MalDet · Static Security Report
33 findings likely need attention, 11 look like noise. Most notable: This Node.js version file pins a runtime that is affected by CVE-2026-111497 (Brotli de... (95% confidence).
Generated from finding counts. A plain-English summary was not available for this scan.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 1 | 34 | 0 | 35 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 9 | 9 |
| guarddog | Malicious package and install-time behaviour | 0 | 1 | 0 | 1 |
33 of 45 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | semgrep | This Node.js version file pins a runtime that is affected by CVE-2026-111497 (Brotli decoder out-of-bounds write, remote code execution) or a floating alias whose patch level cannot be verified. Pin to a fixed release 22.23.4, 24.22.1, 26.12.1 or later on the same line. Node.js 20 and older, 23 and | 1 | /.nvmrc:1 |
| medium | semgrep | Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted inpu | 2 | /demo/bootstrap.php:151 |
| medium | guarddog | Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode] | 1 | /resources/widgets.js:872 |
| medium | semgrep | Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions. | 1 | /demo/ajax_cors.php:4 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 28 | /.github/workflows/screenshots.yml:26 |
| medium | semgrep | Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis | 1 | /resources/debugbar.js:31 |
| medium | semgrep | Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. | 2 | /src/Storage/FileStorage.php:163 |
| low | dep_checker | Loose version constraint: '@antfu/eslint-config^6.7.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@eslint/js^9.39.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@sqltools/formatter^1.2.5' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: '@tabler/icons^3.36.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'esbuild^0.27.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'eslint-plugin-jquery^1.5.1' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'eslint^9.39.2' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'globals^16.5.0' — attacker could push malicious update | 1 | package.json |
| low | dep_checker | Loose version constraint: 'highlight.js^11.11.1' — attacker could push malicious update | 1 | package.json |