Scan report

betaflight / blackbox-log-viewer

View on GitHub (opens in a new tab)
JavaScript
507 stars
Scanned 24 Sep 2026, 10:07

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

23 risk score

Real issues worth reviewing before you rely on this code.

High: 1
Medium: 9
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

4 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 1
Medium: 0
Low: 21

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

32 total findings

Likely real: 10
Uncertain: 1
Likely noise: 21

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a medium vulnerability score of 23.0, which indicates that some code patterns are insecure and could potentially be exploited by an attacker to steal secrets or execute malicious code. However, the scan also identified a low-risk score of 4.0 for signs of intentional malicious intent, suggesting the code is likely not designed to harm users directly. The most concerning finding involves using variable interpolation in GitHub Actions workflows, which allows attackers to inject their own code and potentially bypass security controls. While this specific issue appears to be an ordinary insecure coding practice rather than a deliberate attempt to attack the system, it still represents a significant risk if left unaddressed. Additionally, there are several loose version constraints in the dependencies that could allow malicious updates to slip through, though these are considered low priority and unlikely to cause immediate harm.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Dependency checker 21

CVEs, typosquats and risky installs · Supply chain
Semgrep 10

Pattern-based code analysis · Vulnerability
YARA 1

Malware signature rules · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/deploy.yml line 49

Likely real
Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
```
run: |
          if [[ "${{ github.event_name }}" == "push" ]]; then
            BRANCH=${{ github.ref_name }}
          else
            BRANCH=PR${{ github.event.pull_request.number }}
          fi
          echo "BRANCH=$BRANCH" >> $GITHUB_OUTPUT

          # Set a simple output to confirm the value
          echo "EVENT: ${{ github.event_name }}, BRANCH: $BRANCH"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/components/HelpIcon.vue line 7

Likely real
Yes, 100% confidence

Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content.
```
<div v-html="text" />
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/components/ConfigurationPanel.vue line 32

Likely real
Yes, 100% confidence

Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content.
```
<span v-if="line.before != null" v-html="highlightHtml(line)"></span>
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/graph_config.js line 53

Likely real
Yes, 76% confidence

RegExp() called with a `field` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
```
nameRegex = new RegExp(String.raw`^${escapeRegExp(nameRoot)}\[[0-9]+\]$`);
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/stale.yaml line 16

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/stale@v8
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/deploy_cloudflare.yml line 43

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/download-artifact@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/deploy.yml line 88

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: thollander/actions-comment-pull-request@v3
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/build.yml line 47

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/upload-artifact@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/build.yml line 33

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-node@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/build.yml line 27

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'globals^17.6.0' — attacker could push malicious update
```
globals:^17.6.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'vite-plugin-pwa^1.3.0' — attacker could push malicious update
```
vite-plugin-pwa:^1.3.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'vite^8.0.16' — attacker could push malicious update
```
vite:^8.0.16
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'tailwindcss^4.2.4' — attacker could push malicious update
```
tailwindcss:^4.2.4
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'prettier^3.8.3' — attacker could push malicious update
```
prettier:^3.8.3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'html2canvas^1.0.0-rc.5' — attacker could push malicious update
```
html2canvas:^1.0.0-rc.5
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'eslint-config-prettier^10.1.8' — attacker could push malicious update
```
eslint-config-prettier:^10.1.8
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'eslint^10.3.0' — attacker could push malicious update
```
eslint:^10.3.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@vitejs/plugin-vue^6.0.6' — attacker could push malicious update
```
@vitejs/plugin-vue:^6.0.6
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@nuxt/ui^4.8.1' — attacker could push malicious update
```
@nuxt/ui:^4.8.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@iconify-json/lucide^1.2.105' — attacker could push malicious update
```
@iconify-json/lucide:^1.2.105
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: '@eslint/js^10.0.1' — attacker could push malicious update
```
@eslint/js:^10.0.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'webm-writer^1.0.0' — attacker could push malicious update
```
webm-writer:^1.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'vue-router^4.6.4' — attacker could push malicious update
```
vue-router:^4.6.4
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'vue^3.5.33' — attacker could push malicious update
```
vue:^3.5.33
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'throttle-debounce^5.0.0' — attacker could push malicious update
```
throttle-debounce:^5.0.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'sortablejs^1.15.7' — attacker could push malicious update
```
sortablejs:^1.15.7
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'semver^7.7.4' — attacker could push malicious update
```
semver:^7.7.4
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'pinia^3.0.4' — attacker could push malicious update
```
pinia:^3.0.4
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'leaflet-marker-rotation^0.4.0' — attacker could push malicious update
```
leaflet-marker-rotation:^0.4.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'leaflet^1.9.3' — attacker could push malicious update
```
leaflet:^1.9.3
```