← Scan another repo

github.com/XX-net/XX-Net

@ cfa5bc17b676

Submitted 8/4/2026, 10:28:01 AM · Status: ok

Risk grade
F
100 / 100
Findings
47
0 critical20 high25 medium2 low0 info0 on CISA KEV0ATT&CK
Showing 47 of 47 findings

Findings

  • Detected github-fine-grained-pat: Found a GitHub Fine-Grained Personal Access Token, risking unauthorized repository access and code manipulation
    Found a GitHub Fine-Grained Personal Access Token, risking unauthorized repository access and code manipulation.
    gitleaks
  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret st
    Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)
    semgrepcode/default/lib/noarch/ecdsa/keys.py:960
  • Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret st
    Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)
    semgrepcode/default/lib/noarch/ecdsa/keys.py:962
  • Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret st
    Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)
    semgrepcode/default/lib/noarch/tlslite/utils/keyfactory.py:50
  • Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret st
    Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)
    semgrepcode/default/lib/noarch/tlslite/utils/openssl_rsakey.py:145
  • Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret st
    Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)
    semgrepcode/default/lib/noarch/tlslite/utils/openssl_rsakey.py:152
  • Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)
    semgrepcode/default/launcher/web_ui/js/jquery.timer.js:35
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrepcode/default/gae_proxy/local/cert_util.py:467
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrepcode/default/gae_proxy/local/ipv6_tunnel/win_reset_gp.py:30
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrepcode/default/gae_proxy/local/cert_util.py:344
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrepcode/default/gae_proxy/local/cert_util.py:348
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrepcode/default/gae_proxy/local/cert_util.py:397
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrepcode/default/gae_proxy/local/cert_util.py:402
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrepcode/default/gae_proxy/local/cert_util.py:415
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepcode/default/lib/noarch/dnslib/client.py:83
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepcode/default/smart_router/local/dns_query.py:57
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepcode/default/smart_router/local/dns_query.py:66
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(lint_python)
    checkov.github/workflows/lint_python.yml:0
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(notify_aur_upgrade)
    checkov.github/workflows/notify_aur_upgrade.yml:0
  • Flask session does not add `Vary: Cookie` header when accessed in some ways
    When the `session` object is accessed, Flask should set the `Vary: Cookie` header. This instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python `in` operator…
    osv-scannerCVE-2026-27205
  • PYSEC-2026-2151
    Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs c…
    osv-scannerCVE-2026-27205
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/gae_proxy/local/web_control.py:611
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/gae_proxy/local/web_control.py:612
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/gae_proxy/local/web_control.py:613
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/launcher/setup.py:91
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/launcher/update.py:111
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/asn1crypto/crl.py:524
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/asn1crypto/keys.py:1271
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/asn1crypto/x509.py:1152
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/asn1crypto/x509.py:2841
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/ecdsa/ecdsa.py:307
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/encrypt.py:69
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/scrypto/rc4_md5.py:33
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/scrypto/table.py:43
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/tlslite/handshakehashes.py:21
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/tlslite/handshakehashes.py:22
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/tlslite/recordlayer.py:1145
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/tlslite/recordlayer.py:1147
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/x_tunnel/local/proxy_session.py:1069
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepcode/default/lib/noarch/simple_http_server.py:256
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepcode/default/lib/noarch/tlslite/constants.py:1632
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepcode/default/lib/noarch/tlslite/constants.py:1635
  • Flask session does not add `Vary: Cookie` header when accessed in some ways
    grypeCVE-2026-27205EPSS 0.3%
  • flask: Flask: Information disclosure via improper caching of session data
    Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs c…
    trivyCVE-2026-27205

This report is public.