← Scan another repo

github.com/fatedier/frp

@ 1a3a872bd216

Submitted 8/4/2026, 10:25:53 AM · Status: ok

Risk grade
C
34 / 100
Findings
58
0 critical1 high14 medium0 low43 info0 on CISA KEV0ATT&CK
Showing 58 of 58 findings

Findings

  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Ensure the pipeline image version is referenced via hash not arbitrary tag.
    Ensure the pipeline image version is referenced via hash not arbitrary tag. on jobs(go-version-latest).docker.image[1](cimg/go:1.25-node)
    checkov.circleci/config.yml:5
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(goreleaser)
    checkov.github/workflows/goreleaser.yml:0
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Close stale issues and PRs)
    checkov.github/workflows/stale.yml:7
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Build Image and Publish to Dockerhub & GPR)
    checkov.github/workflows/build-and-push-image.yml:8
  • go-ntlmssp NTLM challenges can panic on malformed payloads
    grypeCVE-2026-32952EPSS 1.0%
  • brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    ### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining many brace groups, an attacker keeps the result count under `max` while making every result grow with the number of groups. Building `ma…
    osv-scannerCVE-2026-14257
  • brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    ### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining many brace groups, an attacker keeps the result count under `max` while making every result grow with the number of groups. Building `ma…
    osv-scannerCVE-2026-14257
  • go-ntlmssp NTLM challenges can panic on malformed payloads
    go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patc…
    osv-scannerCVE-2026-32952
  • MD5/SHA1/DES are broken for security use. Use sha256+, and AES over DES. (Apache-2.0.)
    MD5/SHA1/DES are broken for security use. Use sha256+, and AES over DES. (Apache-2.0.)
    semgreppkg/util/util/util.go:51
  • MD5/SHA1/DES are broken for security use. Use sha256+, and AES over DES. (Apache-2.0.)
    MD5/SHA1/DES are broken for security use. Use sha256+, and AES over DES. (Apache-2.0.)
    semgreppkg/nathole/controller.go:75
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepconf/frps_full_example.toml:106
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepconf/frpc_full_example.toml:35
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepREADME.md:676
  • go-ntlmssp: go-ntlmssp: Denial of Service via malicious NTLM challenge
    go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patc…
    trivyCVE-2026-32952

This report is public.