← Scan another repo

github.com/open-mmlab/mmdetection

@ cfd5d3a985b0

Submitted 8/4/2026, 10:28:02 AM · Status: ok

Risk grade
F
100 / 100
Findings
22
0 critical12 high6 medium4 low0 info0 on CISA KEV0ATT&CK
Showing 22 of 22 findings

Findings

  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrep.dev_scripts/convert_test_benchmark_script.py:110
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrep.dev_scripts/convert_train_benchmark_script.py:100
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrep.dev_scripts/download_checkpoints.py:27
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgreptools/dataset_converters/grit_processing.py:83
  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgreptools/dataset_converters/grit_processing.py:97
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepmmdet/evaluation/metrics/base_video_metric.py:171
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepmmdet/utils/dist_utils.py:76
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepprojects/Detic_new/detic/imagenet_lvis.py:281
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivy.circleci/docker/Dockerfile:11
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile:25
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivy.circleci/docker/Dockerfile:0
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/Dockerfile.
    checkovdocker/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/serve_cn/Dockerfile.
    checkovdocker/serve_cn/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/Dockerfile.
    checkovdocker/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/serve/Dockerfile.
    checkovdocker/serve/Dockerfile:1
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(deploy)
    checkov.github/workflows/deploy.yml:0
  • 'RUN cd ...' to change directory
    Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.
    trivydocker/Dockerfile:35
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivydocker/serve/Dockerfile:0
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivydocker/serve_cn/Dockerfile:0
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivydocker/Dockerfile:0
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivy.circleci/docker/Dockerfile:0

This report is public.