github.com/kovidgoyal/kitty

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice (check_cmd[0], check_cmd[1:]...) — i.e. a command string split into an argv and executed, which let…

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice (cmcmd[0], cmcmd[1:]...) — i.e. a command string split into an argv and executed, which lets input …

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice (cmcmd[0], cmcmd[1:]...) — i.e. a command string split into an argv and executed, which lets input …

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice (cmd_args[0], cmd_args[1:]...) — i.e. a command string split into an argv and executed, which lets …

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice (cmd[0], cmd[1:]...) — i.e. a command string split into an argv and executed, which lets input choo…

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice (cmd[0], cmd[1:]...) — i.e. a command string split into an argv and executed, which lets input choo…

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice (cmd[0], cmd[1:]...) — i.e. a command string split into an argv and executed, which lets input choo…

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice (cmdline[0], cmdline[1:]...) — i.e. a command string split into an argv and executed, which lets in…

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice (cmdline[0], cmdline[1:]...) — i.e. a command string split into an argv and executed, which lets in…

Command injection: exec.Command/exec.CommandContext is invoked with a shell (sh/bash -c) plus an interpolated string, or with argv[0] AND its args spread from the same parsed slice (kitty.DefaultPager[0], kitty.DefaultPager[1:]...) — i.e. a command string split into an argv and e…

subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)

subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)

subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)

subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)

Ensure top-level permissions are not set to write-all on on(CodeQL)

hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)

hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)

hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)

hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)

MD5/SHA1/DES are broken for security use. Use sha256+, and AES over DES. (Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)