github/workflows/release-self-hosted.yml:21, 27, 36, 56 (4 hits)
.github/workflows/build-cloud-image.yml:17, 24, 27 (3 hits)
.github/workflows/continuous-delivery-release.yml:43, 49, 77 (3 hits)
.github/workflows/emergency-cloud-deploy.yml:17, 24, 27 (3 hits)
.github/workflows/ci.yml:30
.github/workflows/continuous-delivery-rollback-canary.yml:53
.github/workflows/continuous-delivery-rollback.yml:37
.github/workflows/continuous-delivery-stg.yml:174
CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 4 occurrences GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
4 files, 4 locations
.github/workflows/continuous-delivery-canary.yml
.github/workflows/continuous-delivery-cloud.yml
.github/workflows/continuous-delivery-stg.yml
.github/workflows/tag-release-candidate.yml
CI/CD securitySupply chainGithub actions
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/server/api/src/app/mcp/oauth/metadata/mcp-oauth-metadata.controller.ts:9
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
packages/server/api/src/app/mcp/oauth/metadata/mcp-oauth-metadata.controller.ts:9 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/server/api/src/app/server.ts:51
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
packages/server/api/src/app/server.ts:51 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in packages/server/worker/src/lib/sandbox/sandbox.ts:78
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
packages/server/worker/src/lib/sandbox/sandbox.ts:78 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in packages/web/src/components/ui/chart.tsx:81
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
packages/web/src/components/ui/chart.tsx:81 Dangerous innerhtml
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in packages/web/src/app/builder/piece-properties/text-input-with-mentions/text-input-utils.ts:423
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
packages/web/src/app/builder/piece-properties/text-input-with-mentions/text-input-utils.ts:423 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in deploy/pulumi/index.ts:7
Found a known-risky pattern (node_child_process). Review and replace if possible.
deploy/pulumi/index.ts:7 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/cli/src/lib/utils/exec.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/cli/src/lib/utils/exec.ts:1 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/pieces/community/oracle-database/src/lib/common/runner-pool.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/pieces/community/oracle-database/src/lib/common/runner-pool.ts:1 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/pieces/community/oracle-database/src/lib/common/thick-mode.ts:6
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/pieces/community/oracle-database/src/lib/common/thick-mode.ts:6 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/pieces/core/pdf/src/lib/actions/convert-to-image.ts:5
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/pieces/core/pdf/src/lib/actions/convert-to-image.ts:5 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/server/api/src/app/pieces/dev-piece-watcher.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/server/api/src/app/pieces/dev-piece-watcher.ts:1 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/server/engine/src/lib/core/code/no-op-code-sandbox.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/server/engine/src/lib/core/code/no-op-code-sandbox.ts:1 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/server/worker/src/lib/sandbox/fork.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/server/worker/src/lib/sandbox/fork.ts:1 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/server/worker/src/lib/sandbox/isolate.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/server/worker/src/lib/sandbox/isolate.ts:1 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/server/worker/src/lib/sandbox/sandbox.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/server/worker/src/lib/sandbox/sandbox.ts:1 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/server/worker/src/lib/sandbox/types.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/server/worker/src/lib/sandbox/types.ts:1 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in packages/server/worker/src/lib/utils/exec.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/server/worker/src/lib/utils/exec.ts:1 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in tools/scripts/check-migration-rollback.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
tools/scripts/check-migration-rollback.ts:1 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in tools/scripts/install-bun.js:3
Found a known-risky pattern (node_child_process). Review and replace if possible.
tools/scripts/install-bun.js:3 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in tools/scripts/pieces/bump-translated-pieces.ts:3
Found a known-risky pattern (node_child_process). Review and replace if possible.
tools/scripts/pieces/bump-translated-pieces.ts:3 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in tools/scripts/utils/exec.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
tools/scripts/utils/exec.ts:1 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in tools/scripts/utils/package-pre-publish-checks.ts:2
Found a known-risky pattern (node_child_process). Review and replace if possible.
tools/scripts/utils/package-pre-publish-checks.ts:2 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in tools/scripts/utils/piece-script-utils.ts:2
Found a known-risky pattern (node_child_process). Review and replace if possible.
tools/scripts/utils/piece-script-utils.ts:2 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in tools/scripts/utils/publish-npm-package.ts:3
Found a known-risky pattern (node_child_process). Review and replace if possible.
tools/scripts/utils/publish-npm-package.ts:3 Node child process
medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in tools/setup-dev.js:3
Found a known-risky pattern (node_child_process). Review and replace if possible.
tools/setup-dev.js:3 Node child process
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in packages/pieces/community/mailchimp/src/i18n/de.json:136
Found a known-risky pattern (weak_hash). Review and replace if possible.
packages/pieces/community/mailchimp/src/i18n/de.json:136 Weak hash
medium System graph security security conf 1.00 Insecure pattern 'weak_hash' in packages/pieces/community/mailchimp/src/i18n/es.json:136
Found a known-risky pattern (weak_hash). Review and replace if possible.
packages/pieces/community/mailchimp/src/i18n/es.json:136 Weak hash

Showing first 300 of 1317. Refine filters or use the findings page for deep search.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/195f8714-1e7f-4e04-bc90-e66ac1b3c39d/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/195f8714-1e7f-4e04-bc90-e66ac1b3c39d/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.