Scan report

KarpelesLab / goro

View on GitHub (opens in a new tab)
PHP
695 stars
Scanned 24 Sep 2026, 09:39

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

72 risk score

Real issues worth reviewing before you rely on this code.

High: 6
Medium: 23
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

3 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 0
Low: 3

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

32 total findings

Likely real: 24
Uncertain: 8
Likely noise: 0

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a medium vulnerability score of 72, which means there are several insecure coding patterns that an attacker could potentially exploit if they find and use the code. The most serious issues involve using MD5 and SHA1 hash algorithms, which are now considered too weak for protecting data, and missing security settings like TLS 1.3 in some network configurations. While these problems represent ordinary mistakes rather than signs of malicious intent, they still require immediate attention because they could allow attackers to steal sensitive information or break critical parts of the system. The low score from other tools suggests that the code does not appear to be trying to do anything harmful, but the high number of medium-risk findings means the code is not ready for production use without significant fixes.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 29

Pattern-based code analysis · Vulnerability
GuardDog 3

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/core/phpctx/http.go line 20

Likely real
Yes, 78% confidence

`Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the server. To fix this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path, "/")))` However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`. See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.
```
full := path.Join(p.root, path.Clean(req.URL.Path))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/exec.go line 93

Likely real
Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
command := exec.Command("/bin/sh", "-c", cmdStr)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/exec.go line 146

Likely real
Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
output, err := exec.Command("/bin/sh", "-c", cmd).Output()
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/exec.go line 172

Likely real
Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
command := exec.Command("/bin/sh", "-c", cmdStr)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/fs.go line 1835

Likely real
Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
cmd := exec.Command("/bin/sh", "-c", cmdStr)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/fs.go line 1866

Likely real
Uncertain, 46% confidence

Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
cmd := exec.Command("/bin/sh", "-c", cmdStr)
```

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /core/compiler/compile-expr.go line 124
Likely real: Yes, 99% confidence

Downcasting or changing sign of an integer with `$CAST_METHOD` method

uv, uerr := strconv.ParseUint(i.Data, 0, 64)
			if uerr == nil {
				// PHP treats values > INT64_MAX as float, not as two's complement int.
				// Only values that fit in signed int64 remain int.
				if uv <= math.MaxInt64 {
					return &runZVal{v: phpv.ZInt(int64(uv)), l: l}, nil
				}
				return &runZVal{v: phpv.ZFloat(float64(uv)), l: l}, nil
			}

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/core/zscanf.go line 208

Likely real
Yes, 99% confidence

Downcasting or changing sign of an integer with `$CAST_METHOD` method
```
un, err3 := strconv.ParseUint(string(s), base, 64)
		if err3 != nil {
			return 0, false
		}
		return int64(un), true
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/core/zscanf.go line 920

Likely real
Yes, 99% confidence

Downcasting or changing sign of an integer with `$CAST_METHOD` method
```
un, err3 := strconv.ParseUint(strings.TrimPrefix(string(s), "+"), base, 64)
		if err3 != nil {
			return 0, false
		}
		return int64(un), true
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/sapi/php-cgi/main.go line 35

Likely real
Yes, 99% confidence

The package `net/http/cgi` is on the import blocklist. The package is vulnerable to httpoxy attacks (CVE-2015-5386). It is recommended to use `net/http` or a web framework to build a web application instead.
```
err := cgi.Serve(p.Handler(".", ini.New()))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/sapi/php-httpd/main.go line 38

Likely real
Yes, 77% confidence

Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string.
```
l, err := net.Listen("tcp", ":8080")
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/strings.go line 771

Likely real
Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
sum := sha1.Sum([]byte(str))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/strings.go line 477

Likely real
Yes, 53% confidence

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
sum := md5.Sum([]byte(str))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/crypt_md5.go line 35

Likely real
Yes, 53% confidence

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
alt := md5.New()
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/strings.go line 805

Likely real
Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
h := sha1.New()
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/curl/curl.go line 347

Likely real
Yes, 53% confidence

`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.
```
TLSClientConfig: &tls.Config{
			InsecureSkipVerify: !sslVerifyPeer, //nolint:gosec
		},
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/mysqli/mysqli.go line 382

Likely real
Yes, 52% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
_, err = d.db.ExecContext(context.Background(), "SET NAMES "+string(charset))
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/mysqli/mysqli.go line 361

Likely real
Yes, 52% confidence

String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.
```
_, err = d.db.ExecContext(context.Background(), "USE `"+string(dbName)+"`")
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 57

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: coverallsapp/github-action@v2
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 19

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/setup-go@v6
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 42

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v6
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 44

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/setup-go@v6
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 17

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v6
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/crypt_md5.go line 29

Likely real
Yes, 51% confidence

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
d := md5.New()
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/crypt_md5.go line 67

Likely real
Yes, 51% confidence

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
r := md5.New()
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/strings.go line 511

Likely real
Yes, 51% confidence

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
h := md5.New()
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/gmp/misc.go line 9

Likely real
Uncertain, 39% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
mathrand "math/rand"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/core/random/rand.go line 4

Likely real
Uncertain, 38% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
"math/rand/v2"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/ext/standard/strings.go line 10

Likely real
Uncertain, 38% confidence

Do not use `math/rand`. Use `crypto/rand` instead.
```
"math/rand/v2"
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/ext/standard/uname.go line 27

Likely real
Yes, 93% confidence

Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
```
case "n":
		n, err := os.Hostname()
		if err != nil {
			return nil, err
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/ext/standard/missing_funcs2.go line 286

Likely real
Yes, 93% confidence

Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
```
fmt.Fprintf(ctx, "PHP Version => %s\n\n", core.VERSION)
		fmt.Fprintf(ctx, "System => %s %s %s\n", runtime.GOOS, hostname, runtime.GOARCH)
		fmt.Fprintf(ctx, "Build Date => Jan  1 2024\n")
		fmt.Fprintf(ctx, "Configure Command => goro\n")
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/ext/standard/missing_funcs2.go line 284

Likely real
Yes, 93% confidence

Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]
```
if flags&1 != 0 { // INFO_GENERAL
		hostname, _ := os.Hostname()
		fmt.Fprintf(ctx, "PHP Version => %s\n\n", core.VERSION)
		fmt.Fprintf(ctx, "System => %s %s %s\n", runtime.GOOS, hostname, runtime.GOARCH)
```