rules: - id: ruby.lang.security.dangerous-exec.dangerous-exec mode: taint pattern-sources: - patterns: - pattern: | def $F(...,$ARG,...) ... end - focus-metavariable: $ARG - pattern: params - pattern: cookies pattern-sinks: - patterns: - pattern: | $EXEC(...) - pattern-not: | $EXEC("...","...","...",...) - pattern-not: | $EXEC(["...","...","...",...],...) - pattern-not: | $EXEC({...},"...","...","...",...) - pattern-not: | $EXEC({...},["...","...","...",...],...) - metavariable-regex: metavariable: $EXEC regex: ^(system|exec|spawn|Process.exec|Process.spawn|Open3.capture2|Open3.capture2e|Open3.capture3|Open3.popen2|Open3.popen2e|Open3.popen3|IO.popen|Gem::Util.popen|PTY.spawn)$ message: Detected non-static command inside $EXEC. Audit the input to '$EXEC'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. metadata: source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_execute.rb cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection category: security technology: - ruby - rails references: - https://guides.rubyonrails.org/security.html#command-line-injection cwe2022-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/ruby.lang.security.dangerous-exec.dangerous-exec shortlink: https://sg.run/R8GY semgrep.dev: rule: r_id: 9805 rv_id: 1409405 rule_id: WAUZOw version_id: WrT7erb url: https://semgrep.dev/playground/r/WrT7erb/ruby.lang.security.dangerous-exec.dangerous-exec origin: community path: ruby.lang.security.dangerous-exec.dangerous-exec severity: WARNING languages: - ruby - id: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly metadata: cwe: - 'CWE-1004: Sensitive Cookie Without ''HttpOnly'' Flag' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTPONLY_COOKIE asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.4.2 Missing Cookie Attribute control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management version: '4' category: security technology: - java references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cookie Security source: https://semgrep.dev/r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly shortlink: https://sg.run/b7Be semgrep.dev: rule: r_id: 9170 rv_id: 1262993 rule_id: EwU2z6 version_id: 5PTo17r url: https://semgrep.dev/playground/r/5PTo17r/java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly origin: community path: java.lang.security.audit.cookie-missing-httponly.cookie-missing-httponly message: A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);' severity: WARNING languages: - java patterns: - pattern-not-inside: $COOKIE.setValue(""); ... - pattern-either: - pattern: $COOKIE.setHttpOnly(false); - patterns: - pattern-not-inside: $COOKIE.setHttpOnly(...); ... - pattern-not-inside: $COOKIE = ResponseCookie.from(...). ...; ... - pattern: $RESPONSE.addCookie($COOKIE); - id: go.lang.security.audit.database.string-formatted-query.string-formatted-query languages: - go message: String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. severity: WARNING metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' source-rule-url: https://github.com/securego/gosec category: security technology: - go confidence: LOW references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/go.lang.security.audit.database.string-formatted-query.string-formatted-query shortlink: https://sg.run/ydEr semgrep.dev: rule: r_id: 9124 rv_id: 1262937 rule_id: ZqU5bD version_id: ZRTKA2q url: https://semgrep.dev/playground/r/ZRTKA2q/go.lang.security.audit.database.string-formatted-query.string-formatted-query origin: community path: go.lang.security.audit.database.string-formatted-query.string-formatted-query patterns: - metavariable-regex: metavariable: $OBJ regex: (?i).*(db|database) - pattern-not-inside: | $VAR = "..." + "..." ... $OBJ.$SINK(..., $VAR, ...) - pattern-not: $OBJ.Exec("...") - pattern-not: $OBJ.ExecContext($CTX, "...") - pattern-not: $OBJ.Query("...") - pattern-not: $OBJ.QueryContext($CTX, "...") - pattern-not: $OBJ.QueryRow("...") - pattern-not: $OBJ.QueryRow($CTX, "...") - pattern-not: $OBJ.QueryRowContext($CTX, "...") - pattern-either: - pattern: $OBJ.Exec($X + ...) - pattern: $OBJ.ExecContext($CTX, $X + ...) - pattern: $OBJ.Query($X + ...) - pattern: $OBJ.QueryContext($CTX, $X + ...) - pattern: $OBJ.QueryRow($X + ...) - pattern: $OBJ.QueryRow($CTX, $X + ...) - pattern: $OBJ.QueryRowContext($CTX, $X + ...) - pattern: $OBJ.Exec(fmt.$P("...", ...)) - pattern: $OBJ.ExecContext($CTX, fmt.$P("...", ...)) - pattern: $OBJ.Query(fmt.$P("...", ...)) - pattern: $OBJ.QueryContext($CTX, fmt.$P("...", ...)) - pattern: $OBJ.QueryRow(fmt.$P("...", ...)) - pattern: $OBJ.QueryRow($CTX, fmt.$U("...", ...)) - pattern: $OBJ.QueryRowContext($CTX, fmt.$P("...", ...)) - patterns: - pattern-either: - pattern: $QUERY = fmt.Fprintf($F, "$SQLSTR", ...) - pattern: $QUERY = fmt.Sprintf("$SQLSTR", ...) - pattern: $QUERY = fmt.Printf("$SQLSTR", ...) - pattern: $QUERY = $X + ... - pattern-either: - pattern-inside: | func $FUNC(...) { ... $OBJ.Query($QUERY, ...) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.ExecContext($CTX, $QUERY, ...) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.Exec($QUERY, ...) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.QueryRow($CTX, $QUERY) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.QueryRow($QUERY) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.QueryContext($CTX, $QUERY) ... } - pattern-inside: | func $FUNC(...) { ... $OBJ.QueryRowContext($CTX, $QUERY, ...) ... } - id: java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'. languages: - java severity: WARNING patterns: - pattern-either: - patterns: - pattern-either: - pattern-inside: | String $SQL = $X + $Y; ... - pattern-inside: | String $SQL = String.format(...); ... - pattern-inside: | $VAL $FUNC(...,String $SQL,...) { ... } - pattern-not-inside: | String $SQL = "..." + "..."; ... - pattern: $S.$METHOD($SQL,...) - pattern: | $S.$METHOD(String.format(...),...); - pattern: | $S.$METHOD($X + $Y,...); - pattern-either: - pattern-inside: | java.sql.Statement $S = ...; ... - pattern-inside: | $TYPE $FUNC(...,java.sql.Statement $S,...) { ... } - pattern-not: | $S.$METHOD("..." + "...",...); - metavariable-regex: metavariable: $METHOD regex: ^(executeQuery|execute|executeUpdate|executeLargeUpdate|addBatch|nativeSQL)$ metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' category: security technology: - jdbc owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli shortlink: https://sg.run/AvkL semgrep.dev: rule: r_id: 9206 rv_id: 1263036 rule_id: oqUe8K version_id: vdT06oL url: https://semgrep.dev/playground/r/vdT06oL/java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli origin: community path: java.lang.security.audit.sqli.jdbc-sqli.jdbc-sqli - id: java.lang.security.audit.crypto.weak-random.weak-random message: Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not cryptographically strong random number generators (RNGs). If you are using these RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead. languages: - java severity: WARNING metadata: functional-categories: - crypto::search::randomness::java.security owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-330: Use of Insufficiently Random Values' category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.weak-random.weak-random shortlink: https://sg.run/NwBp semgrep.dev: rule: r_id: 17327 rv_id: 1263018 rule_id: lBUW5D version_id: 6xT29RK url: https://semgrep.dev/playground/r/6xT29RK/java.lang.security.audit.crypto.weak-random.weak-random origin: community path: java.lang.security.audit.crypto.weak-random.weak-random pattern-either: - pattern: | new java.util.Random(...).$FUNC(...) - pattern: | java.lang.Math.random(...) - id: javascript.lang.security.detect-child-process.detect-child-process message: 'Detected calls to child_process from a function argument `$FUNC`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. ' metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-child-process.js category: security technology: - javascript cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/javascript.lang.security.detect-child-process.detect-child-process shortlink: https://sg.run/l2lo semgrep.dev: rule: r_id: 9313 rv_id: 1409399 rule_id: 10UKNB version_id: 5PT7KnG url: https://semgrep.dev/playground/r/5PT7KnG/javascript.lang.security.detect-child-process.detect-child-process origin: community path: javascript.lang.security.detect-child-process.detect-child-process languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-inside: | function ... (...,$FUNC,...) { ... } - focus-metavariable: $FUNC pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $CP = require('child_process') ... - pattern-inside: | import * as $CP from 'child_process' ... - pattern-inside: | import $CP from 'child_process' ... - pattern-either: - pattern: $CP.exec($CMD,...) - pattern: $CP.execSync($CMD,...) - pattern: $CP.spawn($CMD,...) - pattern: $CP.spawnSync($CMD,...) - pattern-not-inside: $CP.$EXEC("...",...) - pattern-not-inside: $CP.$EXEC(["...",...],...) - pattern-not-inside: | $CMD = "..." ... - pattern-not-inside: | $CMD = ["...",...] ... - focus-metavariable: $CMD - patterns: - pattern-either: - pattern: child_process.exec($CMD,...) - pattern: child_process.execSync($CMD,...) - pattern: child_process.spawn($CMD,...) - pattern: child_process.spawnSync($CMD,...) - pattern-not-inside: child_process.$EXEC("...",...) - pattern-not-inside: child_process.$EXEC(["...",...],...) - pattern-not-inside: | $CMD = "..." ... - pattern-not-inside: | $CMD = ["...",...] ... - focus-metavariable: $CMD - id: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal metadata: cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://find-sec-bugs.github.io/bugs.htm#PATH_TRAVERSAL_IN references: - https://www.owasp.org/index.php/Path_Traversal category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal shortlink: https://sg.run/oxXN semgrep.dev: rule: r_id: 9160 rv_id: 1263064 rule_id: NbUk7X version_id: zyTb2rq url: https://semgrep.dev/playground/r/zyTb2rq/java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal origin: community path: java.lang.security.httpservlet-path-traversal.httpservlet-path-traversal message: Detected a potential path traversal. A malicious actor could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path. mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | (HttpServletRequest $REQ) - patterns: - pattern-inside: | (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...); ... for (javax.servlet.http.Cookie $COOKIE: $COOKIES) { ... } - pattern: | $COOKIE.getValue(...) - patterns: - pattern-inside: | $TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(...); ... - pattern: | $PARAM = $VALS[$INDEX]; pattern-sanitizers: - pattern: org.apache.commons.io.FilenameUtils.getName(...) pattern-sinks: - patterns: - pattern-either: - pattern: | (java.io.File $FILE) = ... - pattern: | (java.io.FileOutputStream $FOS) = ... - pattern: | new java.io.FileInputStream(...) severity: ERROR languages: - java - id: javascript.express.security.audit.xss.direct-response-write.direct-response-write message: Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML. options: interfile: true metadata: interfile: true references: - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' category: security technology: - express cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM vulnerability_class: - Cross-Site-Scripting (XSS) license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write shortlink: https://sg.run/vzGl semgrep.dev: rule: r_id: 9277 rv_id: 1263150 rule_id: 3qUPA1 version_id: JdTzxeg url: https://semgrep.dev/playground/r/JdTzxeg/javascript.express.security.audit.xss.direct-response-write.direct-response-write origin: community path: javascript.express.security.audit.xss.direct-response-write.direct-response-write languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options) - pattern-not-inside: | function ... ($REQ, $RES) { ... $RES.$SET('Content-Type', '$TYPE') } - pattern-not-inside: | $APP.$METHOD(..., function $FUNC($REQ, $RES) { ... $RES.$SET('Content-Type', '$TYPE') }) - pattern-not-inside: | function ... ($REQ, $RES, $NEXT) { ... $RES.$SET('Content-Type', '$TYPE') } - pattern-not-inside: | function ... ($REQ, $RES) { ... $RES.set('$TYPE') } - pattern-not-inside: | $APP.$METHOD(..., function $FUNC($REQ, $RES) { ... $RES.set('$TYPE') }) - pattern-not-inside: | function ... ($REQ, $RES, $NEXT) { ... $RES.set('$TYPE') } - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - pattern-not-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => { ... $RES.$SET('Content-Type', '$TYPE') } - pattern-not-inside: | ({ $REQ }: Request,$RES: Response) => { ... $RES.$SET('Content-Type', '$TYPE') } - pattern-not-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => { ... $RES.set('$TYPE') } - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: body pattern-sinks: - patterns: - pattern-inside: function ... (..., $RES,...) {...} - pattern-either: - pattern: $RES.write($ARG) - pattern: $RES.send($ARG) - pattern-not: $RES. ... .set('...'). ... .send($ARG) - pattern-not: $RES. ... .type('...'). ... .send($ARG) - pattern-not-inside: $RES.$METHOD({ ... }) - focus-metavariable: $ARG pattern-sanitizers: - patterns: - pattern-either: - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | import * as $S from "underscore.string" ... - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | $S = require("underscore.string") ... - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - pattern-inside: | import $S from "dompurify" ... - pattern-inside: | import { ..., $S,... } from "dompurify" ... - pattern-inside: | import * as $S from "dompurify" ... - pattern-inside: | $S = require("dompurify") ... - pattern-inside: | import $S from "isomorphic-dompurify" ... - pattern-inside: | import * as $S from "isomorphic-dompurify" ... - pattern-inside: | $S = require("isomorphic-dompurify") ... - pattern-either: - patterns: - pattern-inside: | $VALUE = $S(...) ... - pattern: $VALUE.sanitize(...) - patterns: - pattern-inside: | $VALUE = $S.sanitize ... - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'xss'; ... - pattern-inside: | import * as $S from 'xss'; ... - pattern-inside: | $S = require("xss") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'sanitize-html'; ... - pattern-inside: | import * as $S from "sanitize-html"; ... - pattern-inside: | $S = require("sanitize-html") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | $S = new Remarkable() ... - pattern: $S.render(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'express-xss-sanitizer'; ... - pattern-inside: | import * as $S from "express-xss-sanitizer"; ... - pattern-inside: | const { ..., $S, ... } = require('express-xss-sanitizer'); ... - pattern-inside: | var { ..., $S, ... } = require('express-xss-sanitizer'); ... - pattern-inside: | let { ...,$S,... } = require('express-xss-sanitizer'); ... - pattern-inside: | $S = require("express-xss-sanitizer") ... - pattern: $S(...) - patterns: - pattern: $RES. ... .type('$F'). ... .send(...) - metavariable-regex: metavariable: $F regex: (?!.*text/html) - patterns: - pattern-inside: | $X = [...]; ... - pattern: | if(<... !$X.includes($SOURCE)...>) { ... return ... } ... - pattern: $SOURCE - id: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command patterns: - pattern-either: - patterns: - pattern-either: - pattern: | exec.Command($CMD,...) - pattern: | exec.CommandContext($CTX,$CMD,...) - pattern-not: | exec.Command("...",...) - pattern-not: | exec.CommandContext($CTX,"...",...) - patterns: - pattern-either: - pattern: | exec.Command("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...) - pattern: | exec.CommandContext($CTX,"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...) - pattern-not: | exec.Command("...","...","...",...) - pattern-not: | exec.CommandContext($CTX,"...","...","...",...) - pattern-either: - pattern: | exec.Command("=~/\/bin\/env/","=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...) - pattern: | exec.CommandContext($CTX,"=~/\/bin\/env/","=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$CMD,...) - pattern-inside: | import "os/exec" ... - pattern-not-inside: | $CMD,$ERR := exec.LookPath("..."); ... - pattern-not-inside: | $CMD = "..."; ... message: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection category: security technology: - go confidence: LOW references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command shortlink: https://sg.run/W8lA semgrep.dev: rule: r_id: 9109 rv_id: 1262935 rule_id: X5U8RQ version_id: vdT06Xp url: https://semgrep.dev/playground/r/vdT06Xp/go.lang.security.audit.dangerous-exec-command.dangerous-exec-command origin: community path: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command severity: ERROR languages: - go - id: csharp.lang.security.sqli.csharp-sqli.csharp-sqli mode: taint pattern-sources: - patterns: - pattern: | (string $X) - pattern-not: | "..." pattern-propagators: - pattern: (StringBuilder $B).$ANY(...,(string $X),...) from: $X to: $B pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: | new $PATTERN($CMD,...) - focus-metavariable: $CMD - patterns: - pattern: | $CMD.