MalDet

Scan report

statamic / cms

Report Rescan
Vulnerability High

Could an attacker exploit mistakes in this code?

195 risk score

Serious issues. Review the high-severity findings before using it.

High
4
Medium
70
Low
4

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

2 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High
1
Medium
0
Low
96

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview
175 total findings
Likely real
60
Uncertain
14
Likely noise
101

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a high vulnerability score of 195, which means there are many insecure coding patterns that an attacker could easily exploit if they find and use your code. The scan also found some signs of potentially malicious intent, but these do not look like intentional attacks; instead, they appear to be ordinary mistakes or outdated practices in the codebase. While the code contains several dangerous functions like phpinfo and command injection risks, the majority of issues are related to potential security flaws rather than deliberate harm. The most serious findings involve executing user input through regex patterns and building file paths from untrusted data, which could allow attackers to steal sensitive information or delete files. However, the overall risk is not as severe as the high vulnerability score suggests because many of these issues can be fixed with simple updates or code changes.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

  • Dependency checker 96

    CVEs, typosquats and risky installs · Supply chain

  • Semgrep 78

    Pattern-based code analysis · Vulnerability

  • YARA 1

    Malware signature rules · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.