Checks

0 checks failed · 0 failing · 1 passing

• Audit mode — PASS — 7 vulnerabilities found. Scan is in audit mode and will not fail. Configure thresholds to enable checks.

Hint: You can configure the checks on the repository settings page.

Scan metadata

• scan: #427398 · branch dependabot/npm_and_yarn/dev-dependencies-e3c6c958fe · sha 6f1c1ef34037
• open: 7 — critical=0 high=0 medium=6 low=1 info=0
• new: 0 — critical=0 high=0 medium=0 low=0 info=0
• new-secrets: 0
• resolved: 0
• ignored: 0

Pre-existing vulnerabilities (7)

Present on the base branch before this scan.

VULN-9Z1 — MEDIUM

• id: VULN-9Z1
• rule: Dependabot configuration missing cooldown period for new packages
• severity: MEDIUM
• state: pre-existing (present on the base branch)
• scope: repo
• location: .github/dependabot.yml:3-18
• title: Inclusion of Functionality from Untrusted Control Sphere
• description: This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 7 to each package-ecosystem entry under updates to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
• remediation: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown

---

VULN-9Z2 — MEDIUM

• id: VULN-9Z2
• rule: Dependabot configuration missing cooldown period for new packages
• severity: MEDIUM
• state: pre-existing (present on the base branch)
• scope: repo
• location: .github/dependabot.yml:20-35
• title: Inclusion of Functionality from Untrusted Control Sphere
• description: This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 7 to each package-ecosystem entry under updates to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
• remediation: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown

---

VULN-9Z3 — MEDIUM

• id: VULN-9Z3
• rule: Dependabot configuration missing cooldown period for new packages
• severity: MEDIUM
• state: pre-existing (present on the base branch)
• scope: repo
• location: .github/dependabot.yml:37-45
• title: Inclusion of Functionality from Untrusted Control Sphere
• description: This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 7 to each package-ecosystem entry under updates to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
• remediation: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown

---

VULN-9Z4 — MEDIUM

• id: VULN-9Z4
• rule: Use of dangerouslySetInnerHTML in React — XSS risk
• severity: MEDIUM
• state: pre-existing (present on the base branch)
• scope: repo
• location: src/components/brand-theme-scope.tsx:73
• title: CWE-79
• description: The application was found calling dangerouslySetInnerHTML which may lead to Cross Site Scripting (XSS). By default, React components will encode the data properly before rendering. Calling dangerouslySetInnerHTML disables this encoding and allows raw markup and JavaScript to be executed. XSS is an attack which exploits a web application or system to treat user input as markup or script code. It is important to encode the data, depending on the specific context it is used in. There are at least six context types: - Inside HTML tags <div>context 1</div> - Inside attributes: <div class="context 2"></div> - Inside event attributes <button onclick="context 3">button</button> - Inside script blocks: <script>var x = "context 4"</script> - Unsafe element HTML assignment: element.innerHTML = "context 5" - Inside URLs: <iframe src="context 6"></iframe><a href="context 6">link</a> Script blocks alone have multiple ways they need to be encoded. Extra care must be taken if user input is ever output inside of script tags. User input that is displayed within the application must be encoded, sanitized or validated to ensure it cannot be treated as HTML or executed as Javascript code. Care must also be taken to not mix server-side templating with client-side templating, as the server-side templating will not encode things like {{ 7*7 }} which may execute client-side templating features. It is NOT advised to encode user input prior to inserting into a data store. The data will need to be encoded depending on context of where it is output. It is much safer to force the displaying system to handle the encoding and not attempt to guess how it should be encoded. Remove the call to dangerouslySetInnerHTML or ensure that the data used in this call does not come from user-supplied input. For more information on dangerously setting inner HTML see: - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html
• remediation: Remove uses of dangerouslySetInnerHTML and render content using JSX bindings that escape by default. Sanitize any required HTML with a vetted library (for example DOMPurify) before assigning it to dangerouslySetInnerHTML. Ensure unescaped HTML only comes from trusted, validated sources and document why it is safe. Apply a Content Security Policy (CSP) to reduce impact of any potential XSS.
• AI verdict: False positive
• AI summary: The code injects a CSS string into a <style> element via dangerouslySetInnerHTML, but the string is assembled only from resolved.light and resolved.dark, which are produced by resolveBrandTheme(theme) and then passed through the isSafeCssValue filter. The selector’s scope ID comes from useId(), a deterministic value generated inside the component and not exposed to the user. Because no attacker‑controlled data can reach the innerHTML and all values are vetted as safe CSS, the XSS warning is a false positive.

---

VULN-9Z5 — MEDIUM

• id: VULN-9Z5
• rule: Potentially vulnerable regular expression — ReDoS hazard
• severity: MEDIUM
• state: pre-existing (present on the base branch)
• scope: repo
• location: src/lib/url-safety.ts:144
• title: Inefficient Regular Expression Complexity
• description: Detected the use of a regular expression ^data:image\/(?:png|jpeg|jpg|gif|webp|avif|x-icon|vnd\.microsoft\.icon)(?:;[a-z0-9-]+(?:=[^,;]*)?)*, which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library which offers default safety against ReDoS vulnerabilities.
• remediation: https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS, https://www.regular-expressions.info/redos.html
• AI verdict: Uncertain
• AI summary: The uncertainty stems from conflicting assessments of whether the SAFE_IMAGE_DATA_PREFIX regular expression can be abused for ReDoS. One view points out that the pattern is anchored, requires a leading semicolon for each segment, and lacks overlapping quantifiers, suggesting that even attacker‑controlled input cannot trigger exponential backtracking. The opposite view highlights the presence of nested quantifiers and the fact that the regex is applied to any <img src> value derived from untrusted data‑URL content without prior length checks or sanitisation, which could allow a crafted payload to exhaust resources. A definitive verdict would require evidence of an actual exploitable input (e.g., a data‑URI that causes the engine to backtrack catastrophically) or confirmation that upstream validation or size limits effectively prevent such inputs.

---

VULN-CAC — MEDIUM

• id: VULN-CAC
• rule: Template literal includes HTML with unescaped interpolations — XSS risk
• severity: MEDIUM
• state: pre-existing (present on the base branch)
• scope: repo
• location: demo/src/App.tsx:113
• title: Improper Encoding or Escaping of Output
• description: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).
• remediation: https://owasp.org/Top10/A03_2021-Injection
• AI verdict: False positive
• AI summary: The title value is sourced from user‑controlled input but it is only interpolated into a template literal that becomes a mrkdwn string inside a JSON payload sent to Slack’s Block Kit API. Slack’s rendering engine sanitizes any HTML tags in mrkdwn content and never executes scripts, and the application does not use dangerouslySetInnerHTML or other DOM‑injection mechanisms. Because the sink is the Slack API rather than a browser DOM, the potentially malicious markup is stripped before display, eliminating the XSS risk.

---

VULN-9Z6 — LOW

• id: VULN-9Z6
• rule: Restrict GitHub Actions top-level permissions to avoid write-all access
• severity: LOW
• state: pre-existing (present on the base branch)
• scope: repo
• location: .github/workflows/ci.yml
• title: Ensure top-level permissions are not set to write-all
• description: Ensure top-level permissions are not set to write-all
• remediation: Review GitHub Actions workflow configuration and modify top-level permissions to exclude write-all access.

---