$PATTERN = $VALUE; - focus-metavariable: $VALUE - metavariable-regex: metavariable: $PATTERN regex: ^(SqlCommand|CommandText|OleDbCommand|OdbcCommand|OracleCommand)$ pattern-sanitizers: - pattern-either: - pattern: | $CMD.Parameters.Add(...) - pattern: | $CMD.Parameters.AddRange(...) - pattern: | $CMD.Parameters.AddWithValue(...) - pattern: | $CMD.Parameters[$IDX].Value = ... by-side-effect: true message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. metadata: category: security technology: - csharp owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli shortlink: https://sg.run/d2Xd semgrep.dev: rule: r_id: 15078 rv_id: 1262648 rule_id: x8UxeP version_id: RGT0LqW url: https://semgrep.dev/playground/r/RGT0LqW/csharp.lang.security.sqli.csharp-sqli.csharp-sqli origin: community path: csharp.lang.security.sqli.csharp-sqli.csharp-sqli languages: - csharp severity: ERROR - id: ruby.lang.security.dangerous-subshell.dangerous-subshell patterns: - pattern: | `...#{$VAL}...` - pattern-not: | `...#{"..."}...` - pattern-not-inside: | $VAL = "..." ... message: Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection category: security technology: - ruby references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/ruby.lang.security.dangerous-subshell.dangerous-subshell shortlink: https://sg.run/NrxL semgrep.dev: rule: r_id: 9827 rv_id: 1263601 rule_id: OrUGn8 version_id: RGT0LJK url: https://semgrep.dev/playground/r/RGT0LJK/ruby.lang.security.dangerous-subshell.dangerous-subshell origin: community path: ruby.lang.security.dangerous-subshell.dangerous-subshell severity: WARNING languages: - ruby - id: php.lang.security.exec-use.exec-use patterns: - pattern: $FUNC(...); - pattern-not: $FUNC('...', ...); - metavariable-regex: metavariable: $FUNC regex: (?i)exec|passthru|proc_open|popen|shell_exec|system|pcntl_exec message: Executing non-constant commands. This can lead to command injection. metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' references: - https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/SystemExecFunctionsSniff.php category: security technology: - php owasp: - A03:2021 - Injection - A05:2025 - Injection cwe2022-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/php.lang.security.exec-use.exec-use shortlink: https://sg.run/5Q1j semgrep.dev: rule: r_id: 9391 rv_id: 1565375 rule_id: qNUjye version_id: ZRTWDRb url: https://semgrep.dev/playground/r/ZRTWDRb/php.lang.security.exec-use.exec-use origin: community path: php.lang.security.exec-use.exec-use languages: - php severity: ERROR - id: java.lang.security.audit.crypto.use-of-md5.use-of-md5 message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead. languages: - java severity: WARNING metadata: functional-categories: - crypto::search::hash-algorithm::java.security owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-328: Use of Weak Hash' source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Insecure Hashing Algorithm source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5.use-of-md5 shortlink: https://sg.run/ryJn semgrep.dev: rule: r_id: 17325 rv_id: 1263013 rule_id: KxU5lW version_id: 0bTKzGX url: https://semgrep.dev/playground/r/0bTKzGX/java.lang.security.audit.crypto.use-of-md5.use-of-md5 origin: community path: java.lang.security.audit.crypto.use-of-md5.use-of-md5 patterns: - pattern: | java.security.MessageDigest.getInstance($ALGO, ...); - metavariable-regex: metavariable: $ALGO regex: (?i)(.MD5.) - focus-metavariable: $ALGO fix: | "SHA-512" - id: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion message: '`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13'' to the TLS configuration to bump the minimum version to TLS 1.3.' metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go references: - https://go.dev/doc/go1.22#minor_library_changes - https://pkg.go.dev/crypto/tls#:~:text=MinVersion - https://www.us-cert.gov/ncas/alerts/TA14-290A category: security technology: - go confidence: HIGH subcategory: - audit likelihood: MEDIUM impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion shortlink: https://sg.run/oxEN semgrep.dev: rule: r_id: 9116 rv_id: 1262924 rule_id: NbUk4X version_id: 1QTypyp url: https://semgrep.dev/playground/r/1QTypyp/go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion origin: community path: go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion languages: - go severity: WARNING patterns: - pattern: | tls.Config{ $...CONF } - pattern-not: | tls.Config{..., MinVersion: ..., ...} fix: | tls.Config{ $...CONF, MinVersion: tls.VersionTLS13 } - id: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag metadata: cwe: - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_COOKIE asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.4.1 Missing Cookie Attribute control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management version: '4' category: security technology: - java references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cookie Security source: https://semgrep.dev/r/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag shortlink: https://sg.run/kXoK semgrep.dev: rule: r_id: 9172 rv_id: 1262994 rule_id: L1Uyvp version_id: GxTkelB url: https://semgrep.dev/playground/r/GxTkelB/java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag origin: community path: java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag message: A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);' severity: WARNING languages: - java patterns: - pattern-not-inside: $COOKIE.setValue(""); ... - pattern-either: - pattern: $COOKIE.setSecure(false); - patterns: - pattern-not-inside: $COOKIE.setSecure(...); ... - pattern-not-inside: $COOKIE = ResponseCookie.from(...). ...; ... - pattern: $RESPONSE.addCookie($COOKIE); - id: python.lang.security.audit.eval-detected.eval-detected patterns: - pattern-not: eval(f"") - pattern-not: eval("...") - pattern: eval(...) message: Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. metadata: source-rule-url: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b307-eval cwe: - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.2.4 Dyanmic Code Execution Features control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements version: '4' category: security technology: - python references: - https://owasp.org/Top10/A03_2021-Injection subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/python.lang.security.audit.eval-detected.eval-detected shortlink: https://sg.run/ZvrD semgrep.dev: rule: r_id: 9635 rv_id: 1263477 rule_id: gxU149 version_id: bZT537Q url: https://semgrep.dev/playground/r/bZT537Q/python.lang.security.audit.eval-detected.eval-detected origin: community path: python.lang.security.audit.eval-detected.eval-detected languages: - python severity: WARNING - id: python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query message: 'Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.' metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql - https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column category: security technology: - sqlalchemy cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query shortlink: https://sg.run/2b1L semgrep.dev: rule: r_id: 10563 rv_id: 1263578 rule_id: oqUz5y version_id: bZT53rp url: https://semgrep.dev/playground/r/bZT53rp/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query origin: community path: python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query severity: ERROR languages: - python pattern-either: - pattern: | $CONNECTION.execute( $SQL + ..., ... ) - pattern: | $CONNECTION.execute( $SQL % (...), ...) - pattern: | $CONNECTION.execute( $SQL.format(...), ... ) - pattern: | $CONNECTION.execute(f"...{...}...", ...) - patterns: - pattern-inside: | $QUERY = $SQL + ... ... - pattern: | $CONNECTION.execute($QUERY, ...) - patterns: - pattern-inside: | $QUERY = $SQL % (...) ... - pattern: | $CONNECTION.execute($QUERY, ...) - patterns: - pattern-inside: | $QUERY = $SQL.format(...) ... - pattern: | $CONNECTION.execute($QUERY, ...) - patterns: - pattern-inside: | $QUERY = f"...{...}..." ... - pattern: | $CONNECTION.execute($QUERY, ...) - id: php.lang.security.eval-use.eval-use patterns: - pattern: eval(...); - pattern-not: eval('...'); message: Evaluating non-constant commands. This can lead to command injection. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' references: - https://www.php.net/manual/en/function.eval - https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/NoEvalsSniff.php category: security technology: - php owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/php.lang.security.eval-use.eval-use shortlink: https://sg.run/J9AP semgrep.dev: rule: r_id: 9390 rv_id: 1263279 rule_id: KxUbX3 version_id: xyTjz1X url: https://semgrep.dev/playground/r/xyTjz1X/php.lang.security.eval-use.eval-use origin: community path: php.lang.security.eval-use.eval-use languages: - php severity: ERROR - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. languages: - go severity: WARNING metadata: owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-328: Use of Weak Hash' source-rule-url: https://github.com/securego/gosec#available-rules category: security technology: - go confidence: MEDIUM references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Insecure Hashing Algorithm source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 shortlink: https://sg.run/2xB5 semgrep.dev: rule: r_id: 9119 rv_id: 1262928 rule_id: x8Un6q version_id: bZT535Y url: https://semgrep.dev/playground/r/bZT535Y/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 origin: community path: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5 patterns: - pattern-inside: | import "crypto/md5" ... - pattern-either: - pattern: | md5.New() - pattern: | md5.Sum(...) - id: javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli message: Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. metadata: references: - https://www.npmjs.com/package/mysql2 - https://www.npmjs.com/package/mysql - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' confidence: LOW technology: - mysql - mysql2 - javascript - nodejs cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli shortlink: https://sg.run/Y0oy semgrep.dev: rule: r_id: 18258 rv_id: 1263207 rule_id: ZqUlWE version_id: JdTzx2D url: https://semgrep.dev/playground/r/JdTzx2D/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli origin: community path: javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-inside: function ... (..., $Y,...) {...} - pattern: $Y - pattern-not-inside: | function ... (..., $Y: number,...) {...} - pattern-not-inside: $Y.query - pattern-not-inside: $Y.body - pattern-not-inside: $Y.params - pattern-not-inside: $Y.cookies - pattern-not-inside: $Y.headers pattern-sinks: - patterns: - focus-metavariable: $QUERY - pattern-either: - pattern-inside: $POOL.query($QUERY, ...) - pattern-inside: $POOL.execute($QUERY, ...) - pattern-either: - pattern-inside: | import $S from "$IMPORT" ... - pattern-inside: | import { ... } from "$IMPORT" ... - pattern-inside: | import * as $S from "$IMPORT" ... - pattern-inside: | require("$IMPORT") ... - metavariable-regex: metavariable: $IMPORT regex: (mysql|mysql2) pattern-sanitizers: - patterns: - pattern: parseInt(...) - id: go.lang.security.audit.sqli.gosql-sqli.gosql-sqli patterns: - pattern-either: - patterns: - pattern: $DB.$METHOD(...,$QUERY,...) - pattern-either: - pattern-inside: | $QUERY = $X + $Y ... - pattern-inside: | $QUERY += $X ... - pattern-inside: | $QUERY = fmt.Sprintf("...", $PARAM1, ...) ... - pattern-not-inside: | $QUERY += "..." ... - pattern-not-inside: | $QUERY = "..." + "..." ... - pattern: $DB.$METHOD(..., $X + $Y, ...) - pattern: $DB.$METHOD(..., fmt.Sprintf("...", $PARAM1, ...), ...) - pattern-either: - pattern-inside: | $DB, ... = sql.Open(...) ... - pattern-inside: | func $FUNCNAME(..., $DB *sql.DB, ...) { ... } - pattern-not: $DB.$METHOD(..., "..." + "...", ...) - metavariable-regex: metavariable: $METHOD regex: ^(Exec|ExecContent|Query|QueryContext|QueryRow|QueryRowContext)$ languages: - go message: Detected string concatenation with a non-literal variable in a "database/sql" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use prepared statements with the 'Prepare' and 'PrepareContext' calls. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' references: - https://golang.org/pkg/database/sql/ category: security technology: - go confidence: LOW owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli shortlink: https://sg.run/YgOX semgrep.dev: rule: r_id: 10258 rv_id: 1262951 rule_id: YGUrnQ version_id: RGT0Lpr url: https://semgrep.dev/playground/r/RGT0Lpr/go.lang.security.audit.sqli.gosql-sqli.gosql-sqli origin: community path: go.lang.security.audit.sqli.gosql-sqli.gosql-sqli severity: ERROR - id: javascript.browser.security.eval-detected.eval-detected message: Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. metadata: cwe: - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.2.4 Dynamic Code Execution Features control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing version: '4' category: security technology: - browser subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW references: - https://owasp.org/Top10/A03_2021-Injection license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected shortlink: https://sg.run/7ope semgrep.dev: rule: r_id: 9238 rv_id: 1263117 rule_id: GdU7dw version_id: l4TJR2y url: https://semgrep.dev/playground/r/l4TJR2y/javascript.browser.security.eval-detected.eval-detected origin: community path: javascript.browser.security.eval-detected.eval-detected languages: - javascript - typescript severity: WARNING patterns: - pattern-not: eval("...") - pattern: eval(...) - id: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect message: Application redirects to a destination URL specified by a user-supplied parameter that is not validated. This could direct users to malicious locations. Consider using an allowlist to validate URLs. metadata: cwe: - 'CWE-601: URL Redirection to Untrusted Site (''Open Redirect'')' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://find-sec-bugs.github.io/bugs.htm#UNVALIDATED_REDIRECT asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.1.5 Open Redirect control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v51-input-validation-requirements version: '4' category: security technology: - java references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control subcategory: - vuln impact: LOW likelihood: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Open Redirect source: https://semgrep.dev/r/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect shortlink: https://sg.run/Q51P semgrep.dev: rule: r_id: 9186 rv_id: 1263048 rule_id: WAUo0p version_id: PkTR329 url: https://semgrep.dev/playground/r/PkTR329/java.lang.security.audit.unvalidated-redirect.unvalidated-redirect origin: community path: java.lang.security.audit.unvalidated-redirect.unvalidated-redirect severity: WARNING languages: - java pattern-either: - pattern: | $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) { ... $RES.sendRedirect($URL); ... } - pattern: | $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) { ... $RES.sendRedirect($URL); ... } - pattern: | $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) { ... String $URL = $REQ.getParameter(...); ... $RES.sendRedirect($URL); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) { ... String $URL = $REQ.getParameter(...); ... $RES.sendRedirect($URL); ... } - pattern: | $X $METHOD(...,String $URL,...) { ... HttpServletResponse $RES = ...; ... $RES.sendRedirect($URL); ... } - pattern: | $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) { ... $RES.sendRedirect($REQ.getParameter(...)); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) { ... $RES.sendRedirect($REQ.getParameter(...)); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...,String $URL,...) { ... $RES.addHeader("Location",$URL); ... } - pattern: | $X $METHOD(...,String $URL,...,HttpServletResponse $RES,...) { ... $RES.addHeader("Location",$URL); ... } - pattern: | $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) { ... String $URL = $REQ.getParameter(...); ... $RES.addHeader("Location",$URL); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) { ... String $URL = $REQ.getParameter(...); ... $RES.addHeader("Location",$URL); ... } - pattern: | $X $METHOD(...,String $URL,...) { ... HttpServletResponse $RES = ...; ... $RES.addHeader("Location",$URL); ... } - pattern: | $X $METHOD(...,HttpServletRequest $REQ,...,HttpServletResponse $RES,...) { ... $RES.addHeader("Location",$REQ.getParameter(...)); ... } - pattern: |- $X $METHOD(...,HttpServletResponse $RES,...,HttpServletRequest $REQ,...) { ... $RES.addHeader("Location",$REQ.getParameter(...)); ... } - id: python.lang.security.audit.formatted-sql-query.formatted-sql-query message: Detected possible formatted SQL query. Use parameterized queries instead. metadata: owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' references: - https://stackoverflow.com/questions/775296/mysql-parameterized-queries category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query shortlink: https://sg.run/EkWw semgrep.dev: rule: r_id: 9637 rv_id: 1263479 rule_id: 3qUP9k version_id: kbTzGBe url: https://semgrep.dev/playground/r/kbTzGBe/python.lang.security.audit.formatted-sql-query.formatted-sql-query origin: community path: python.lang.security.audit.formatted-sql-query.formatted-sql-query severity: WARNING languages: - python pattern-either: - pattern: $DB.execute("..." % ...) - pattern: $DB.execute("...".format(...)) - pattern: $DB.execute(f"...") - patterns: - pattern-either: - pattern-inside: | $SQL = "..." % ... ... - pattern-inside: | $SQL = "...".format(...) ... - pattern-inside: | $SQL = f"...