MalDet · Static Security Report
This repository has a high vulnerability risk score of 231.0, which means there are many insecure coding patterns that an attacker could exploit to break your application. The most serious issues involve missing mutex locks that can cause the program to crash unexpectedly, using functions meant for finding paths instead of sanitizing them from user input, and running commands directly without verifying what is passed to them. While some findings suggest potential malicious intent, the majority appear to be standard insecure practices rather than signs of a hidden attack. The code also contains several other medium-risk issues related to regular expression usage and memory safety that could lead to crashes or denial-of-service attacks if not fixed.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 8 | 89 | 0 | 97 |
| yara | Signatures of malicious behaviour in source files | 6 | 0 | 1 | 7 |
| guarddog | Malicious package and install-time behaviour | 0 | 1 | 1 | 2 |
68 of 106 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | Missing mutex unlock (`f.mu` variable) before returning from a function. This could result in panics resulting from double lock operations | 1 | /hugolib/filesystems/basefs.go:100 |
| high | semgrep | `Clean` is not intended to sanitize against path traversal attacks. This function is for finding the shortest path name equivalent to the given input. Using `Clean` to sanitize file reads may expose this application to path traversal attacks, where an attacker could access arbitrary files on the ser | 1 | /commands/server.go:321 |
| high | semgrep | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. | 6 | /common/hexec/exec.go:542 |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 2 | /.github/workflows/test.yml |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 4 | /internal/warpc/js/renderkatex.bundle.js |
| medium | semgrep | RegExp() called with a `regexp` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll | 1 | /livereload/livereload.js:1587 |
| medium | semgrep | RegExp() called with a `separator` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contr | 1 | /livereload/livereload.js:1779 |
| medium | semgrep | Variable `si` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /common/hugio/copy.go:41 |
| medium | semgrep | Variable `file` is likely modified and later used on error. In some cases this could result in panics due to a nil dereference | 1 | /commands/convert.go:153 |
| medium | semgrep | Found a formatted template string passed to 'template.HTML()'. 'template.HTML()' does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. | 2 | /tpl/strings/truncate.go:154 |
| medium | semgrep | Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. | 2 | /internal/warpc/genavif/avif.c:324 |
| medium | semgrep | Iteration over a possibly empty map `m`. This is likely a bug or redundant code | 1 | /htesting/hqt/checkers.go:169 |
| medium | semgrep | `t.envName.replace` method will only replace the first occurrence when used with a string argument ("*"). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. | 1 | /internal/warpc/js/renderkatex.bundle.js:253 |
| medium | semgrep | This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: | 1 | /.github/dependabot.yml:4 |
| medium | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 1 | /releaser/releaser.go:119 |
| medium | semgrep | Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use | 39 | /hugolib/page__content.go:581 |
| medium | semgrep | The Origin header in the HTTP WebSocket handshake is used to guarantee that the connection accepted by the WebSocket is from a trusted origin domain. Failure to enforce can lead to Cross Site Request Forgery (CSRF). As per "gorilla/websocket" documentation: "A CheckOrigin function should carefully v | 1 | /livereload/livereload.go:96 |
| medium | semgrep | Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string. | 1 | /helpers/general.go:39 |
| medium | semgrep | An HTTP redirect was found to be crafted from user-input `r`. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to cra | 2 | /commands/server.go:364 |
| medium | semgrep | Detected 'Fprintf' or similar writing to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. | 1 | /commands/server.go:292 |
| medium | semgrep | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | 7 | /tpl/crypto/crypto.go:45 |
| medium | semgrep | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | 2 | /tpl/crypto/crypto.go:115 |
| medium | semgrep | Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. | 1 | /commands/server.go:489 |
| medium | semgrep | Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. | 1 | /livereload/livereload.go:144 |
| medium | semgrep | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to | 16 | /common/hreflect/helpers.go:204 |
| medium | semgrep | Do not use `math/rand`. Use `crypto/rand` instead. | 6 | /tpl/math/math.go:21 |
| medium | semgrep | This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted | 1 | /tpl/tplimpl/embedded/templates/_shortcodes/instagram.html:243 |
| low | guarddog | Detects heavy obfuscation techniques commonly used by malware [threat-runtime-obfuscation] | 1 | /tpl/internal/go_templates/htmltemplate/js.go:21 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 1 | /hugolib/testdata/redis.cn.md |