Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist. Details In the /license/ endpoint, the licensedetailsview function is vulnerable to a potential cross-site scripting (XSS) attack due to inadequate validation and sanitization of the key parameter. This vulnerability arises when attempting to access a key with malicious javascript. PoC 1. Access following endpoint on scancode.io instance: http://localhost/license/%3Cscript%3Ealert(document.cookie);%3C/script%3E/ Impact Attackers can exploit the vulnerability to inject malicious scripts into the response generated by the licensedetailsview function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.
Recommended action: Upgrade to 32.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Command Injection in docker fetch process Summary A possible command injection in the docker fetch process as it allows to append malicious commands in the dockerreference parameter. Details In the function scanpipe/pipes/fetch.py:fetchdockerimage[1] the parameter dockerreference is user controllable. The dockerreference variable is then passed to the vulnerable function getdockerimageplatform. However, the getdockerimageplaform function constructs a shell command with the passed dockerreference. The pipes.runcommand then executes the shell command without any prior sanitization, making the function vulnerable to command injections. A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of docker://;,…
Recommended action: Upgrade to 32.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.