{$X}..." ... - pattern: $DB.execute($SQL) - id: go.lang.security.audit.crypto.math_random.math-random-used metadata: cwe: - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation category: security technology: - go confidence: MEDIUM subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.math_random.math-random-used shortlink: https://sg.run/6nK6 semgrep.dev: rule: r_id: 9115 rv_id: 1262923 rule_id: bwUwy8 version_id: jQTn5nj url: https://semgrep.dev/playground/r/jQTn5nj/go.lang.security.audit.crypto.math_random.math-random-used origin: community path: go.lang.security.audit.crypto.math_random.math-random-used message: Do not use `math/rand`. Use `crypto/rand` instead. languages: - go severity: WARNING patterns: - pattern-either: - pattern: | import $RAND "$MATH" - pattern: | import "$MATH" - metavariable-regex: metavariable: $MATH regex: ^(math/rand(\/v[0-9]+)*)$ - pattern-either: - pattern-inside: | ... rand.$FUNC(...) - pattern-inside: | ... $RAND.$FUNC(...) - focus-metavariable: - $MATH fix: | crypto/rand - id: javascript.express.security.injection.raw-html-format.raw-html-format message: User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html category: security technology: - express cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format shortlink: https://sg.run/5DO3 semgrep.dev: rule: r_id: 14691 rv_id: 1263175 rule_id: 5rUL0X version_id: NdTzyQv url: https://semgrep.dev/playground/r/NdTzyQv/javascript.express.security.injection.raw-html-format.raw-html-format origin: community path: javascript.express.security.injection.raw-html-format.raw-html-format languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - label: EXPRESS patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - label: EXPRESSTS patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body - label: CLEAN by-side-effect: true patterns: - pattern-either: - pattern: $A($SOURCE) - pattern: $SANITIZE. ... .$A($SOURCE) - pattern: $A. ... .$SANITIZE($SOURCE) - focus-metavariable: $SOURCE - metavariable-regex: metavariable: $A regex: (?i)(.*valid|.*sanitiz) pattern-sinks: - requires: (EXPRESS and not CLEAN) or (EXPRESSTS and not CLEAN) patterns: - pattern-either: - patterns: - pattern-either: - pattern: '"$HTMLSTR" + $EXPR' - pattern: '"$HTMLSTR".concat(...)' - pattern: util.format($HTMLSTR, ...) - metavariable-pattern: metavariable: $HTMLSTR language: generic pattern: <$TAG ... - patterns: - pattern: | `...` - pattern-regex: | .*<\w+.* - id: kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call message: A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#COMMAND_INJECTION. category: security technology: - kt references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call shortlink: https://sg.run/6nEK semgrep.dev: rule: r_id: 9359 rv_id: 1263259 rule_id: yyUnpo version_id: 0bTKzZ9 url: https://semgrep.dev/playground/r/0bTKzZ9/kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call origin: community path: kotlin.lang.security.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call severity: ERROR languages: - kt pattern-either: - pattern: $RUNTIME.exec($X + $Y) - pattern: $RUNTIME.exec(String.format(...)) - pattern: $RUNTIME.loadLibrary($X + $Y) - pattern: $RUNTIME.loadLibrary(String.format(...)) - id: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution category: security technology: - .net confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization shortlink: https://sg.run/E5e5 semgrep.dev: rule: r_id: 11137 rv_id: 1262638 rule_id: kxURnR version_id: LjTkgPk url: https://semgrep.dev/playground/r/LjTkgPk/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization origin: community path: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization message: The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability. patterns: - pattern-inside: | using MBrace.FsPickler.Json; ... - pattern: | FsPickler.CreateJsonSerializer(); - id: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override mode: taint pattern-sources: - patterns: - focus-metavariable: $ARG - pattern-inside: | public $T $M(...,string $ARG,...){...} pattern-sinks: - patterns: - pattern: | $XMLDOCUMENT.$METHOD(...) - pattern-inside: "XmlDocument $XMLDOCUMENT = new XmlDocument(...);\n...\n$XMLDOCUMENT.XmlResolver = new XmlUrlResolver(...);\n... \n" message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data. languages: - csharp severity: WARNING metadata: category: security references: - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks technology: - .net - xml cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override shortlink: https://sg.run/k98P semgrep.dev: rule: r_id: 18228 rv_id: 1262654 rule_id: ReUK9k version_id: K3TKk5E url: https://semgrep.dev/playground/r/K3TKk5E/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override origin: community path: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override - id: generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key pattern-regex: SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9-]{43}\b languages: - regex message: SendGrid API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/narendrakadali/gitrob/blob/master/rules/contentsignatures.json category: security technology: - secrets - sendgrid confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key shortlink: https://sg.run/qqOy semgrep.dev: rule: r_id: 12856 rv_id: 1262890 rule_id: x8U2EG version_id: PkTR3RD url: https://semgrep.dev/playground/r/PkTR3RD/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key origin: community path: generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key - id: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call patterns: - metavariable-pattern: metavariable: $RUNTIME patterns: - pattern-either: - pattern: (java.lang.Runtime $R) - pattern: java.lang.Runtime.getRuntime(...) - pattern-either: - pattern: $RUNTIME.exec($X + $Y); - pattern: $RUNTIME.exec(String.format(...)); - pattern: $RUNTIME.loadLibrary($X + $Y); - pattern: $RUNTIME.loadLibrary(String.format(...)); - patterns: - pattern-either: - pattern: | $RUNTIME.exec("=~/(sh|bash|ksh|csh|tcsh|zsh)/", "-c", $ARG,...) - pattern: | $RUNTIME.exec(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...),...) - pattern: | $RUNTIME.exec(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$ARG,...},...) - patterns: - pattern-either: - pattern: | $RUNTIME.exec($CMD,"-c",$ARG,...) - pattern: | $RUNTIME.exec(Arrays.asList($CMD,"-c",$ARG,...),...) - pattern: | $RUNTIME.exec(new String[]{$CMD,"-c",$ARG,...},...) - pattern-inside: | $CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/"; ... - patterns: - pattern-either: - pattern: | $RUNTIME.exec($CMD, $EXECUTE, $ARG, ...) - pattern-inside: | $CMD = new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/", ...}; ... - patterns: - pattern-either: - pattern: | $RUNTIME.exec("=~/(sh|bash|ksh|csh|tcsh|zsh)/", $BASH, $ARG,...) - pattern: | $RUNTIME.exec(Arrays.asList("=~/(sh|bash|ksh|csh|tcsh|zsh)/",$BASH,$ARG,...),...) - pattern: | $RUNTIME.exec(new String[]{"=~/(sh|bash|ksh|csh|tcsh|zsh)/",$BASH,$ARG,...},...) - pattern-inside: | $BASH = new String[]{"=~/(-c)/", ...}; ... - pattern-not-inside: | $ARG = "..."; ... - pattern-not: | $RUNTIME.exec("...","...","...",...) - pattern-not: | $RUNTIME.exec(new String[]{"...","...","...",...},...) - pattern-not: | $RUNTIME.exec(Arrays.asList("...","...","...",...),...) message: A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#COMMAND_INJECTION. category: security technology: - java references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call shortlink: https://sg.run/rd90 semgrep.dev: rule: r_id: 9169 rv_id: 1262991 rule_id: nJUzvJ version_id: PkTR3ez url: https://semgrep.dev/playground/r/PkTR3ez/java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call origin: community path: java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call severity: ERROR languages: - java - id: php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off patterns: - pattern-either: - pattern: | $ARG = $IS_VERIFIED; ... curl_setopt(..., CURLOPT_SSL_VERIFYPEER, $ARG); - pattern: curl_setopt(..., CURLOPT_SSL_VERIFYPEER, $IS_VERIFIED) - metavariable-regex: metavariable: $IS_VERIFIED regex: 0|false|null message: SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= $IS_VERIFIED) metadata: cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' references: - https://www.saotn.org/dont-turn-off-curlopt_ssl_verifypeer-fix-php-configuration/ category: security technology: - php owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures subcategory: - vuln likelihood: LOW impact: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off shortlink: https://sg.run/PJqv semgrep.dev: rule: r_id: 9389 rv_id: 1263277 rule_id: 0oU5Xg version_id: kbTzG9b url: https://semgrep.dev/playground/r/kbTzG9b/php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off origin: community path: php.lang.security.curl-ssl-verifypeer-off.curl-ssl-verifypeer-off languages: - php severity: ERROR - id: generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key pattern-regex: (?i)softlayer.{0,50}["|'|`]?[a-z0-9]{64}["|'|`]? languages: - regex message: SoftLayer API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/softlayer.py category: security technology: - secrets - softlayer confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key shortlink: https://sg.run/YXq4 semgrep.dev: rule: r_id: 12858 rv_id: 1262894 rule_id: eqUplZ version_id: RGT0L0o url: https://semgrep.dev/playground/r/RGT0L0o/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key origin: community path: generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key - id: bash.curl.security.curl-pipe-bash.curl-pipe-bash languages: - bash severity: WARNING message: Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity. metadata: owasp: - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' category: security technology: - bash - curl confidence: LOW references: - https://owasp.org/Top10/A03_2021-Injection subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash shortlink: https://sg.run/KXz6 semgrep.dev: rule: r_id: 14555 rv_id: 1262602 rule_id: qNUXrw version_id: 5PTo1Lx url: https://semgrep.dev/playground/r/5PTo1Lx/bash.curl.security.curl-pipe-bash.curl-pipe-bash origin: community path: bash.curl.security.curl-pipe-bash.curl-pipe-bash patterns: - pattern-either: - pattern: curl ... | ... bash ... - pattern: curl ... | ... /bin/bash ... - pattern: '... bash <(curl ...)' - pattern: '... /bin/bash <(curl ...)' - pattern: '... bash -c "$(curl ...)"' - pattern: '... /bin/bash -c "$(curl ...)"' - id: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled message: $sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application could provide additional attack surface for XSS vulnerabilities. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' references: - https://docs.angularjs.org/api/ng/service/$sce - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf category: security technology: - angular owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled shortlink: https://sg.run/N4DG semgrep.dev: rule: r_id: 9227 rv_id: 1263094 rule_id: EwU20Z version_id: 5PTo1EW url: https://semgrep.dev/playground/r/5PTo1EW/javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled origin: community path: javascript.angular.security.detect-angular-sce-disabled.detect-angular-sce-disabled languages: - javascript - typescript severity: ERROR pattern: | $sceProvider.enabled(false); - id: generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key pattern-regex: key-[0-9a-zA-Z]{32} languages: - regex message: Mailgun API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - mailgun confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key shortlink: https://sg.run/jRL2 semgrep.dev: rule: r_id: 9065 rv_id: 1262882 rule_id: v8UneY version_id: ExTExAG url: https://semgrep.dev/playground/r/ExTExAG/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key origin: community path: generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key - id: generic.secrets.security.detected-square-access-token.detected-square-access-token pattern-regex: sq0atp-[0-9A-Za-z\-_]{22} languages: - regex message: Square Access Token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - square confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token shortlink: https://sg.run/OP3b semgrep.dev: rule: r_id: 9075 rv_id: 1262896 rule_id: 3qUPqO version_id: BjTkZkz url: https://semgrep.dev/playground/r/BjTkZkz/generic.secrets.security.detected-square-access-token.detected-square-access-token origin: community path: generic.secrets.security.detected-square-access-token.detected-square-access-token - id: javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell message: Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability. metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-child-process.js category: security technology: - javascript references: - https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell shortlink: https://sg.run/DJ8v semgrep.dev: rule: r_id: 9852 rv_id: 1263193 rule_id: qNUo10 version_id: PkTR3nY url: https://semgrep.dev/playground/r/PkTR3nY/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell origin: community path: javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-inside: | function ... (...,$FUNC,...) { ... } - focus-metavariable: $FUNC pattern-sinks: - patterns: - pattern-either: - pattern-inside: | require('child_process') ... - pattern-inside: | import 'child_process' ... - pattern-either: - pattern: spawn(...) - pattern: spawnSync(...) - pattern: $CP.spawn(...) - pattern: $CP.spawnSync(...) - pattern-either: - pattern: | $EXEC("=~/(sh|bash|ksh|csh|tcsh|zsh)/",["-c", $ARG, ...],...) - patterns: - pattern: $EXEC($CMD,["-c", $ARG, ...],...) - pattern-inside: | $CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/" ... - pattern: | $EXEC("=~/(sh|bash|ksh|csh|tcsh|zsh)/",[$ARG, ...],...) - patterns: - pattern: $EXEC($CMD,[$ARG, ...],...) - pattern-inside: | $CMD = "=~/(sh|bash|ksh|csh|tcsh|zsh)/" ... - focus-metavariable: $ARG - id: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes message: Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers. metadata: cwe: - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-pseudoRandomBytes.js asvs: section: 'V6: Stored Cryptography Verification Requirements' control_id: 6.3.1 Insecure Randomness control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v63-random-values version: '4' category: security technology: - javascript subcategory: - audit likelihood: LOW impact: LOW confidence: LOW references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes shortlink: https://sg.run/pxze semgrep.dev: rule: r_id: 9318 rv_id: 1263217 rule_id: NbUkR2 version_id: qkTR799 url: https://semgrep.dev/playground/r/qkTR799/javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes origin: community path: javascript.lang.security.detect-pseudorandombytes.detect-pseudoRandomBytes languages: - javascript - typescript severity: WARNING pattern: crypto.pseudoRandomBytes - id: java.lang.security.audit.formatted-sql-string.formatted-sql-string metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.5 Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' references: - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html - https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html#create_ps - https://software-security.sans.org/developer-how-to/fix-sql-injection-in-java-using-prepared-callable-statement category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.lang.security.audit.formatted-sql-string.formatted-sql-string shortlink: https://sg.run/OPXp semgrep.dev: rule: r_id: 9175 rv_id: 1409389 rule_id: QrUzxR version_id: ExTeyBP url: https://semgrep.dev/playground/r/ExTeyBP/java.lang.security.audit.formatted-sql-string.formatted-sql-string origin: community path: java.lang.security.audit.formatted-sql-string.formatted-sql-string options: taint_assume_safe_numbers: true taint_assume_safe_booleans: true message: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements (java.sql.PreparedStatement) instead. You can obtain a PreparedStatement using 'connection.prepareStatement'. mode: taint pattern-sources: - patterns: - pattern-either: - pattern: | (HttpServletRequest $REQ) - patterns: - pattern-inside: | $ANNOT $FUNC (..., $INPUT, ...) { ... } - pattern: (String $INPUT) - focus-metavariable: $INPUT label: INPUT - patterns: - pattern-either: - pattern: $X + $INPUT - pattern: $X += $INPUT - pattern: String.format(..., $INPUT, ...) - pattern: String.join(..., $INPUT, ...) - pattern: (String $STR).concat($INPUT) - pattern: $INPUT.concat(...) - patterns: - pattern-either: - pattern: $STRB.append($INPUT) - pattern: new $STRB(..., $INPUT, ...) - metavariable-type: metavariable: $STRB type: StringBuilder label: CONCAT requires: INPUT pattern-propagators: - pattern: (StringBuffer $S).append($X) from: $X to: $S - pattern: (StringBuilder $S).append($X) from: $X to: $S pattern-sinks: - patterns: - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE *$/" ...