Scan report

Ne0nd0g / merlin

View on GitHub (opens in a new tab)
Go
5605 stars
Scanned 18 Sep 2026, 19:38

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

56 risk score

Real issues worth reviewing before you rely on this code.

High: 3
Medium: 24
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

4 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 5
Medium: 0
Low: 4

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

36 total findings

Likely real: 22
Uncertain: 5
Likely noise: 9

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a medium vulnerability score of 56, which means there are several insecure coding patterns that an attacker could exploit to break into the system. The scan also found some signs of potentially malicious intent, but these findings look more like ordinary mistakes or weak defaults rather than intentional attacks. Most of the issues involve common security practices such as using untrusted user input, missing encryption settings, and relying on default Docker configurations instead of explicitly restricting permissions. While there are a few specific code injection risks and potential supply chain vulnerabilities, they do not appear to be part of a coordinated attack plan targeting this project. Overall, the code is likely safe to use if developers apply basic security updates to fix the identified issues.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 27

Pattern-based code analysis · Vulnerability
YARA 9

Malware signature rules · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/servers/http/handler.go line 136

Likely real
Yes, 99% confidence

Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention] (https://semgrep.dev/docs/cheat-sheets/go-xss/).
```
n, err := w.Write(rdata)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/modules/sharpgen/sharpgen.go line 225

Likely real
Uncertain, 47% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
cmd := exec.Command(config.DotNetBin, args...) // #nosec G204 Intended to run this way
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/Dockerfile line 17

Likely real
Probably noise, 23% confidence

By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.
```
ENTRYPOINT ["./merlinServer-Linux-x64", "-addr", "0.0.0.0:50051"]
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/transformer/encrypters/rc4/rc4.go line 55

Likely real
Yes, 100% confidence

Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead.
```
cipher, err := rc4.NewCipher(key) // #nosec G405 Intentionally using RC4 knowing it is insecure
```

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /pkg/services/message/message.go line 216
Likely real: Yes, 99% confidence

Variable `msg` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference

msg, err = s.listener.Deconstruct(data, key)
		if err != nil {
			slog.Warn("there was an error deconstructing the message", "error", err, "agent", id)
			//logging.Message("debug", fmt.Sprintf("pkg/services/message.Handle(): there was an error deconstructing the message for agent %s: %s", id, err))
			// If there is an orphaned agent, we can try to send back a message to re-accomplish authentication
			// Unable to deconstruct because the message wasn't encrypted with the PSK; likely encrypted with the Agent's session key established during authentication
			slog.Warn(fmt.Sprintf("Orphaned agent request from %s detected, instructing agent to re-authenticate", id))
			s.clientMsgRepo.Add(message.NewMessage(message.Note, fmt.Sprintf("Orphaned agent request from %s detected, instructing agent to re-authenticate", id)))

			// Unable to deconstruct because this listener's transforms don't match what the Agent used
			s.clientMsgRepo.Add(message.NewMessage(message.Warn, fmt.Sprintf("Ensure listener %s is configured the exact same way as the agent. If not create a new listener with the correct configuration and try again.", s.listener.ID())))
			msg.ID = id
			// If the agent previously authenticated, connected to a different server, and then connected back to this one, it will need to re-authenticate
			if s.agentService.Exist(id) && s.agentService.Authenticated(id) {
				//fmt.Println("Orphaned, exists, and authenticated, resetting authentication")
				key = nil
				err = s.agentService.ResetAuthentication(id)
				if err != nil {
					s.clientMsgRepo.Add(message.NewErrorMessage(fmt.Errorf("there was an error resetting the authentication status for orphaned agent %s: %s", id, err)))
				}
			}
		}

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/services/job/job.go line 366

Likely real
Yes, 54% confidence

Downcasting or changing sign of an integer with `uint32` method
```
i, err := strconv.Atoi(jobArgs[2])
			if err != nil {
				return "", err
			}
			payload.PID = uint32(i)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/servers/http/http.go line 568

Likely real
Yes, 53% confidence

`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.
```
tlsConfig := tls.Config{Certificates: []tls.Certificate{*certificates}} // #nosec G402 TLS version is not configured to facilitate dynamic JA3 configurations
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/servers/http/http.go line 565

Likely real
Yes, 53% confidence

`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.
```
tlsConfig := tls.Config{Certificates: []tls.Certificate{*certificates}} // #nosec G402 TLS version is not configured to facilitate dynamic JA3 configurations
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 100

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: ncipollo/release-action@v1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 31

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-go@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 15

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/qodana_pr.yml line 30

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: JetBrains/qodana-action@v2023.3
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/qodana_pr.yml line 25

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/qodana.yml line 33

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: JetBrains/qodana-action@v2023.3
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/go_main.yml line 58

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: github/codeql-action/upload-sarif@v2
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/go_dev.yml line 29

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/go_dev.yml line 32

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-go@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/go_dev.yml line 46

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: golang/govulncheck-action@v1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/go_dev.yml line 53

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: securego/gosec@master
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/go_main.yml line 28

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/go_main.yml line 31

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-go@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/go_main.yml line 45

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: golang/govulncheck-action@v1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/go_main.yml line 52

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: securego/gosec@master
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/qodana.yml line 28

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/servers/http/handler.go line 136

Likely real
Uncertain, 46% confidence

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.
```
n, err := w.Write(rdata)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/core/core.go line 24

Likely real
Uncertain, 39% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
"math/rand"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/pkg/services/message/message.go line 30

Likely real
Uncertain, 39% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
"math/rand"
```