replicatedhq / kots

Large result: showing the top 232 of 696 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.

1. high Semgrep Detected calls to child_process from a function argument `page`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. /e2e/playwright/shared-core/support-bundle.ts:210 99%
2. high Semgrep Detected calls to child_process from a function argument `remoteUrl`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. /e2e/playwright/regression/shared/cli.ts:575 99%
3. high Semgrep Detected calls to child_process from a function argument `localPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. /e2e/playwright/regression/shared/cli.ts:575 99%
4. high Semgrep Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: [Go XSS prevention] (https://semgrep.dev/docs/cheat-sheets/go-xss/). /pkg/handlers/update.go:91 99%
5. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function. /pkg/handlers/update.go:484 96%
6. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function. /pkg/handlers/airgap.go:205 96%
7. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Go, it is possible to sanitize user input and mitigate path traversal by using the built-in `filepath.Clean` function. /pkg/handlers/airgap.go:225 95%
8. high Semgrep This Node.js version file pins a runtime that is affected by CVE-2026-111497 (Brotli decoder out-of-bounds write, remote code execution) or a floating alias whose patch level cannot be verified. Pin to a fixed release 22.23.4, 24.22.1, 26.12.1 or later on the same line. Node.js 20 and older, 23 and 25 are end-of-life and will not receive a fix. /web/.nvmrc:1 95%
9. high GuardDog Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] /web/src/components/config_render/ConfigGroup.jsx:40 95%
10. high GuardDog Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] /web/src/components/config_render/ConfigFileInput.jsx:101 95%
11. high GuardDog Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] /web/src/components/config_render/ConfigGroups.jsx:25 95%
12. high GuardDog Detects base64 decoding followed by code execution [threat-runtime-obfuscation-base64exec] /pkg/operator/client/deploy.go:184 91%
13. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/release.yaml:70 87%
14. high Semgrep Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. /e2e/playwright/regression/shared/cli.ts:583 84%
15. high Semgrep Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. /e2e/playwright/regression/shared/cli.ts:591 84%
16. high Semgrep Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. /e2e/playwright/shared-core/support-bundle.ts:235 84%
17. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/actions/scan-image/action.yml:77 57%
18. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/regression.yaml:240 57%
19. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/actions/scan-image/action.yml:85 57%
20. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/e2e-workspace-cleanup.yaml:84 57%
21. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/e2e-workspace-cleanup.yaml:112 57%
22. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/promote-kurl-release.yaml:39 57%
23. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/regression.yaml:142 57%
24. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/actions/kurl-addon-kots-generate/action.yml:61 57%
25. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/release.yaml:30 57%
26. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/release-for-ec.yaml:96 57%
27. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/release-for-ec.yaml:19 57%
28. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/actions/kurl-addon-kots-generate/action.yml:69 57%
29. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/actions/scan-image/action.yml:46 57%
30. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/actions/kurl-addon-kots-generate/action.yml:38 57%
31. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/actions/kots-e2e/action.yml:124 57%
32. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/actions/build-dep-image-with-apko/action.yml:33 57%
33. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/publish-securebuild.yml:41 57%
34. high Semgrep bcrypt hash detected /dev/manifests/kotsadm/deployment.yaml:84 49%
35. high Semgrep Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. /pkg/airgap/update.go:46 47%
36. high Semgrep Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. /pkg/apparchive/app.go:58 47%
37. high Semgrep Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. /pkg/apparchive/app.go:178 47%
38. high Semgrep Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. /pkg/apparchive/helm-v1beta1.go:133 47%
39. high Semgrep Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. /pkg/docker/registry/temp_registry.go:70 47%
40. high Semgrep Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. /pkg/embeddedcluster/artifacts.go:80 46%
41. high Semgrep Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. /pkg/embeddedcluster/upgrade.go:159 46%
42. high Semgrep Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. /pkg/operator/applier/kubectl.go:221 46%
43. high Semgrep Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. /pkg/operator/applier/kubectl.go:300 46%
44. high Semgrep Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. /pkg/upgradeservice/process.go:112 46%
45. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /e2e/Dockerfile:19 22%
46. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /.github/actions/copy-assets/Dockerfile:11 22%
47. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /.github/actions/version-tag/dist/index.js 3%
48. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /.github/actions/kurl-addon-kots-publisher/dist/index.js 3%
49. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /.github/actions/cmx-versions/dist/index.js 3%
50. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /Makefile 1%
51. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /pkg/preflight/preflight.go 1%
52. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /dev/dockerfiles/kotsadm/Dockerfile.ttlsh 1%
53. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /dev/dockerfiles/kotsadm/Dockerfile.local 1%
54. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /cmd/kots/cli/check-version.go 1%
55. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /cmd/kots/cli/version.go 1%
56. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /e2e/scripts/deps.sh 1%
57. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /.github/actions/version-tag/dist/index.js 1%
58. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /.github/actions/cmx-versions/dist/index.js 1%
59. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /.github/actions/kurl-addon-kots-publisher/dist/index.js 1%
60. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /pkg/supportbundle/supportbundle.go 1%
61. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /pkg/handlers/troubleshoot.go 1%
62. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /.github/actions/cmx-versions/dist/index.js 1%
63. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /.github/actions/kurl-addon-kots-publisher/dist/index.js 1%
64. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /.github/actions/version-tag/dist/index.js 1%
65. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /cmd/kotsadm/cli/completion.go 0%
66. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /cmd/kots/cli/completion.go 0%
67. medium Semgrep RegExp() called with a `expectedSequence` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /e2e/playwright/regression/shared/version-history.ts:180 100%
68. medium Semgrep RegExp() called with a `functionName` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /.github/actions/cmx-versions/test.js:52 100%
69. medium Semgrep RegExp() called with a `sequence` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /e2e/playwright/regression/shared/version-history.ts:221 100%
70. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/preflight_store.go:38 100%
71. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/preflight_store.go:64 100%
72. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/preflight_store.go:93 100%
73. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/preflight_store.go:115 100%
74. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/preflight_store.go:131 100%
75. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/prometheus_store.go:14 100%
76. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/prometheus_store.go:37 100%
77. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/registry_store.go:19 100%
78. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/registry_store.go:75 100%
79. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/registry_store.go:86 100%
80. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/registry_store.go:101 100%
81. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/session_store.go:44 100%
82. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/session_store.go:100 100%
83. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/snapshot_store.go:21 100%
84. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/license_store.go:53 100%
85. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/snapshot_store.go:47 100%
86. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/preflight_store.go:20 100%
87. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:489 100%
88. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:467 100%
89. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:417 100%
90. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:395 100%
91. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:345 100%
92. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:323 100%
93. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:273 100%
94. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:251 100%
95. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:201 100%
96. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:179 100%
97. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:129 100%
98. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:107 100%
99. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/migrations.go:57 100%
100. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/license_store.go:226 100%
101. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/license_store.go:87 100%
102. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/version_store.go:975 100%
103. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/version_store.go:45 100%
104. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/version_store.go:76 100%
105. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/version_store.go:102 100%
106. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/version_store.go:184 100%
107. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/version_store.go:215 100%
108. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/version_store.go:800 100%
109. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/version_store.go:932 100%
110. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/version_store.go:946 100%
111. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/user_store.go:237 100%
112. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/version_store.go:1035 100%
113. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/tasks/tasks.go:89 100%
114. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/tasks/tasks.go:104 100%
115. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/tasks/tasks.go:119 100%
116. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/tasks/tasks.go:135 100%
117. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/version/version.go:68 100%
118. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:391 100%
119. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/supportbundle_store.go:187 100%
120. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/snapshot_store.go:90 100%
121. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/snapshot_store.go:107 100%
122. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/snapshot_store.go:133 100%
123. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/snapshot_store.go:149 100%
124. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/snapshot_store.go:176 100%
125. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/supportbundle_store.go:43 100%
126. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/supportbundle_store.go:89 100%
127. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/supportbundle_store.go:126 100%
128. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/snapshot_store.go:63 100%
129. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/supportbundle_store.go:191 100%
130. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/user_store.go:63 100%
131. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/user_store.go:88 100%
132. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/user_store.go:149 100%
133. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/user_store.go:159 100%
134. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/user_store.go:180 100%
135. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/user_store.go:229 100%
136. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:395 100%
137. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:64 100%
138. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:88 100%
139. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:112 100%
140. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:131 100%
141. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:153 100%
142. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:221 100%
143. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:311 100%
144. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:352 100%
145. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:366 100%
146. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:50 100%
147. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:422 100%
148. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:472 100%
149. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:489 100%
150. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:506 100%
151. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:523 100%
152. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:541 100%
153. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:595 100%
154. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:674 100%
155. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:688 100%
156. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/filestore/rqlite_store.go:69 100%
157. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/app/app.go:16 100%
158. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/app/app.go:30 100%
159. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/app/app.go:44 100%
160. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/app/app.go:58 100%
161. medium Semgrep Variable `tmpFile` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/base/helm.go:462 100%
162. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/filestore/migrate.go:98 100%
163. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/filestore/migrate.go:170 100%
164. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/filestore/migrate.go:184 100%
165. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/filestore/rqlite_store.go:54 100%
166. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/kotsadm_params_store.go:83 100%
167. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/filestore/rqlite_store.go:109 100%
168. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/persistence/migrate.go:209 100%
169. medium Semgrep Variable `license` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/pull/pull.go:165 100%
170. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/airgap_store.go:18 100%
171. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/airgap_store.go:32 100%
172. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/airgap_store.go:54 100%
173. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/airgap_store.go:92 100%
174. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/airgap_store.go:107 100%
175. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:34 100%
176. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:1122 100%
177. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:289 100%
178. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:568 100%
179. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:1069 100%
180. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/app_store.go:713 100%
181. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/license_store.go:24 100%
182. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/kotsadm_params_store.go:68 100%
183. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/kotsadm_params_store.go:45 100%
184. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/kotsadm_params_store.go:18 100%
185. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/installation_store.go:16 100%
186. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:327 100%
187. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:1207 100%
188. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:1234 100%
189. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:1250 100%
190. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/embedded_cluster_store.go:19 100%
191. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/embedded_cluster_store.go:33 100%
192. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/embedded_cluster_store.go:47 100%
193. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/embedded_store.go:14 100%
194. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/embedded_store.go:37 100%
195. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/embedded_store.go:46 100%
196. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/cluster_store.go:195 100%
197. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/appstatus_store.go:17 100%
198. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/appstatus_store.go:79 100%
199. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/branding_store.go:19 100%
200. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/branding_store.go:53 100%
201. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/branding_store.go:83 100%
202. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/branding_store.go:131 100%
203. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/cluster_store.go:21 100%
204. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/cluster_store.go:64 100%
205. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/cluster_store.go:87 100%
206. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/cluster_store.go:121 100%
207. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/cluster_store.go:178 100%
208. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:226 100%
209. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:29 100%
210. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:63 100%
211. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:89 100%
212. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:115 100%
213. medium Semgrep Variable `wr` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:166 100%
214. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:181 100%
215. medium Semgrep Variable `rows` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/store/kotsstore/downstream_store.go:204 100%
216. medium Semgrep `command.replace` method will only replace the first occurrence when used with a string argument ("\n"). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. /e2e/playwright/shared-core/support-bundle.ts:233 100%
217. medium Semgrep Variable `kotsadmMetadata` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/handlers/metadata.go:73 99%
218. medium Semgrep Iteration over a possibly empty map `forwardedAdditionalPorts`. This is likely a bug or redundant code /pkg/k8sutil/portforward.go:238 99%
219. medium Semgrep This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown /.github/dependabot.yml:6 99%
220. medium Semgrep This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown /.github/dependabot.yml:18 99%
221. medium Semgrep Variable `restore` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/snapshot/restore.go:161 99%
222. medium Semgrep Variable `backup` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference /pkg/snapshot/backup.go:147 99%
223. medium Semgrep A secret is exposed in the workflow-level `env:` block, making it available to every job and step in this workflow — including any untrusted code run in pull-request workflows. Scope secrets as narrowly as possible: prefer step-level `env:` so the secret is only available where it is actually needed. /.github/workflows/regression.yaml:73 98%
224. medium Semgrep A secret is exposed in the workflow-level `env:` block, making it available to every job and step in this workflow — including any untrusted code run in pull-request workflows. Scope secrets as narrowly as possible: prefer step-level `env:` so the secret is only available where it is actually needed. /.github/workflows/e2e-infra-cleanup.yaml:17 97%
225. medium GuardDog Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] /cmd/imagedeps/main.go:25 96%
226. low GuardDog Detects heavy obfuscation techniques commonly used by malware [threat-runtime-obfuscation] /pkg/identity/assets.go:3 94%
227. low GuardDog Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] /.github/actions/copy-assets/main.go:46 93%
228. low GuardDog Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] /.github/actions/cmx-versions/dist/index.js:39674 93%
229. low GuardDog Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] /.github/actions/cmx-versions/index.js:11 93%
230. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /pkg/kotsadm/objects/scripts/wait-for-rqlite.sh 0%
231. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /.github/workflows/build-test.yaml 0%
232. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /dev/dockerfiles/kotsadm-migrations/Dockerfile.ttlsh 0%

No findings match these filters. Clear filters