>) - pattern-not: $S.$SQLFUNC(<... "=~/.*TABLE %s$/" ...>) - pattern-either: - pattern: (Statement $S).$SQLFUNC(...) - pattern: (PreparedStatement $P).$SQLFUNC(...) - pattern: (Connection $C).createStatement(...).$SQLFUNC(...) - pattern: (Connection $C).prepareStatement(...).$SQLFUNC(...) - pattern: (EntityManager $EM).$SQLFUNC(...) - metavariable-regex: metavariable: $SQLFUNC regex: execute|executeQuery|createQuery|query|addBatch|nativeSQL|create|prepare requires: CONCAT pattern-sanitizers: - patterns: - pattern: (CriteriaBuilder $CB).$ANY(...) severity: ERROR languages: - java - id: generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key patterns: - pattern-regex: (("|'|`)?((?i)aws)_?\w*((?i)secret)_?\w*("|'|`)?\s{0,50}(:|=>|=)\s{0,50}("|'|`)?[A-Za-z0-9/+=]{40}("|'|`)?) - pattern-not-regex: (?i)example|sample|test|fake|xxxxxx languages: - regex message: AWS Secret Access Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets - aws confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key shortlink: https://sg.run/Bk39 semgrep.dev: rule: r_id: 9051 rv_id: 1262862 rule_id: 2ZUbe8 version_id: zyTb2Dr url: https://semgrep.dev/playground/r/zyTb2Dr/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key origin: community path: generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key - id: java.servlets.security.cookie-issecure-false.cookie-issecure-false patterns: - pattern: $COOKIE = new Cookie($...ARGS); - pattern-not-inside: | $COOKIE = new Cookie(...); ... $COOKIE.setSecure(...); message: 'Default session middleware settings: `setSecure` not set to true. This ensures that the cookie is sent only over HTTPS to prevent cross-site scripting attacks.' fix: | $COOKIE = new Cookie($...ARGS); $COOKIE.setSecure(true); metadata: vulnerability: Insecure Transport owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' references: - https://docs.oracle.com/javaee/6/api/javax/servlet/http/Cookie.html#setSecure(boolean) - https://owasp.org/www-community/controls/SecureCookieAttribute category: security technology: - java - cookie subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/java.servlets.security.cookie-issecure-false.cookie-issecure-false shortlink: https://sg.run/pxn0 semgrep.dev: rule: r_id: 9218 rv_id: 1263073 rule_id: kxUkn9 version_id: bZT53lB url: https://semgrep.dev/playground/r/bZT53lB/java.servlets.security.cookie-issecure-false.cookie-issecure-false origin: community path: java.servlets.security.cookie-issecure-false.cookie-issecure-false languages: - java severity: WARNING - id: php.lang.security.unserialize-use.unserialize-use patterns: - pattern: unserialize(...) - pattern-not: unserialize("...",...) message: Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). metadata: references: - https://www.php.net/manual/en/function.unserialize.php - https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization.html category: security technology: - php owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/php.lang.security.unserialize-use.unserialize-use shortlink: https://sg.run/b24E semgrep.dev: rule: r_id: 13970 rv_id: 1263302 rule_id: v8U9OJ version_id: WrTqKeJ url: https://semgrep.dev/playground/r/WrTqKeJ/php.lang.security.unserialize-use.unserialize-use origin: community path: php.lang.security.unserialize-use.unserialize-use languages: - php severity: WARNING - id: yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor languages: - yaml message: The Shai-hulud backdoor creates a purposefully vulnerable github action with the name `discussion.yaml`. paths: include: - '**/.github/workflows/discussion.yaml' metadata: category: security cwe: - 'CWE-509: Replicating Malicious Code (Virus or Worm)' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection technology: - github-actions cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source_rule_url: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack references: - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains source: https://semgrep.dev/r/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor shortlink: https://sg.run/JdYPZ semgrep.dev: rule: r_id: 238946 rv_id: 1263927 rule_id: 7KUDRPj version_id: 6xT29ol url: https://semgrep.dev/playground/r/6xT29ol/yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor origin: community path: yaml.github-actions.security.detect-shai-hulud-backdoor.detect-shai-hulud-backdoor patterns: - pattern-inside: 'steps: [...]' - pattern-inside: | - run: ... ... - pattern: 'run: $SHELL' - metavariable-pattern: language: generic metavariable: $SHELL patterns: - pattern-either: - pattern: ${{ github.event.issue.title }} - pattern: ${{ github.event.issue.body }} - pattern: ${{ github.event.pull_request.title }} - pattern: ${{ github.event.pull_request.body }} - pattern: ${{ github.event.comment.body }} - pattern: ${{ github.event.review.body }} - pattern: ${{ github.event.review_comment.body }} - pattern: ${{ github.event.pages. ... .page_name}} - pattern: ${{ github.event.head_commit.message }} - pattern: ${{ github.event.head_commit.author.email }} - pattern: ${{ github.event.head_commit.author.name }} - pattern: ${{ github.event.commits ... .author.email }} - pattern: ${{ github.event.commits ... .author.name }} - pattern: ${{ github.event.pull_request.head.ref }} - pattern: ${{ github.event.pull_request.head.label }} - pattern: ${{ github.event.pull_request.head.repo.default_branch }} - pattern: ${{ github.head_ref }} - pattern: ${{ github.event.inputs ... }} - pattern: ${{ github.event.discussion.title }} - pattern: ${{ github.event.discussion.body }} - pattern: ${{ inputs ... }} severity: ERROR - id: csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization patterns: - pattern-either: - pattern: TypeNameHandling = TypeNameHandling.$TYPEHANDLER - pattern: | $SETTINGS.TypeNameHandling = TypeNameHandling.$TYPEHANDLER; ... JsonConvert.DeserializeObject<$TYPE>(...,$SETTINGS); - pattern: | $SETTINGS.TypeNameHandling = TypeNameHandling.$TYPEHANDLER; ... JsonConvert.DeserializeObject(...,$SETTINGS); - pattern-inside: | using Newtonsoft.Json; ... - metavariable-regex: metavariable: $TYPEHANDLER regex: (All|Auto|Objects|Arrays) message: TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None. languages: - csharp severity: WARNING metadata: category: security cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks technology: - .net - newtonsoft - json confidence: LOW cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization shortlink: https://sg.run/8n2g semgrep.dev: rule: r_id: 11140 rv_id: 1262643 rule_id: OrUGgl version_id: 44TEjgG url: https://semgrep.dev/playground/r/44TEjgG/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization origin: community path: csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization - id: generic.secrets.security.detected-hockeyapp.detected-hockeyapp pattern-regex: (?i)hockey.{0,50}(\\\"|'|`)?[0-9a-f]{32}(\\\"|'|`)? languages: - regex message: HockeyApp detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets - hockeyapp confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp shortlink: https://sg.run/2xoY semgrep.dev: rule: r_id: 9063 rv_id: 1262878 rule_id: OrU3zo version_id: vdT068z url: https://semgrep.dev/playground/r/vdT068z/generic.secrets.security.detected-hockeyapp.detected-hockeyapp origin: community path: generic.secrets.security.detected-hockeyapp.detected-hockeyapp - id: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 pattern: $CIPHER.getInstance("RC4") metadata: functional-categories: - crypto::search::symmetric-algorithm::javax.crypto cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 shortlink: https://sg.run/7OYR semgrep.dev: rule: r_id: 48738 rv_id: 1263015 rule_id: lBUw8k version_id: qkTR7vk url: https://semgrep.dev/playground/r/qkTR7vk/java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 origin: community path: java.lang.security.audit.crypto.use-of-rc4.use-of-rc4 message: 'Use of RC4 was detected. RC4 is vulnerable to several attacks, including stream cipher attacks and bit flipping attacks. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' severity: WARNING languages: - java - id: dockerfile.audit.dockerfile-pip-extra-index-url.dockerfile-pip-extra-index-url patterns: - pattern: | RUN ... $PIP install ... --extra-index-url ... - metavariable-regex: metavariable: $PIP regex: pip|pip3 message: 'When `--extra-index-url` is used in a `pip install` command, this is usually meant to install a package from a package index other than the public one. However, if a package is added with the same name to the public PyPi repository, and if the version number is high enough, this package will be installed when building this docker image. This package may be a malicious dependency. Such an attack is called a dependency confusion attack. If using a private package index, prefer to use `--index-url` if possible. ' languages: - dockerfile severity: INFO metadata: references: - https://pip.pypa.io/en/stable/cli/pip_install/#cmdoption-extra-index-url - https://github.com/semgrep/semgrep-rules/issues/3032 category: security subcategory: - audit confidence: MEDIUM impact: HIGH likelihood: LOW technology: - docker cwe: - 'CWE-427: Uncontrolled Search Path Element' license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/dockerfile.audit.dockerfile-pip-extra-index-url.dockerfile-pip-extra-index-url shortlink: https://sg.run/qk4p8 semgrep.dev: rule: r_id: 197112 rv_id: 1039209 rule_id: pKUkLD3 version_id: 1QTY5L3 url: https://semgrep.dev/playground/r/1QTY5L3/dockerfile.audit.dockerfile-pip-extra-index-url.dockerfile-pip-extra-index-url origin: community path: dockerfile.audit.dockerfile-pip-extra-index-url.dockerfile-pip-extra-index-url - id: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled patterns: - pattern-not-inside: | ... $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false) - pattern-either: - pattern: $XMLFACTORY = XMLInputFactory.newFactory(...) - pattern: $XMLFACTORY = XMLInputFactory.newInstance(...) - pattern: $XMLFACTORY = new XMLInputFactory(...) message: XMLInputFactory being instantiated without calling the setProperty functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality. languages: - scala severity: WARNING metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html category: security technology: - scala confidence: HIGH references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled shortlink: https://sg.run/3BEb semgrep.dev: rule: r_id: 19043 rv_id: 1263683 rule_id: qNUQ7w version_id: xyTjzkA url: https://semgrep.dev/playground/r/xyTjzkA/scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled origin: community path: scala.lang.security.audit.xmlinputfactory-dtd-enabled.xmlinputfactory-dtd-enabled - id: problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification message: Checks for disabling of TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks. severity: WARNING metadata: likelihood: HIGH impact: MEDIUM confidence: MEDIUM category: security cwe: 'CWE-319: Cleartext Transmission of Sensitive Information' owasp: A03:2017 - Sensitive Data Exposure references: - https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate subcategory: - vuln technology: - go vulnerability: Insecure Transport license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification shortlink: https://sg.run/4xj5 semgrep.dev: rule: r_id: 9400 rv_id: 946043 rule_id: DbUpjg version_id: ZRT358j url: https://semgrep.dev/playground/r/ZRT358j/problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification origin: community path: problem-based-packs.insecure-transport.go-stdlib.bypass-tls-verification.bypass-tls-verification languages: - go pattern-either: - pattern: | tls.Config{..., InsecureSkipVerify: true, ...} - pattern: | $CONFIG = &tls.Config{...} ... $CONFIG.InsecureSkipVerify = true - id: generic.secrets.security.detected-etc-shadow.detected-etc-shadow patterns: - pattern-regex: ^(\s*)(?Proot:[x!*]*:[0-9]*:[0-9]*) - focus-metavariable: $ROOT languages: - regex message: linux shadow file detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' category: security technology: - secrets confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow shortlink: https://sg.run/4ylL semgrep.dev: rule: r_id: 10044 rv_id: 1262866 rule_id: JDUP6p version_id: jQTn5yp url: https://semgrep.dev/playground/r/jQTn5yp/generic.secrets.security.detected-etc-shadow.detected-etc-shadow origin: community path: generic.secrets.security.detected-etc-shadow.detected-etc-shadow - id: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes pattern-either: - patterns: - pattern-either: - pattern-inside: | import javax; ... - pattern-either: - pattern: javax.crypto.Cipher.getInstance("AES") - pattern: (javax.crypto.Cipher $CIPHER).getInstance("AES") - patterns: - pattern-either: - pattern-inside: | import javax.*; ... - pattern-inside: | import javax.crypto; ... - pattern-either: - pattern: crypto.Cipher.getInstance("AES") - pattern: (crypto.Cipher $CIPHER).getInstance("AES") - patterns: - pattern-either: - pattern-inside: | import javax.crypto.*; ... - pattern-inside: | import javax.crypto.Cipher; ... - pattern-either: - pattern: Cipher.getInstance("AES") - pattern: (Cipher $CIPHER).getInstance("AES") metadata: functional-categories: - crypto::search::mode::javax.crypto cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes shortlink: https://sg.run/nzKO semgrep.dev: rule: r_id: 48736 rv_id: 1263011 rule_id: KxUB7Z version_id: DkTRbwy url: https://semgrep.dev/playground/r/DkTRbwy/java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes origin: community path: java.lang.security.audit.crypto.use-of-default-aes.use-of-default-aes message: 'Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn''t provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' severity: WARNING languages: - java - id: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation - https://nvd.nist.gov/vuln/detail/CVE-2017-18342 category: security technology: - pyyaml cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load shortlink: https://sg.run/we9Y semgrep.dev: rule: r_id: 9673 rv_id: 1263530 rule_id: ZqU5jZ version_id: 1QTyprw url: https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load origin: community path: python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load languages: - python message: Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead. fix-regex: regex: unsafe_load replacement: safe_load count: 1 severity: ERROR patterns: - pattern-inside: | import yaml ... - pattern-not-inside: | $YAML = ruamel.yaml.YAML(...) ... - pattern-either: - pattern: yaml.unsafe_load(...) - pattern: yaml.load(..., Loader=yaml.Loader, ...) - pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...) - pattern: yaml.load(..., Loader=yaml.CLoader, ...) - pattern: yaml.load_all(..., Loader=yaml.Loader, ...) - pattern: yaml.load_all(..., Loader=yaml.UnsafeLoader, ...) - pattern: yaml.load_all(..., Loader=yaml.CLoader, ...) - id: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind metadata: cwe: - 'CWE-287: Improper Authentication' owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS category: security technology: - kotlin references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind shortlink: https://sg.run/rY2n semgrep.dev: rule: r_id: 15125 rv_id: 1263258 rule_id: v8U9Q7 version_id: WrTqKgJ url: https://semgrep.dev/playground/r/WrTqKgJ/kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind origin: community path: kotlin.lang.security.anonymous-ldap-bind.anonymous-ldap-bind message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information. severity: WARNING pattern: | $ENV.put($CTX.SECURITY_AUTHENTICATION, "none") ... $DCTX = InitialDirContext($ENV, ...) languages: - kt - id: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ category: security technology: - jwt confidence: HIGH references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm shortlink: https://sg.run/Gej1 semgrep.dev: rule: r_id: 9092 rv_id: 1262919 rule_id: 5rUOWQ version_id: zyTb2bz url: https://semgrep.dev/playground/r/zyTb2bz/go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm origin: community path: go.jwt-go.security.jwt-none-alg.jwt-go-none-algorithm languages: - go severity: ERROR patterns: - pattern-either: - pattern-inside: | import "github.com/golang-jwt/jwt" ... - pattern-inside: | import "github.com/dgrijalva/jwt-go" ... - pattern-either: - pattern: | jwt.SigningMethodNone - pattern: jwt.UnsafeAllowNoneSignatureType - id: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks category: security technology: - .net confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization shortlink: https://sg.run/gJnR semgrep.dev: rule: r_id: 11141 rv_id: 1262644 rule_id: eqUvND version_id: PkTR30n url: https://semgrep.dev/playground/r/PkTR30n/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization origin: community path: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization message: The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure patterns: - pattern-inside: | using System.Runtime.Serialization.Formatters.Soap; ... - pattern: | new SoapFormatter(); - id: generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret pattern-regex: sq0csp-[0-9A-Za-z\\\-_]{43} languages: - regex message: Square OAuth Secret detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json references: - https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py category: security technology: - secrets - square confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret shortlink: https://sg.run/eL7E semgrep.dev: rule: r_id: 9076 rv_id: 1262897 rule_id: 4bUk4l version_id: DkTRbRG url: https://semgrep.dev/playground/r/DkTRbRG/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret origin: community path: generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret - id: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.3 Insecue Stateless Session Tokens control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jwt subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg shortlink: https://sg.run/PJXv semgrep.dev: rule: r_id: 9301 rv_id: 1263190 rule_id: 0oU53g version_id: QkTGqQo url: https://semgrep.dev/playground/r/QkTGqQo/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg origin: community path: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg languages: - javascript - typescript severity: ERROR patterns: - pattern-inside: | $JWT = require("jsonwebtoken"); ... - pattern: $JWT.verify($P, $X, {algorithms:[...,'none',...]