MalDet · Static Security Report
This repository has a critical vulnerability score of 478.0, which means there are serious insecure coding patterns that an attacker could exploit to break into the system. The scan found many instances where code calls dangerous functions like child_process or uses shell commands with user input, but these issues appear to be ordinary mistakes rather than signs of malicious intent. While some findings involve using variables from GitHub workflows to inject code, which is a higher risk, the overall picture suggests the codebase has significant gaps that need immediate attention before it can be used in production.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 53 | 104 | 20 | 177 |
83 of 177 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Detected calls to child_process from a function argument `appName`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | 2 | /script/test-summary.js:129 |
| high | semgrep | Detected calls to child_process from a function argument `specPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | 1 | /script/cypress-testrail-helper/lib/utils.js:194 |
| high | semgrep | Detected calls to child_process from a function argument `portToKill`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | 1 | /src/applications/_mock-form-ae-design-patterns/vadx/server/utils/processes.js:23 |
| high | semgrep | Detected calls to child_process from a function argument `apiUrl`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | 1 | /script/run-review-instance-api.js:105 |
| high | semgrep | Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. | 7 | /src/applications/travel-pay/services/mocks/claims/claimHandlers.js:104 |
| high | semgrep | Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. | 2 | /script/utils.js:25 |
| high | semgrep | Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | 2 | /script/utils.js:25 |
| high | semgrep | Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. | 2 | /src/applications/_mock-form-ae-design-patterns/vadx/server/utils/processes.js:131 |
| high | semgrep | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use | 17 | /.github/workflows/full-suite-tests.yml:255 |
| high | semgrep | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. | 2 | /src/platform/utilities/preview-environment/Dockerfile:18 |
| high | semgrep | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities | 16 | /src/applications/static-pages/widget-creators/createMyVALoginWidget.js:11 |
| medium | semgrep | RegExp() called with a `key` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled | 1 | /src/applications/vaos/utils/calendar.js:91 |
| medium | semgrep | RegExp() called with a `i` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in | 2 | /src/platform/forms/validations.js:176 |
| medium | semgrep | RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled | 1 | /src/applications/benefits-optimization-aquia/shared/cypress-helpers/assertions.js:13 |
| medium | semgrep | RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in | 1 | /src/platform/forms-system/src/js/routing/index.js:81 |
| medium | semgrep | RegExp() called with a `schema` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll | 8 | /src/applications/edu-benefits/10297/helpers.js:271 |
| medium | semgrep | RegExp() called with a `labelText` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contr | 7 | /src/applications/benefits-optimization-aquia/shared/cypress-helpers/form-interactions.js:61 |
| medium | semgrep | RegExp() called with a `props` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle | 3 | /src/applications/mhv-secure-messaging/components/MessageList/MessageListItem.jsx:43 |
| medium | semgrep | RegExp() called with a `fileName` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contro | 1 | /script/github-actions/check-imports.js:13 |
| medium | semgrep | RegExp() called with a `term` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled | 1 | /src/applications/facility-locator/hooks/useServiceType.jsx:59 |
| medium | semgrep | RegExp() called with a `rootUrl` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control | 1 | /src/applications/simple-forms-form-engine/shared/utils/url.js:5 |
| medium | semgrep | RegExp() called with a `qs` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled i | 1 | /src/platform/testing/e2e/mockapi.js:93 |
| medium | semgrep | RegExp() called with a `domain` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll | 1 | /src/platform/utilities/environment/stagingDomains.js:13 |
| medium | semgrep | RegExp() called with a `batchRedirect` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-c | 1 | /src/applications/proxy-rewrite/redirects/index.js:29 |
| medium | semgrep | Service 'vets-website' is running with a writable root filesystem. This may allow malicious applications to download and run additional payloads, or modify container files. If an application inside a container has to save something temporarily consider using a tmpfs. Add 'read_only: true' to this se | 3 | /docker-compose.review.yml:3 |
| medium | semgrep | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of | 3 | /src/platform/landing-pages/dev-template.ejs:282 |
| medium | semgrep | Service 'vets-website' allows for privilege escalation via setuid or setgid binaries. Add 'no-new-privileges:true' in 'security_opt' to prevent this. | 3 | /.devcontainer/docker-compose.yml:3 |
| medium | semgrep | The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input befor | 1 | /src/applications/accredited-representative-portal/containers/AuthCallbackHandler.jsx:186 |
| medium | semgrep | RegExp() called with a `{ arrayPath, path }` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on | 1 | /src/platform/testing/e2e/cypress/support/form-tester/utilities.js:24 |
| medium | semgrep | RegExp() called with a `field` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle | 1 | /src/applications/caregivers/components/FormFields/AddressWithAutofill.jsx:115 |
| medium | semgrep | Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. | 2 | /src/applications/ivc-champva/10-7959C/config/submitTransformer.js:214 |
| medium | semgrep | Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol instead of http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle attacks in which the attacker is able to read sensitive information. | 2 | /script/run-cypress-enhanced.js:244 |
| medium | semgrep | Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HT | 2 | /src/applications/avs/components/ParagraphBlock.jsx:19 |
| medium | semgrep | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis | 3 | /src/applications/benefits-optimization-aquia/shared/utils/zod-helpers/zod-helpers.js:51 |
| medium | semgrep | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. | 54 | /script/github-actions/annotate-enzyme.js:33 |
| low | semgrep | A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies. | 3 | /src/applications/_mock-form-ae-design-patterns/vadx/server/index.js:9 |
| low | semgrep | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. | 17 | /script/test-summary.js:135 |