Scan report
WordPress / ai
Could an attacker exploit mistakes in this code?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 1
- Medium
- 2
- Low
- 3
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
No issues of this kind were found.
- High
- 0
- Medium
- 0
- Low
- 0
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 3
- Uncertain
- 3
- Likely noise
- 0
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
3 findings likely need attention. Most notable: This Node.js version file pins a runtime that is affected by CVE-2026-111497 (Brotli de... in /.nvmrc (95% confidence).
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.nvmrc line 1
- Likely real
- Yes, 95% confidence
This Node.js version file pins a runtime that is affected by CVE-2026-111497 (Brotli decoder out-of-bounds write, remote code execution) or a floating alias whose patch level cannot be verified. Pin to a fixed release 22.23.4, 24.22.1, 26.12.1 or later on the same line. Node.js 20 and older, 23 and 25 are end-of-life and will not receive a fix.
24.18 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.npmrc line 3
- Likely real
- Yes, 97% confidence
This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/
min-release-age = 1 -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /.github/workflows/props-bot.yml line 74
- Likely real
- Yes, 52% confidence
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
uses: WordPress/props-bot-action@trunk -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/experiments/comment-moderation/components/LazyAnalysisController.tsx line 324
- Likely real
- Uncertain, 33% confidence
Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
`Failed to analyze comment ${ comment.id }:`, -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/experiments/editorial-updates/hooks/useEditorialUpdates.ts line 443
- Likely real
- Uncertain, 33% confidence
Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
`[Refine Notes] Failed to refine block ${ block.clientId }`, -
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /src/utils/notes.ts line 72
- Likely real
- Uncertain, 33% confidence
Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
`[AI Notes] Failed to fetch ${ status } Notes page ${ page }:`,
No findings match these filters.