},...) - id: python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key patterns: - pattern-inside: | $CLIENT = paramiko.client.SSHClient(...) ... $CLIENT.set_missing_host_key_policy(...) - pattern-either: - pattern: paramiko.client.AutoAddPolicy - pattern: paramiko.client.WarningPolicy message: Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead. metadata: cwe: - 'CWE-322: Key Exchange without Entity Authentication' owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/ssh_no_host_key_verification.py references: - http://docs.paramiko.org/en/stable/api/client.html#paramiko.client.AutoAddPolicy category: security technology: - paramiko subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key shortlink: https://sg.run/4xpl semgrep.dev: rule: r_id: 9644 rv_id: 1263510 rule_id: AbUzbe version_id: JdTzxEQ url: https://semgrep.dev/playground/r/JdTzxEQ/python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key origin: community path: python.lang.security.audit.paramiko-implicit-trust-host-key.paramiko-implicit-trust-host-key languages: - python severity: WARNING - id: python.lang.security.use-defused-xml-parse.use-defused-xml-parse metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' references: - https://docs.python.org/3/library/xml.html - https://github.com/tiran/defusedxml - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse shortlink: https://sg.run/n3jG semgrep.dev: rule: r_id: 72436 rv_id: 1263541 rule_id: X5Uqnx version_id: vdT06ER url: https://semgrep.dev/playground/r/vdT06ER/python.lang.security.use-defused-xml-parse.use-defused-xml-parse origin: community path: python.lang.security.use-defused-xml-parse.use-defused-xml-parse message: The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`. languages: - python severity: ERROR patterns: - pattern: xml.etree.ElementTree.parse($...ARGS) - pattern-not: xml.etree.ElementTree.parse("...") fix: defusedxml.etree.ElementTree.parse($...ARGS) - id: clojure.lang.security.use-of-md5.use-of-md5 languages: - clojure severity: WARNING message: MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms. metadata: references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html technology: - clojure source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/weak-hash-function-md5.yml owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-328: Use of Weak Hash' author: Gabriel Marquet category: security subcategory: - vuln confidence: HIGH likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Insecure Hashing Algorithm source: https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5 shortlink: https://sg.run/BgPx semgrep.dev: rule: r_id: 52195 rv_id: 1262609 rule_id: nJU1ep version_id: 0bTKz2B url: https://semgrep.dev/playground/r/0bTKz2B/clojure.lang.security.use-of-md5.use-of-md5 origin: community path: clojure.lang.security.use-of-md5.use-of-md5 pattern-either: - pattern: (MessageDigest/getInstance "MD5") - pattern: (MessageDigest/getInstance MessageDigestAlgorithms/MD5) - pattern: (MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5) - pattern: (java.security.MessageDigest/getInstance "MD5") - pattern: (java.security.MessageDigest/getInstance MessageDigestAlgorithms/MD5) - pattern: (java.security.MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5) - id: php.lang.security.md5-used-as-password.md5-used-as-password severity: WARNING message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use `password_hash($PASSWORD, PASSWORD_BCRYPT, $OPTIONS);`. languages: - php metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://tools.ietf.org/html/rfc6151 - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords - https://github.com/returntocorp/semgrep-rules/issues/1609 - https://www.php.net/password_hash category: security technology: - md5 subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/php.lang.security.md5-used-as-password.md5-used-as-password shortlink: https://sg.run/66YL semgrep.dev: rule: r_id: 14759 rv_id: 1263294 rule_id: YGUD1O version_id: PkTR37j url: https://semgrep.dev/playground/r/PkTR37j/php.lang.security.md5-used-as-password.md5-used-as-password origin: community path: php.lang.security.md5-used-as-password.md5-used-as-password mode: taint pattern-sources: - patterns: - pattern-either: - pattern: md5(...) - pattern: hash('md5', ...) pattern-sinks: - patterns: - pattern: $FUNCTION(...) - metavariable-regex: metavariable: $FUNCTION regex: (?i)(.*password.*) - id: javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation message: No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS). metadata: owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-345: Insufficient Verification of Data Authenticity' category: security technology: - browser subcategory: - audit likelihood: LOW impact: LOW confidence: LOW references: - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation shortlink: https://sg.run/gL9x semgrep.dev: rule: r_id: 9241 rv_id: 1263120 rule_id: BYUN0X version_id: o5TbDRl url: https://semgrep.dev/playground/r/o5TbDRl/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation origin: community path: javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation languages: - javascript - typescript severity: WARNING pattern-either: - patterns: - pattern: | window.addEventListener('message', $FUNC, ...) - metavariable-pattern: patterns: - pattern: | function($OBJ) { ... } - pattern-not: | function($OBJ) { ... if (<... $OBJ.origin ...>) { ... } ... } metavariable: $FUNC - patterns: - pattern-either: - pattern-inside: | function $FNAME($OBJ) { $CONTEXT } ... - pattern-inside: | $FNAME = (...) => { $CONTEXT } ... - pattern: | window.addEventListener('message', $FNAME,...) - metavariable-pattern: patterns: - pattern-not: | ... if (<... $OBJ.origin ...>) { ... } ... metavariable: $CONTEXT - id: ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. metadata: cwe: - 'CWE-345: Insufficient Verification of Data Authenticity' owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ category: security technology: - jwt references: - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify shortlink: https://sg.run/AlYg semgrep.dev: rule: r_id: 9706 rv_id: 1263587 rule_id: KxU426 version_id: ZRTKAnz url: https://semgrep.dev/playground/r/ZRTKAnz/ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify origin: community path: ruby.jwt.security.audit.jwt-decode-without-verify.ruby-jwt-decode-without-verify languages: - ruby severity: WARNING patterns: - pattern-inside: | require 'jwt' ... - pattern: JWT.decode($PAYLOAD,$SECRET,false,...) - id: python.flask.security.injection.tainted-sql-string.tainted-sql-string message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries. metadata: cwe: - 'CWE-704: Incorrect Type Conversion or Cast' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql - https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm - https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column category: security technology: - sqlalchemy - flask subcategory: - vuln impact: MEDIUM likelihood: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Validation source: https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/JxZj semgrep.dev: rule: r_id: 14702 rv_id: 1409402 rule_id: YGUDKQ version_id: A8TEvb4 url: https://semgrep.dev/playground/r/A8TEvb4/python.flask.security.injection.tainted-sql-string.tainted-sql-string origin: community path: python.flask.security.injection.tainted-sql-string.tainted-sql-string severity: ERROR languages: - python mode: taint pattern-sources: - patterns: - pattern-either: - pattern: flask.request.$ANYTHING - patterns: - pattern-inside: | @$APP.route(...) def $FUNC(..., $ROUTEVAR, ...): ... - pattern: $ROUTEVAR pattern-sinks: - patterns: - pattern-either: - pattern: | "$SQLSTR" + ... - pattern: | "$SQLSTR" % ... - pattern: | "$SQLSTR".format(...) - pattern: | f"$SQLSTR{...}..." - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.* - id: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe message: Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' category: security technology: - express references: - https://www.npmjs.com/package/xml2json cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe shortlink: https://sg.run/XBD4 semgrep.dev: rule: r_id: 9264 rv_id: 1263174 rule_id: x8Uneb version_id: bZT534J url: https://semgrep.dev/playground/r/bZT534J/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe origin: community path: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe languages: - javascript - typescript severity: ERROR mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - pattern: $REQ.files.$ANYTHING.data.toString('utf8') - pattern: $REQ.files.$ANYTHING['data'].toString('utf8') - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body - pattern: files.$ANYTHING.data.toString('utf8') - pattern: files.$ANYTHING['data'].toString('utf8') pattern-sinks: - patterns: - pattern-either: - pattern-inside: | require('xml2json'); ... - pattern-inside: | import 'xml2json'; ... - pattern: $EXPAT.toJson($SINK,...) - focus-metavariable: $SINK - id: solidity.security.no-bidi-characters.no-bidi-characters message: The code must not contain any of Unicode Direction Control Characters metadata: category: security technology: - solidity cwe: 'CWE-837: Improper Enforcement of a Single, Unique Action' confidence: HIGH likelihood: LOW impact: LOW subcategory: - audit references: - https://entethalliance.org/specs/ethtrust-sl/v1/#req-1-unicode-bdo license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/solidity.security.no-bidi-characters.no-bidi-characters shortlink: https://sg.run/6DyK semgrep.dev: rule: r_id: 67659 rv_id: 946622 rule_id: 5rUD6Z version_id: DkTNp8K url: https://semgrep.dev/playground/r/DkTNp8K/solidity.security.no-bidi-characters.no-bidi-characters origin: community path: solidity.security.no-bidi-characters.no-bidi-characters patterns: - pattern-either: - pattern-regex: "\u202A" - pattern-regex: "\u202B" - pattern-regex: "\u202D" - pattern-regex: "\u202E" - pattern-regex: "\u2066" - pattern-regex: "\u2067" - pattern-regex: "\u2068" - pattern-regex: "\u202C" - pattern-regex: "\u2069" languages: - solidity severity: WARNING - id: generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token pattern-regex: access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32} languages: - regex message: PayPal Braintree Access Token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - paypal - braintree confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token shortlink: https://sg.run/9oBR semgrep.dev: rule: r_id: 9067 rv_id: 1262885 rule_id: ZqU507 version_id: 8KT5ryb url: https://semgrep.dev/playground/r/8KT5ryb/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token origin: community path: generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token - id: problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification message: Checks for redefinitions of the checkServerTrusted function in the X509TrustManager class that disables TLS/SSL certificate verification. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks. severity: WARNING metadata: likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM category: security cwe: 'CWE-319: Cleartext Transmission of Sensitive Information' owasp: A03:2017 - Sensitive Data Exposure references: - https://riptutorial.com/java/example/16517/temporarily-disable-ssl-verification--for-testing-purposes- - https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1 subcategory: - vuln technology: - java vulnerability: Insecure Transport license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification shortlink: https://sg.run/qxD7 semgrep.dev: rule: r_id: 9412 rv_id: 946055 rule_id: X5U8qv version_id: 5PT9Oj9 url: https://semgrep.dev/playground/r/5PT9Oj9/problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification origin: community path: problem-based-packs.insecure-transport.java-stdlib.bypass-tls-verification.bypass-tls-verification languages: - java patterns: - pattern: | new X509TrustManager() { ... public void checkClientTrusted(X509Certificate[] certs, String authType) {...} ... } - pattern-not: | new X509TrustManager() { ... public void checkServerTrusted(X509Certificate[] certs, String authType) { ... throw new CertificateException(...); ... } ... } - pattern-not: | new X509TrustManager() { ... public void checkServerTrusted(X509Certificate[] certs, String authType) { ... throw new IllegalArgumentException(...); ... } ... } - id: python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle patterns: - pattern: | jsonpickle.decode($PAYLOAD,...) - pattern-not: | jsonpickle.decode("...",...) metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://github.com/jsonpickle/jsonpickle#jsonpickle - https://www.exploit-db.com/exploits/49585 category: security technology: - jsonpickle cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle shortlink: https://sg.run/rkNP semgrep.dev: rule: r_id: 12069 rv_id: 1263529 rule_id: BYU7Kp version_id: jQTn58A url: https://semgrep.dev/playground/r/jQTn58A/python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle origin: community path: python.lang.security.deserialization.avoid-jsonpickle.avoid-jsonpickle message: Avoid using `jsonpickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data using `json` module. languages: - python severity: WARNING - id: java.lang.security.audit.object-deserialization.object-deserialization metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OBJECT_DESERIALIZATION references: - https://www.owasp.org/index.php/Deserialization_of_untrusted_data - https://www.oracle.com/java/technologies/javase/seccodeguide.html#8 category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization shortlink: https://sg.run/Ek0A semgrep.dev: rule: r_id: 9181 rv_id: 1263030 rule_id: GdU7py version_id: NdTzyGe url: https://semgrep.dev/playground/r/NdTzyGe/java.lang.security.audit.object-deserialization.object-deserialization origin: community path: java.lang.security.audit.object-deserialization.object-deserialization message: Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object. severity: WARNING languages: - java pattern: new ObjectInputStream(...); - id: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override mode: taint pattern-sources: - patterns: - focus-metavariable: $ARG - pattern-inside: | public $T $M(...,string $ARG,...){...} pattern-sinks: - patterns: - pattern: | XmlReader $READER = XmlReader.Create(...,$RS,...); - pattern-inside: "XmlReaderSettings $RS = new XmlReaderSettings();\n...