Skip to content

fix: remediate 29 HIGH/CRITICAL security vulnerabilities - #1

Open
Briggs599 wants to merge 1 commit into
mainfrom
fix/security-1773104065
Open

fix: remediate 29 HIGH/CRITICAL security vulnerabilities#1
Briggs599 wants to merge 1 commit into
mainfrom
fix/security-1773104065

Conversation

@Briggs599

@Briggs599 Briggs599 commented Mar 10, 2026

Copy link
Copy Markdown
Owner

Security Audit: 230 Vulnerabilities Detected, 29 Fixed

Scanners: Semgrep Pro (SAST) + Semgrep Supply Chain (SCA) + Claude deep audit
Triage: Every finding individually verified by Claude against source code

Metric Count
Total verified TPs 230
Fixes applied 29
Code vulnerabilities 229
Dependency vulnerabilities 1

Findings (top 50)

Severity Source File Title
CRITICAL semgrep templates/js/testsuiteutils.js:151 javascript.browser.security.insecure-document-method.insecur
CRITICAL semgrep testcode/BenchmarkTest00001.py:47 python.flask.file.tainted-path-traversal-stdlib-flask.tainte
CRITICAL semgrep testcode/BenchmarkTest00003.py:50 python.flask.file.tainted-path-traversal-stdlib-flask.tainte
CRITICAL semgrep testcode/BenchmarkTest00013.py:55 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00006.py:60 python.flask.file.tainted-path-traversal-stdlib-flask.tainte
CRITICAL semgrep testcode/BenchmarkTest00005.py:60 python.flask.file.tainted-path-traversal-stdlib-flask.tainte
CRITICAL semgrep testcode/BenchmarkTest00014.py:56 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00015.py:56 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00016.py:58 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00075.py:53 python.flask.code.tainted-code-stdlib-flask.tainted-code-std
CRITICAL semgrep testcode/BenchmarkTest00018.py:50 python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lx
CRITICAL semgrep testcode/BenchmarkTest00019.py:54 python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lx
CRITICAL semgrep testcode/BenchmarkTest00085.py:45 python.flask.file.tainted-path-traversal-stdlib-flask.tainte
CRITICAL semgrep testcode/BenchmarkTest00078.py:53 python.flask.security.insecure-deserialization.insecure-dese
CRITICAL semgrep testcode/BenchmarkTest00086.py:52 python.flask.file.tainted-path-traversal-stdlib-flask.tainte
CRITICAL semgrep testcode/BenchmarkTest00095.py:43 python.flask.file.tainted-path-traversal-stdlib-flask.tainte
CRITICAL semgrep testcode/BenchmarkTest00099.py:49 python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqla
CRITICAL semgrep testcode/BenchmarkTest00105.py:49 python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lx
CRITICAL semgrep testcode/BenchmarkTest00156.py:43 python.flask.code.tainted-code-stdlib-flask.tainted-code-std
CRITICAL semgrep testcode/BenchmarkTest00106.py:46 python.flask.xml.tainted-flask-xml-lxml.tainted-flask-xml-lx
CRITICAL semgrep testcode/BenchmarkTest00159.py:45 python.flask.code.tainted-code-stdlib-flask.tainted-code-std
CRITICAL semgrep testcode/BenchmarkTest00161.py:40 python.flask.code.tainted-code-stdlib-flask.tainted-code-std
CRITICAL semgrep testcode/BenchmarkTest00163.py:47 python.flask.code.tainted-code-stdlib-flask.tainted-code-std
CRITICAL semgrep testcode/BenchmarkTest00164.py:47 python.flask.security.insecure-deserialization.insecure-dese
CRITICAL semgrep testcode/BenchmarkTest00166.py:53 python.flask.security.injection.subprocess-injection.subproc
CRITICAL semgrep testcode/BenchmarkTest00166.py:53 python.flask.os.tainted-os-command-stdlib-flask-secure-defau
CRITICAL semgrep testcode/BenchmarkTest00166.py:53 python.lang.security.dangerous-subprocess-use.dangerous-subp
CRITICAL semgrep testcode/BenchmarkTest00166.py:53 python.lang.security.audit.subprocess-shell-true.subprocess-
CRITICAL semgrep testcode/BenchmarkTest00167.py:53 python.flask.security.injection.subprocess-injection.subproc
CRITICAL semgrep testcode/BenchmarkTest00167.py:53 python.flask.os.tainted-os-command-stdlib-flask-secure-defau
CRITICAL semgrep testcode/BenchmarkTest00167.py:53 python.lang.security.dangerous-subprocess-use.dangerous-subp
CRITICAL semgrep testcode/BenchmarkTest00167.py:53 python.lang.security.audit.subprocess-shell-true.subprocess-
CRITICAL semgrep testcode/BenchmarkTest00171.py:46 python.flask.file.tainted-path-traversal-stdlib-flask.tainte
CRITICAL semgrep testcode/BenchmarkTest00174.py:50 python.flask.file.tainted-path-traversal-stdlib-flask.tainte
CRITICAL semgrep testcode/BenchmarkTest00177.py:45 python.flask.file.tainted-path-traversal-stdlib-flask.tainte
CRITICAL semgrep testcode/BenchmarkTest00193.py:49 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00194.py:48 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00195.py:50 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00197.py:46 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00198.py:45 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00199.py:43 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00201.py:46 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00200.py:45 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00202.py:45 python.lang.security.use-defused-xml-parse.use-defused-xml-p
CRITICAL semgrep testcode/BenchmarkTest00264.py:44 python.flask.code.tainted-code-stdlib-flask.tainted-code-std
CRITICAL semgrep testcode/BenchmarkTest00269.py:44 python.flask.security.insecure-deserialization.insecure-dese
CRITICAL semgrep testcode/BenchmarkTest00269.py:44 python.lang.security.deserialization.avoid-pyyaml-load.avoid
CRITICAL semgrep testcode/BenchmarkTest00269.py:44 python.flask.deserialization.tainted-pyyaml-flask.tainted-py
CRITICAL semgrep testcode/BenchmarkTest00270.py:41 python.flask.security.insecure-deserialization.insecure-dese
CRITICAL semgrep testcode/BenchmarkTest00270.py:41 python.lang.security.deserialization.avoid-pyyaml-load.avoid

...and 180 more findings (see workflow logs for full list)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Briggs599