← Scan another repo

github.com/opendatalab/MinerU

@ 79d6d8d79fb8

Submitted 8/4/2026, 10:25:56 AM · Status: ok

Risk grade
F
100 / 100
Findings
63
0 critical22 high30 medium11 low0 info0 on CISA KEV0ATT&CK
Showing 63 of 63 findings

Findings

  • os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    os.system() runs a string through the shell — command injection if any part is influenced by input. Use subprocess with an argv list. (Apache-2.0.)
    semgrepmineru/model/vlm/lmdeploy_server.py:90
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/global/Dockerfile:9
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/china/dcu.Dockerfile:6
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/china/Dockerfile:9
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/china/corex.Dockerfile:6
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/china/kxpu.Dockerfile:6
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/china/maca.Dockerfile:9
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/china/mlu.Dockerfile:10
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/china/musa.Dockerfile:6
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/china/npu.Dockerfile:9
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/china/ppu.Dockerfile:9
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/global/Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/china/Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/china/corex.Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/china/dcu.Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/china/gcu.Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/china/kxpu.Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/china/maca.Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/china/mlu.Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/china/musa.Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/china/npu.Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/china/ppu.Dockerfile:0
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/china/dcu.Dockerfile.
    checkovdocker/china/dcu.Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/china/ppu.Dockerfile.
    checkovdocker/china/ppu.Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/china/corex.Dockerfile.
    checkovdocker/china/corex.Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/china/musa.Dockerfile.
    checkovdocker/china/musa.Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/china/gcu.Dockerfile.
    checkovdocker/china/gcu.Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/china/maca.Dockerfile.
    checkovdocker/china/maca.Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/global/Dockerfile.
    checkovdocker/global/Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/china/mlu.Dockerfile.
    checkovdocker/china/mlu.Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/china/npu.Dockerfile.
    checkovdocker/china/npu.Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/china/Dockerfile.
    checkovdocker/china/Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /docker/china/kxpu.Dockerfile.
    checkovdocker/china/kxpu.Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/china/ppu.Dockerfile.
    checkovdocker/china/ppu.Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/china/corex.Dockerfile.
    checkovdocker/china/corex.Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/china/musa.Dockerfile.
    checkovdocker/china/musa.Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/china/gcu.Dockerfile.
    checkovdocker/china/gcu.Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/china/maca.Dockerfile.
    checkovdocker/china/maca.Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/global/Dockerfile.
    checkovdocker/global/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/china/mlu.Dockerfile.
    checkovdocker/china/mlu.Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/china/npu.Dockerfile.
    checkovdocker/china/npu.Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/china/Dockerfile.
    checkovdocker/china/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/china/kxpu.Dockerfile.
    checkovdocker/china/kxpu.Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/china/dcu.Dockerfile.
    checkovdocker/china/dcu.Dockerfile:1
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(check-status)
    checkov.github/workflows/rerun.yml:11
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Publish docs via GitHub Pages)
    checkov.github/workflows/mkdocs.yml:0
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Python package)
    checkov.github/workflows/python-package.yml:0
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepmineru/utils/hash_utils.py:7
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepmineru/utils/hash_utils.py:13
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepmineru/utils/hash_utils.py:30
  • hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)
    semgrepmineru/model/layout/pp_doclayoutv2.py:177
  • 'RUN cd ...' to change directory
    Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.
    trivydocker/china/musa.Dockerfile:17

This report is public.