\n$RS.DtdProcessing = DtdProcessing.Parse;\n... \n" message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data. languages: - csharp severity: WARNING metadata: category: security references: - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks technology: - .net - xml cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override shortlink: https://sg.run/wXjA semgrep.dev: rule: r_id: 18229 rv_id: 1262655 rule_id: AbU3pX version_id: qkTR7WD url: https://semgrep.dev/playground/r/qkTR7WD/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override origin: community path: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override - id: python.lang.security.deserialization.pickle.avoid-dill metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-dill shortlink: https://sg.run/vzjA semgrep.dev: rule: r_id: 9677 rv_id: 1263534 rule_id: L1Uy60 version_id: bZT53np url: https://semgrep.dev/playground/r/bZT53np/python.lang.security.deserialization.pickle.avoid-dill origin: community path: python.lang.security.deserialization.pickle.avoid-dill languages: - python message: Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. severity: WARNING patterns: - pattern: dill.$FUNC(...) - pattern-not: dill.$FUNC("...") - id: generic.secrets.security.detected-github-token.detected-github-token patterns: - pattern-either: - pattern: | $VAR = $SECRET - pattern: | $VAR: $SECRET - pattern: | $VAR = '$SECRET' - pattern: | $VAR: '$SECRET' - pattern: | '$VAR' = '$SECRET' - pattern: | '$VAR': '$SECRET' - pattern: | "[hH][tT][tT][pP][sS]?://.*$SECRET.*" - metavariable-regex: metavariable: $SECRET regex: gh[pousr]_[A-Za-z0-9_]{36,251} - metavariable-analysis: analyzer: entropy metavariable: $SECRET languages: - generic message: GitHub Token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.blog/changelog/2021-03-04-authentication-token-format-updates/ category: security technology: - secrets - github confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token shortlink: https://sg.run/PpOv semgrep.dev: rule: r_id: 11589 rv_id: 1262871 rule_id: eqUv7b version_id: bZT5397 url: https://semgrep.dev/playground/r/bZT5397/generic.secrets.security.detected-github-token.detected-github-token origin: community path: generic.secrets.security.detected-github-token.detected-github-token - id: python.lang.security.audit.python-reverse-shell.python-reverse-shell patterns: - pattern-either: - pattern: pty.spawn("$BINPATH",...) - pattern: subprocess.call(["$BINPATH",...],...) - metavariable-regex: metavariable: $BINPATH regex: /bin/.*?sh\b - pattern-inside: | import socket ... $S = socket.socket(...) ... $S.connect(($IP,$PORT),...) ... message: Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT metadata: cwe: - 'CWE-553: Command Shell in Externally Accessible Directory' category: security technology: - python references: - https://cwe.mitre.org/data/definitions/553.html subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.audit.python-reverse-shell.python-reverse-shell shortlink: https://sg.run/gYZJ semgrep.dev: rule: r_id: 15185 rv_id: 946375 rule_id: nJUZRY version_id: BjT1NZ4 url: https://semgrep.dev/playground/r/BjT1NZ4/python.lang.security.audit.python-reverse-shell.python-reverse-shell origin: community path: python.lang.security.audit.python-reverse-shell.python-reverse-shell languages: - python severity: WARNING - id: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization severity: ERROR metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://frohoff.github.io/appseccali-marshalling-pickles/ - https://book.hacktricks.xyz/network-services-pentesting/1099-pentesting-java-rmi - https://youtu.be/t_aw1mDNhzI - https://github.com/qtc-de/remote-method-guesser - https://github.com/openjdk/jdk/blob/master/src/java.rmi/share/classes/sun/rmi/server/UnicastRef.java#L303C4-L331 category: security technology: - rmi cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization shortlink: https://sg.run/zvnl semgrep.dev: rule: r_id: 9217 rv_id: 1263072 rule_id: NbUkw5 version_id: rxTAKN2 url: https://semgrep.dev/playground/r/rxTAKN2/java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization origin: community path: java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization message: Using an arbitrary object ('$PARAMTYPE $PARAM') with Java RMI is an insecure deserialization vulnerability. This object can be manipulated by a malicious actor allowing them to execute code on your system. Instead, use an integer ID to look up your object, or consider alternative serialization schemes such as JSON. languages: - java patterns: - pattern: | interface $INTERFACE extends Remote { $RETURNTYPE $METHOD($PARAMTYPE $PARAM) throws RemoteException; } - metavariable-pattern: metavariable: $PARAMTYPE language: generic patterns: - pattern-not: String - pattern-not: java.lang.String - pattern-not: boolean - pattern-not: Boolean - pattern-not: java.lang.Boolean - pattern-not: byte - pattern-not: Byte - pattern-not: java.lang.Byte - pattern-not: char - pattern-not: Character - pattern-not: java.lang.Character - pattern-not: double - pattern-not: Double - pattern-not: java.lang.Double - pattern-not: float - pattern-not: Float - pattern-not: java.lang.Float - pattern-not: int - pattern-not: Integer - pattern-not: java.lang.Integer - pattern-not: long - pattern-not: Long - pattern-not: java.lang.Long - pattern-not: short - pattern-not: Short - pattern-not: java.lang.Short - id: python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off message: Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://flask.palletsprojects.com/en/1.1.x/templating/#controlling-autoescaping - https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup category: security technology: - flask cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off shortlink: https://sg.run/Bkn2 semgrep.dev: rule: r_id: 9551 rv_id: 1263445 rule_id: YGURo6 version_id: 7ZTE3jd url: https://semgrep.dev/playground/r/7ZTE3jd/python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off origin: community path: python.flask.security.xss.audit.template-autoescape-off.template-autoescape-off languages: - regex paths: include: - '*.html' severity: WARNING pattern-regex: '{%\s*autoescape\s+false\s*%}' - id: generic.nginx.security.insecure-ssl-version.insecure-ssl-version patterns: - pattern-not: ssl_protocols TLSv1.2 TLSv1.3; - pattern-not: ssl_protocols TLSv1.3 TLSv1.2; - pattern-not: ssl_protocols TLSv1.2; - pattern-not: ssl_protocols TLSv1.3; - pattern: ssl_protocols ...; paths: include: - '*.conf' - '*.vhost' - '**/sites-available/*' - '**/sites-enabled/*' languages: - generic severity: WARNING message: Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later. metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' references: - https://www.acunetix.com/blog/web-security-zone/hardening-nginx/ - https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/ category: security technology: - nginx confidence: HIGH owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures subcategory: - audit likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version shortlink: https://sg.run/gLKy semgrep.dev: rule: r_id: 9041 rv_id: 1262676 rule_id: WAUo9k version_id: vdT06O4 url: https://semgrep.dev/playground/r/vdT06O4/generic.nginx.security.insecure-ssl-version.insecure-ssl-version origin: community path: generic.nginx.security.insecure-ssl-version.insecure-ssl-version - id: csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings message: Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections. severity: WARNING metadata: likelihood: LOW impact: LOW confidence: LOW category: security cwe: - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies - https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL - https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL subcategory: - audit technology: - .net - asp - webforms license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cookie Security source: https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings shortlink: https://sg.run/z1jd semgrep.dev: rule: r_id: 18217 rv_id: 1262626 rule_id: 7KUxPg version_id: NdTzyXg url: https://semgrep.dev/playground/r/NdTzyXg/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings origin: community path: csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings languages: - generic paths: include: - '*web.config' patterns: - pattern-either: - pattern: | requireSSL="false" - pattern: | cookieRequireSSL="false" - pattern-either: - pattern-inside: | - pattern-inside: | - pattern-inside: | - id: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults mode: taint pattern-sources: - patterns: - focus-metavariable: $ARG - pattern-inside: | public $T $M(...,string $ARG,...){...} pattern-sinks: - patterns: - pattern: | $READER.$METHOD(...) - pattern-not-inside: | $READER.DtdProcessing = DtdProcessing.Prohibit; ... - pattern-inside: | XmlTextReader $READER = new XmlTextReader(...); ... message: XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data. languages: - csharp severity: WARNING metadata: category: security references: - https://www.jardinesoftware.net/2016/05/26/xxe-and-net/ - https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks technology: - .net - xml cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - vuln impact: MEDIUM likelihood: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults shortlink: https://sg.run/xXjL semgrep.dev: rule: r_id: 18230 rv_id: 1262656 rule_id: BYUevk version_id: l4TJRWG url: https://semgrep.dev/playground/r/l4TJRWG/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults origin: community path: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults - id: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish pattern: $CIPHER.getInstance("Blowfish") metadata: functional-categories: - crypto::search::symmetric-algorithm::javax.crypto cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish shortlink: https://sg.run/ZE4n semgrep.dev: rule: r_id: 48735 rv_id: 1263010 rule_id: 0oUR28 version_id: BjTkZy0 url: https://semgrep.dev/playground/r/BjTkZy0/java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish origin: community path: java.lang.security.audit.crypto.use-of-blowfish.use-of-blowfish message: 'Use of Blowfish was detected. Blowfish uses a 64-bit block size that makes it vulnerable to birthday attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' severity: WARNING languages: - java - id: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size patterns: - pattern-inside: cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...) - pattern: cryptography.hazmat.primitives.asymmetric.ec.$SIZE - metavariable-pattern: metavariable: $SIZE pattern-either: - pattern: SECP192R1 - pattern: SECT163K1 - pattern: SECT163R2 - focus-metavariable: $SIZE fix: | SECP256R1 message: Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'. metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves category: security technology: - cryptography subcategory: - audit likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM functional-categories: - crypto::search::key-length::cryptography license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size shortlink: https://sg.run/GeQq semgrep.dev: rule: r_id: 9448 rv_id: 1263355 rule_id: qNUjZ3 version_id: RGT0LW6 url: https://semgrep.dev/playground/r/RGT0LW6/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size origin: community path: python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size languages: - python severity: WARNING - id: yaml.github-actions.security.curl-eval.curl-eval languages: - yaml message: Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity. metadata: category: security cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections technology: - github-actions - bash - curl cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/yaml.github-actions.security.curl-eval.curl-eval shortlink: https://sg.run/9r7r semgrep.dev: rule: r_id: 14967 rv_id: 1263926 rule_id: X5Udrd version_id: YDTZe7K url: https://semgrep.dev/playground/r/YDTZe7K/yaml.github-actions.security.curl-eval.curl-eval origin: community path: yaml.github-actions.security.curl-eval.curl-eval patterns: - pattern-inside: 'steps: [...]' - pattern-inside: | - run: ... ... - pattern: 'run: $SHELL' - metavariable-pattern: language: bash metavariable: $SHELL patterns: - pattern: | $DATA=<... curl ...> ... eval <... $DATA ...> severity: ERROR - id: generic.secrets.security.detected-outlook-team.detected-outlook-team pattern-regex: https://outlook\.office\.com/webhook/[0-9a-f-]{36} languages: - regex message: Outlook Team detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets - outlook confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team shortlink: https://sg.run/1ZwQ semgrep.dev: rule: r_id: 9066 rv_id: 1262884 rule_id: d8UjXq version_id: LjTkgA1 url: https://semgrep.dev/playground/r/LjTkgA1/generic.secrets.security.detected-outlook-team.detected-outlook-team origin: community path: generic.secrets.security.detected-outlook-team.detected-outlook-team - id: generic.secrets.security.detected-slack-webhook.detected-slack-webhook patterns: - pattern-regex: https://hooks\.slack\.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24} - pattern-not: https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX languages: - regex message: Slack Webhook detected severity: ERROR metadata: references: - https://api.slack.com/messaging/webhooks source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - slack confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe: - 'CWE-798: Use of Hard-coded Credentials' cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook shortlink: https://sg.run/weWX semgrep.dev: rule: r_id: 9073 rv_id: 1262892 rule_id: gxU1dy version_id: 5PTo1oO url: https://semgrep.dev/playground/r/5PTo1oO/generic.secrets.security.detected-slack-webhook.detected-slack-webhook origin: community path: generic.secrets.security.detected-slack-webhook.detected-slack-webhook - id: python.lang.security.audit.logging.listeneval.listen-eval languages: - python message: Because portions of the logging configuration are passed through eval(), use of this function may open its users to a security risk. While the function only binds to a socket on localhost, and so does not accept connections from remote machines, there are scenarios where untrusted code could be run under the account of the process which calls listen(). To avoid this happening, use the `verify()` argument to `listen()` to prevent unrecognized configurations. metadata: cwe: - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.python.org/3/library/logging.config.html?highlight=security#logging.config.listen category: security technology: - python subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/python.lang.security.audit.logging.listeneval.listen-eval shortlink: https://sg.run/9okY semgrep.dev: rule: r_id: 9667 rv_id: 1263500 rule_id: wdUJQY version_id: RGT0L6X url: https://semgrep.dev/playground/r/RGT0L6X/python.lang.security.audit.logging.listeneval.listen-eval origin: community path: python.lang.security.audit.logging.listeneval.listen-eval severity: WARNING pattern: logging.config.listen(...) - id: kotlin.lang.security.no-null-cipher.no-null-cipher pattern: NullCipher(...) metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' category: security technology: - kotlin references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/kotlin.lang.security.no-null-cipher.no-null-cipher shortlink: https://sg.run/0ywb semgrep.dev: rule: r_id: 14698 rv_id: 1263265 rule_id: 0oU2Yy version_id: o5TbDPj url: https://semgrep.dev/playground/r/o5TbDPj/kotlin.lang.security.no-null-cipher.no-null-cipher origin: community path: kotlin.lang.security.no-null-cipher.no-null-cipher message: 'NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' severity: WARNING languages: - kt - scala - id: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1 message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications. languages: - java severity: WARNING metadata: functional-categories: - crypto::search::hash-algorithm::javax.crypto owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-328: Use of Weak Hash' source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1 asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Insecure Hashing Algorithm source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1 shortlink: https://sg.run/bXNp semgrep.dev: rule: r_id: 17326 rv_id: 1263016 rule_id: qNUWNn version_id: l4TJRpL url: https://semgrep.dev/playground/r/l4TJRpL/java.lang.security.audit.crypto.use-of-sha1.use-of-sha1 origin: community path: java.lang.security.audit.crypto.use-of-sha1.use-of-sha1 pattern-either: - patterns: - pattern: | java.security.MessageDigest.getInstance("$ALGO", ...); - metavariable-regex: metavariable: $ALGO regex: (SHA1|SHA-1) - pattern: | $DU.getSha1Digest().digest(...) - id: problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification message: Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used. severity: WARNING metadata: likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM category: security cwe: 'CWE-319: Cleartext Transmission of Sensitive Information' owasp: A03:2017 - Sensitive Data Exposure references: - https://nodejs.org/api/https.html#https_https_request_options_callback - https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100 subcategory: - vuln technology: - node.js