← Scan another repo

github.com/MetaCubeX/mihomo

@ 008b91bfe8c0

Submitted 8/4/2026, 10:28:02 AM · Status: ok

Risk grade
B
16 / 100
Findings
3
0 critical1 high2 medium0 low0 info0 on CISA KEV0ATT&CK
Showing 3 of 3 findings

Findings

  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepexamples/data_persistence.py:19
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Delete old workflow)
    checkov.github/workflows/Delete.yml:0
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Build)
    checkov.github/workflows/build.yml:5

This report is public.