vulnerability: Insecure Transport license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification shortlink: https://sg.run/9oxr semgrep.dev: rule: r_id: 9423 rv_id: 946067 rule_id: OrU3Y6 version_id: JdTDybO url: https://semgrep.dev/playground/r/JdTDybO/problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification origin: community path: problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification languages: - javascript - typescript pattern-either: - pattern: | process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0; - pattern: | {rejectUnauthorized:false} - id: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb message: ECB (Electronic Code Book) is the simplest mode of operation for block ciphers. Each block of data is encrypted in the same way. This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L101 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B305 references: - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes - https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption category: security technology: - cryptography subcategory: - audit likelihood: LOW impact: LOW confidence: MEDIUM functional-categories: - crypto::search::mode::cryptography license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb shortlink: https://sg.run/4xr5 semgrep.dev: rule: r_id: 9444 rv_id: 1263351 rule_id: DbUp5g version_id: PkTR3w7 url: https://semgrep.dev/playground/r/PkTR3w7/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb origin: community path: python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb severity: WARNING languages: - python pattern: cryptography.hazmat.primitives.ciphers.modes.ECB($IV) fix: cryptography.hazmat.primitives.ciphers.modes.GCM($IV) - id: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security category: security technology: - .net confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization shortlink: https://sg.run/L0AX semgrep.dev: rule: r_id: 11139 rv_id: 1262642 rule_id: x8UW7x version_id: 3ZT4X6b url: https://semgrep.dev/playground/r/3ZT4X6b/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization origin: community path: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization message: The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure patterns: - pattern-inside: | using System.Runtime.Serialization; ... - pattern: | new NetDataContractSerializer(); - id: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled shortlink: https://sg.run/2x75 semgrep.dev: rule: r_id: 9163 rv_id: 1263068 rule_id: x8Unkq version_id: jQTn5Jv url: https://semgrep.dev/playground/r/jQTn5Jv/java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled origin: community path: java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled message: XML external entities are enabled for this XMLInputFactory. This is vulnerable to XML external entity attacks. Disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false. patterns: - pattern-either: - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities", true); - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, true); - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, true); - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.TRUE); - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.TRUE); - pattern: (javax.xml.stream.XMLInputFactory $XMLFACTORY).setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, Boolean.TRUE); languages: - java - id: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization severity: WARNING languages: - java metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.3 Insecue Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://www.blackhat.com/docs/us-16/materials/us-16-Kaiser-Pwning-Your-Java-Messaging-With-Deserialization-Vulnerabilities-wp.pdf category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization shortlink: https://sg.run/zvO1 semgrep.dev: rule: r_id: 9161 rv_id: 1263065 rule_id: kxUk12 version_id: pZT03A1 url: https://semgrep.dev/playground/r/pZT03A1/java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization origin: community path: java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization message: JMS Object messages depend on Java Serialization for marshalling/unmarshalling of the message payload when ObjectMessage.getObject() is called. Deserialization of untrusted data can lead to security flaws; a remote attacker could via a crafted JMS ObjectMessage to execute arbitrary code with the permissions of the application listening/consuming JMS Messages. In this case, the JMS MessageListener consume an ObjectMessage type received inside the onMessage method, which may lead to arbitrary code execution when calling the $Y.getObject method. patterns: - pattern-inside: | public class $JMS_LISTENER implements MessageListener { ... public void onMessage(Message $JMS_MSG) { ... } } - pattern-either: - pattern-inside: $X = $Y.getObject(...); - pattern-inside: $X = ($Z) $Y.getObject(...); - id: javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization message: Detected a call to `$FUNC()` in an attempt to HTML escape the string `$STR`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`. metadata: category: security technology: - javascript - typescript owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' references: - https://www.npmjs.com/package/dompurify - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization shortlink: https://sg.run/AzoB semgrep.dev: rule: r_id: 22550 rv_id: 1263104 rule_id: kxUYE9 version_id: l4TJR1L url: https://semgrep.dev/playground/r/l4TJR1L/javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization origin: community path: javascript.audit.detect-replaceall-sanitization.detect-replaceall-sanitization languages: - javascript - typescript severity: INFO patterns: - pattern-either: - pattern: $STR.$FUNC('<', '<') - pattern: $STR.$FUNC('>', '>') - pattern: $STR.$FUNC('"', '"') - pattern: $STR.$FUNC("'", ''') - pattern: $STR.$FUNC('&', '&') - metavariable-regex: metavariable: $FUNC regex: (replace|replaceAll) - id: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled patterns: - pattern-either: - pattern: | $DF = DocumentBuilderFactory.newInstance(...) ... $DB = $DF.newDocumentBuilder(...) - patterns: - pattern: $DB = DocumentBuilderFactory.newInstance(...) - pattern-not-inside: | ... $X = $DB.newDocumentBuilder(...) - pattern: $DB = DocumentBuilderFactory.newInstance(...).newDocumentBuilder(...) - pattern-not-inside: | ... $DB.setXIncludeAware(true) ... $DB.setNamespaceAware(true) ... $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - pattern-not-inside: | ... $DB.setXIncludeAware(true) ... $DB.setNamespaceAware(true) ... $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) ... $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) - pattern-not-inside: | ... $DB.setXIncludeAware(true) ... $DB.setNamespaceAware(true) ... $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - pattern-not-inside: | ... $DB.setXIncludeAware(true) ... $DB.setNamespaceAware(true) ... $DB.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $DB.setFeature("http://xml.org/sax/features/external-parameter-entities", false) ... $DB.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) message: Document Builder being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Document builder can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality. languages: - scala severity: WARNING metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html category: security technology: - scala confidence: HIGH references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled shortlink: https://sg.run/gRQn semgrep.dev: rule: r_id: 19041 rv_id: 1263673 rule_id: 0oUwzP version_id: X0TzyRq url: https://semgrep.dev/playground/r/X0TzyRq/scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled origin: community path: scala.lang.security.audit.documentbuilder-dtd-enabled.documentbuilder-dtd-enabled - id: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des message: Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B304 references: - https://cwe.mitre.org/data/definitions/326.html - https://www.pycryptodome.org/src/cipher/cipher category: security technology: - pycryptodome subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: HIGH functional-categories: - crypto::search::symmetric-algorithm::pycryptodome - crypto::search::symmetric-algorithm::pycryptodomex license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des shortlink: https://sg.run/Z5bw semgrep.dev: rule: r_id: 33635 rv_id: 1263546 rule_id: 5rUr73 version_id: 7ZTE3G7 url: https://semgrep.dev/playground/r/7ZTE3G7/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des origin: community path: python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des options: symbolic_propagation: true severity: WARNING languages: - python pattern-either: - pattern: Cryptodome.Cipher.DES.new(...) - pattern: Crypto.Cipher.DES.new(...) - pattern: Cryptodome.Cipher.DES3.new(...) - pattern: Crypto.Cipher.DES3.new(...) - id: go.lang.security.bad_tmp.bad-tmp-file-creation message: File creation in shared tmp directory without using `io.CreateTemp`. languages: - go severity: WARNING metadata: cwe: - 'CWE-377: Insecure Temporary File' source-rule-url: https://github.com/securego/gosec category: security technology: - go confidence: LOW owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - https://pkg.go.dev/io/ioutil#TempFile - https://pkg.go.dev/os#CreateTemp - https://github.com/securego/gosec/blob/5fd2a370447223541cddb35da8d1bc707b7bb153/rules/tempfiles.go#L67 subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/go.lang.security.bad_tmp.bad-tmp-file-creation shortlink: https://sg.run/Gejn semgrep.dev: rule: r_id: 9104 rv_id: 1262965 rule_id: 6JUjnL version_id: 2KTv2pJ url: https://semgrep.dev/playground/r/2KTv2pJ/go.lang.security.bad_tmp.bad-tmp-file-creation origin: community path: go.lang.security.bad_tmp.bad-tmp-file-creation pattern-either: - pattern: ioutil.WriteFile("=~//tmp/.*$/", ...) - pattern: os.Create("=~//tmp/.*$/", ...) - pattern: os.WriteFile("=~//tmp/.*$/", ...) - id: generic.secrets.security.detected-artifactory-token.detected-artifactory-token patterns: - pattern-regex: | \bAKC[a-zA-Z0-9]{10,} - pattern-not-regex: | sha(128|256|512).* - pattern-not-regex: (?s)---BEGIN.*---\Z languages: - regex paths: exclude: - '*.svg' - '*go.sum' - '*package.json' - '*package-lock.json' - '*bundle.js' - '*pnpm-lock*' - '*Podfile.lock' - '**/*/openssl/*.h' - '*.xcscmblueprint' - '*cargo.lock' message: Artifactory token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/artifactory.py category: security technology: - secrets - artifactory confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token shortlink: https://sg.run/5Q2l semgrep.dev: rule: r_id: 9047 rv_id: 1262858 rule_id: 6JUj3l version_id: l4TJR6J url: https://semgrep.dev/playground/r/l4TJR6J/generic.secrets.security.detected-artifactory-token.detected-artifactory-token origin: community path: generic.secrets.security.detected-artifactory-token.detected-artifactory-token - id: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation patterns: - pattern-either: - pattern: urllib3.PoolManager(..., cert_reqs=$REQS, ...) - pattern: urllib3.ProxyManager(..., cert_reqs=$REQS, ...) - pattern: urllib3.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) - pattern: urllib3.connectionpool.HTTPSConnectionPool(..., cert_reqs=$REQS, ...) - pattern: urllib3.connection_from_url(..., cert_reqs=$REQS, ...) - pattern: urllib3.proxy_from_url(..., cert_reqs=$REQS, ...) - pattern: $CONTEXT.wrap_socket(..., cert_reqs=$REQS, ...) - pattern: ssl.wrap_socket(..., cert_reqs=$REQS, ...) - metavariable-regex: metavariable: $REQS regex: (NONE|CERT_NONE|CERT_OPTIONAL|ssl\.CERT_NONE|ssl\.CERT_OPTIONAL|\'NONE\'|\"NONE\"|\'OPTIONAL\'|\"OPTIONAL\") message: certificate verification explicitly disabled, insecure connections possible metadata: cwe: - 'CWE-295: Improper Certificate Validation' owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures category: security technology: - python references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation shortlink: https://sg.run/b7yp semgrep.dev: rule: r_id: 9670 rv_id: 1263506 rule_id: eqU87k version_id: K3TKkZn url: https://semgrep.dev/playground/r/K3TKkZn/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation origin: community path: python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation languages: - python severity: ERROR - id: scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode patterns: - pattern-inside: | import pdi.jwt.$DEPS ... - pattern-either: - pattern: $JWT.encode($X, "...", ...) - pattern: $JWT.decode($X, "...", ...) - pattern: $JWT.decodeRawAll($X, "...", ...) - pattern: $JWT.decodeRaw($X, "...", ...) - pattern: $JWT.decodeAll($X, "...", ...) - pattern: $JWT.validate($X, "...", ...) - pattern: $JWT.isValid($X, "...", ...) - pattern: $JWT.decodeJson($X, "...", ...) - pattern: $JWT.decodeJsonAll($X, "...", ...) - patterns: - pattern-either: - pattern: $JWT.encode($X, $KEY, ...) - pattern: $JWT.decode($X, $KEY, ...) - pattern: $JWT.decodeRawAll($X, $KEY, ...) - pattern: $JWT.decodeRaw($X, $KEY, ...) - pattern: $JWT.decodeAll($X, $KEY, ...) - pattern: $JWT.validate($X, $KEY, ...) - pattern: $JWT.isValid($X, $KEY, ...) - pattern: $JWT.decodeJson($X, $KEY, ...) - pattern: $JWT.decodeJsonAll($X, $KEY, ...) - pattern: $JWT.encode($X, this.$KEY, ...) - pattern: $JWT.decode($X, this.$KEY, ...) - pattern: $JWT.decodeRawAll($X, this.$KEY, ...) - pattern: $JWT.decodeRaw($X, this.$KEY, ...) - pattern: $JWT.decodeAll($X, this.$KEY, ...) - pattern: $JWT.validate($X, this.$KEY, ...) - pattern: $JWT.isValid($X, this.$KEY, ...) - pattern: $JWT.decodeJson($X, this.$KEY, ...) - pattern: $JWT.decodeJsonAll($X, this.$KEY, ...) - pattern-either: - pattern-inside: | class $CL { ... $KEY = "..." ... } - pattern-inside: | object $CL { ... $KEY = "..." ... } - metavariable-pattern: metavariable: $JWT patterns: - pattern-either: - pattern: Jwt - pattern: JwtArgonaut - pattern: JwtCirce - pattern: JwtJson4s - pattern: JwtJson - pattern: JwtUpickle message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' languages: - scala severity: WARNING metadata: references: - https://jwt-scala.github.io/jwt-scala/ category: security cwe: - 'CWE-522: Insufficiently Protected Credentials' owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design technology: - scala confidence: HIGH cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode shortlink: https://sg.run/8zE7 semgrep.dev: rule: r_id: 19040 rv_id: 1263669 rule_id: WAUdK0 version_id: o5TbDA8 url: https://semgrep.dev/playground/r/o5TbDA8/scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode origin: community path: scala.jwt-scala.security.jwt-scala-hardcode.jwt-scala-hardcode - id: generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key pattern-regex: (?i)sonar[a-z0-9_.-]{0,30}(token|key|login|password|pass|secret|auth)?\s*[:=]\s*(\\?["'`])?[0-9a-f]{40}\b languages: - regex message: SonarQube Docs API Key detected severity: ERROR paths: exclude: - '*.svg' - '*go.sum' - '*cargo.lock' - '*package.json' - '*yarn.lock' - '*package-lock.json' - '*bundle.js' - '*pnpm-lock*' - '*Podfile.lock' - '**/*/openssl/*.h' - '*.xcscmblueprint' metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets - sonarqube confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key shortlink: https://sg.run/x10P semgrep.dev: rule: r_id: 9074 rv_id: 1501837 rule_id: QrUzP1 version_id: bZTQ72r url: https://semgrep.dev/playground/r/bZTQ72r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key origin: community path: generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key - id: ruby.lang.security.md5-used-as-password.md5-used-as-password languages: - ruby severity: WARNING message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Instead, use a suitable password hashing function such as bcrypt. You can use the `bcrypt` gem. metadata: category: security technology: - md5 references: - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords - https://github.com/returntocorp/semgrep-rules/issues/1609 owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/ruby.lang.security.md5-used-as-password.md5-used-as-password shortlink: https://sg.run/GOZy semgrep.dev: rule: r_id: 14704 rv_id: 1263611 rule_id: oqU4p2 version_id: JdTzx0e url: https://semgrep.dev/playground/r/JdTzx0e/ruby.lang.security.md5-used-as-password.md5-used-as-password origin: community path: ruby.lang.security.md5-used-as-password.md5-used-as-password mode: taint pattern-sources: - pattern: Digest::MD5 pattern-sinks: - patterns: - pattern: $FUNCTION(...); - metavariable-regex: metavariable: $FUNCTION regex: (?i)(.*password.*) - id: yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection message: Using input or workflow parameters in here-scripts can lead to command injection or code injection. Convert the parameters to env variables instead. languages: - yaml metadata: category: security cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - "A03:2021 \u2013 Injection" confidence: MEDIUM likelihood: MEDIUM impact: HIGH subcategory: - vuln references: - https://github.com/argoproj/argo-workflows/issues/5061 - https://github.com/argoproj/argo-workflows/issues/5114#issue-808865370 technology: - ci - argo license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection - Command Injection source: https://semgrep.dev/r/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection shortlink: https://sg.run/yqeZ semgrep.dev: rule: r_id: 40768 rv_id: 1151472 rule_id: 10U0zW version_id: xyTp17z url: https://semgrep.dev/playground/r/xyTp17z/yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection origin: community path: yaml.argo.security.argo-workflow-parameter-command-injection.argo-workflow-parameter-command-injection severity: ERROR patterns: - pattern-inside: | apiVersion: $VERSION ... - metavariable-regex: metavariable: $VERSION regex: (argoproj.io.*) - pattern-either: - patterns: - pattern-inside: | command: ... - $LANG ... ... source: $SCRIPT - metavariable-regex: metavariable: $LANG regex: .*(sh|bash|ksh|csh|tcsh|zsh|python|python3|node|perl|ruby|php|lua|awk|sed|powershell|fish|dash|R|grooby|scala|clj|elixir|coffee|dart|haskell|ocaml).* - metavariable-pattern: metavariable: $SCRIPT pattern-either: - pattern-regex: (.*{{.*inputs.parameters.*}}.*) - pattern-regex: (.*{{.*workflow.parameters.*}}.*) - focus-metavariable: $SCRIPT - patterns: - pattern-either: - pattern-inside: | container: ... command: $LANG ... args: $PARAM - pattern-inside: | containerSet: ... containers: - ... command: $LANG ... args: $PARAM - metavariable-regex: metavariable: $LANG regex: .*(sh|bash|ksh|csh|tcsh|zsh|python|python3|node|perl|ruby|php|lua|awk|sed|powershell|fish|dash|R|grooby|scala|clj|elixir|coffee|dart|haskell|ocaml).* - metavariable-pattern: metavariable: $PARAM pattern-either: - pattern-regex: (.*{{.*inputs.parameters.*}}.*) - pattern-regex: (.*{{.*workflow.parameters.*}}.*) - focus-metavariable: $PARAM - id: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape message: Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks. metadata: cwe: - 'CWE-116: Improper Encoding or Escaping of Output' owasp: - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-disable-mustache-escape.js category: security technology: - mustache subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW references: - https://owasp.org/Top10/A03_2021-Injection license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Encoding source: https://semgrep.dev/r/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape shortlink: https://sg.run/Yvwd semgrep.dev: rule: r_id: 9314 rv_id: 1263213 rule_id: 9AU17r version_id: DkTRb3X url: https://semgrep.dev/playground/r/DkTRb3X/javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape origin: community path: javascript.lang.security.detect-disable-mustache-escape.detect-disable-mustache-escape languages: - javascript - typescript severity: WARNING pattern: $OBJ.escapeMarkup = false - id: generic.nginx.security.alias-path-traversal.alias-path-traversal patterns: - pattern: | location $...LOCATION { ... alias .../; ... } - metavariable-pattern: metavariable: $...LOCATION pattern-regex: ^.*[^/]$ paths: include: - '*.conf' - '*.vhost' - '**/sites-available/*' - '**/sites-enabled/*' fix-regex: regex: location\s+([A-Za-z0-9/-_\.]+) replacement: location \1/ languages: - generic severity: WARNING message: The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path. metadata: cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' source-rule-url: https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md category: security technology: - nginx confidence: LOW owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control - https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/ - https://www.youtube.com/watch?v=CIhHpkybYsY - https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal shortlink: https://sg.run/ZvNL semgrep.dev: rule: r_id: 9035 rv_id: 1262670 rule_id: 5rUOjq version_id: NdTzyBg url: https://semgrep.dev/playground/r/NdTzyBg/generic.nginx.security.alias-path-traversal.alias-path-traversal origin: community path: generic.nginx.security.alias-path-traversal.alias-path-traversal - id: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size patterns: - pattern-either: - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(..., key_size=$SIZE, ...) - pattern: cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key($SIZE, ...) - metavariable-comparison: metavariable: $SIZE comparison: $SIZE < 2048 - focus-metavariable: $SIZE fix: | 2048 message: Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher. metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/ - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf category: security technology: - cryptography subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM functional-categories: - crypto::search::key-length::cryptography license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size shortlink: https://sg.run/5Qb0 semgrep.dev: rule: r_id: 9447 rv_id: 1263354 rule_id: KxUb0x version_id: GxTkeOK url: https://semgrep.dev/playground/r/GxTkeOK/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size origin: community path: python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size languages: - python severity: WARNING - id: php.lang.security.ldap-bind-without-password.ldap-bind-without-password patterns: - pattern-either: - pattern: ldap_bind($LDAP, $DN, NULL) - pattern: ldap_bind($LDAP, $DN, '') - patterns: - pattern: ldap_bind(...) - pattern-not: ldap_bind($LDAP, $DN, $PASSWORD) message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. metadata: references: - https://www.php.net/manual/en/function.ldap-bind.php cwe: - 'CWE-287: Improper Authentication' owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures category: security technology: - php cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/php.lang.security.ldap-bind-without-password.ldap-bind-without-password shortlink: https://sg.run/18Rv semgrep.dev: rule: r_id: 13966 rv_id: 1263292 rule_id: wdUjA5 version_id: 3ZT4X56 url: https://semgrep.dev/playground/r/3ZT4X56/php.lang.security.ldap-bind-without-password.ldap-bind-without-password origin: community path: php.lang.security.ldap-bind-without-password.ldap-bind-without-password languages: - php severity: WARNING - id: java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor languages: - java metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://securitylab.github.com/research/swagger-yaml-parser-vulnerability/#snakeyaml-deserialization-vulnerability category: security technology: - snakeyaml cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor shortlink: https://sg.run/L8qY semgrep.dev: rule: r_id: 12683 rv_id: 1263067 rule_id: 6JU67x version_id: X0Tzynw url: https://semgrep.dev/playground/r/X0Tzynw/java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor origin: community path: java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor message: Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments, which is vulnerable to deserialization attacks. Use the one-argument Yaml(...) constructor instead, with SafeConstructor or a custom Constructor as the argument. patterns: - pattern: | $Y = new org.yaml.snakeyaml.Yaml(); ... $Y.load(...); severity: WARNING - id: generic.secrets.security.detected-slack-token.detected-slack-token pattern-either: - pattern-regex: (xox[pboa]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32}) - pattern-regex: xox.-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24} languages: - regex message: Slack Token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json references: - https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58 category: security technology: - secrets - slack confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token shortlink: https://sg.run/kXdz semgrep.dev: rule: r_id: 9072 rv_id: 1262891 rule_id: 8GUjRA version_id: JdTzxz3 url: https://semgrep.dev/playground/r/JdTzxz3/generic.secrets.security.detected-slack-token.detected-slack-token origin: community path: generic.secrets.security.detected-slack-token.detected-slack-token - id: generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth pattern-regex: '[fF][aA][cC][eE][bB][oO][oO][kK].*[tT][oO][kK][eE][nN].*[''|"]?[0-9a-f]{32}[''|"]?' languages: - regex message: Facebook OAuth detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - facebook confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth shortlink: https://sg.run/Klq6 semgrep.dev: rule: r_id: 9055 rv_id: 1262868 rule_id: 9AU127 version_id: 9lT4b5N url: https://semgrep.dev/playground/r/9lT4b5N/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth origin: community path: generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth - id: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - ruby severity: ERROR message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: references: - https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/EB7N semgrep.dev: rule: r_id: 18281 rv_id: 1263586 rule_id: PeUxOE version_id: d6Tyx1Z url: https://semgrep.dev/playground/r/d6Tyx1Z/ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string origin: community path: ruby.aws-lambda.security.tainted-sql-string.tainted-sql-string mode: taint pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context) ... end pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: | "...#{...}..." - pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].* - patterns: - pattern-either: - pattern: Kernel::sprintf("$SQLSTR", ...) - pattern: | "$SQLSTR" + $EXPR - pattern: | "$SQLSTR" % $EXPR - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b|\w+\s*!?[<>=].* - pattern-not-inside: | puts(...) - id: go.lang.security.zip.path-traversal-inside-zip-extraction message: File traversal when extracting zip archive metadata: cwe: - 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' source_rule_url: https://github.com/securego/gosec/issues/205 category: security technology: - go confidence: LOW owasp: - A05:2017 - Broken Access Control - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/go.lang.security.zip.path-traversal-inside-zip-extraction shortlink: https://sg.run/Av64 semgrep.dev: rule: r_id: 9106 rv_id: 1262971 rule_id: zdUkoR version_id: rxTAK1Z url: https://semgrep.dev/playground/r/rxTAK1Z/go.lang.security.zip.path-traversal-inside-zip-extraction origin: community path: go.lang.security.zip.path-traversal-inside-zip-extraction languages: - go severity: WARNING pattern: | reader, $ERR := zip.OpenReader($ARCHIVE) ... for _, $FILE := range reader.File { ... path := filepath.Join($TARGET, $FILE.Name) ... } - id: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key message: RSA keys should be at least 2048 bits based on NIST recommendation. languages: - java severity: WARNING metadata: functional-categories: - crypto::search::key-length::java.security cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms category: security technology: - java subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key shortlink: https://sg.run/4x6x semgrep.dev: rule: r_id: 9200 rv_id: 1263019 rule_id: 0oU5P5 version_id: o5TbDLY url: https://semgrep.dev/playground/r/o5TbDLY/java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key origin: community path: java.lang.security.audit.crypto.weak-rsa.use-of-weak-rsa-key patterns: - pattern: | KeyPairGenerator $KEY = $G.getInstance("RSA"); ... $KEY.initialize($BITS); - metavariable-comparison: metavariable: $BITS comparison: $BITS < 2048 - id: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ category: security technology: - ruamel.yaml cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel shortlink: https://sg.run/x1rz semgrep.dev: rule: r_id: 9674 rv_id: 1263531 rule_id: nJUzqK version_id: 9lT4bvG url: https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel origin: community path: python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel languages: - python message: Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead. severity: ERROR pattern-either: - pattern: ruamel.yaml.YAML(..., typ='unsafe', ...) - pattern: ruamel.yaml.YAML(..., typ='base', ...) - id: javascript.jose.security.jwt-none-alg.jwt-none-alg message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.3 Insecue Stateless Session Tokens control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jose - jwt subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg shortlink: https://sg.run/AvRL semgrep.dev: rule: r_id: 9294 rv_id: 1263183 rule_id: 5rUOGN version_id: ZRTKAyb url: https://semgrep.dev/playground/r/ZRTKAyb/javascript.jose.security.jwt-none-alg.jwt-none-alg origin: community path: javascript.jose.security.jwt-none-alg.jwt-none-alg languages: - javascript - typescript severity: ERROR pattern-either: - pattern: | var $JOSE = require("jose"); ... var { JWK, JWT } = $JOSE; ... var $T = JWT.verify($P, JWK.None,...); - pattern: | var $JOSE = require("jose"); ... var { JWK, JWT } = $JOSE; ... $T = JWT.verify($P, JWK.None,...); - pattern: | var $JOSE = require("jose"); ... var { JWK, JWT } = $JOSE; ... JWT.verify($P, JWK.None,...); - id: python.lang.security.deserialization.pickle.avoid-pickle metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-pickle shortlink: https://sg.run/OPwB semgrep.dev: rule: r_id: 9675 rv_id: 1263532 rule_id: EwU2BJ version_id: yeTxpEE url: https://semgrep.dev/playground/r/yeTxpEE/python.lang.security.deserialization.pickle.avoid-pickle origin: community path: python.lang.security.deserialization.pickle.avoid-pickle languages: - python message: Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. severity: WARNING patterns: - pattern-either: - pattern: pickle.$FUNC(...) - pattern: _pickle.$FUNC(...) - pattern-not: pickle.$FUNC("...") - pattern-not: _pickle.$FUNC("...") - id: yaml.kubernetes.security.privileged-container.privileged-container pattern-either: - patterns: - pattern-inside: | containers: ... - pattern-inside: | image: ... ... securityContext: ... - pattern: | privileged: true - patterns: - pattern-inside: | spec: ... - pattern-not-inside: | image: ... ... - pattern: | privileged: true message: Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability. metadata: cwe: - 'CWE-250: Execution with Unnecessary Privileges' references: - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html category: security technology: - kubernetes subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container shortlink: https://sg.run/Ygr5 semgrep.dev: rule: r_id: 10058 rv_id: 1501845 rule_id: oqUz2p version_id: d6T70JW url: https://semgrep.dev/playground/r/d6T70JW/yaml.kubernetes.security.privileged-container.privileged-container origin: community path: yaml.kubernetes.security.privileged-container.privileged-container languages: - yaml severity: WARNING - id: php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv patterns: - pattern-either: - pattern: openssl_encrypt($D, $M, $K, $FLAGS, "...",...); - pattern: openssl_decrypt($D, $M, $K, $FLAGS, "...",...); - metavariable-comparison: metavariable: $M comparison: re.match(".*-CBC",$M) message: Static IV used with AES in CBC mode. Static IVs enable chosen-plaintext attacks against encrypted data. languages: - php severity: ERROR metadata: cwe: - 'CWE-329: Generation of Predictable IV with CBC Mode' references: - https://csrc.nist.gov/publications/detail/sp/800-38a/final owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures technology: - php - openssl category: security subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv shortlink: https://sg.run/LgWJ semgrep.dev: rule: r_id: 19039 rv_id: 1263295 rule_id: DbUGbE version_id: JdTzxOD url: https://semgrep.dev/playground/r/JdTzxOD/php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv origin: community path: php.lang.security.openssl-cbc-static-iv.openssl-cbc-static-iv - id: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish message: Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B304 references: - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption - https://www.pycryptodome.org/src/cipher/cipher category: security technology: - pycryptodome subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: HIGH functional-categories: - crypto::search::symmetric-algorithm::pycryptodome - crypto::search::symmetric-algorithm::pycryptodomex license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish shortlink: https://sg.run/dlOE semgrep.dev: rule: r_id: 33634 rv_id: 1263545 rule_id: JDUGnK version_id: ExTExln url: https://semgrep.dev/playground/r/ExTExln/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish origin: community path: python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish options: symbolic_propagation: true severity: WARNING languages: - python pattern-either: - pattern: Cryptodome.Cipher.Blowfish.new(...) - pattern: Crypto.Cipher.Blowfish.new(...) - id: generic.secrets.security.detected-sauce-token.detected-sauce-token pattern-regex: (?i)sauce.{0,50}(\\\"|'|`)?[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[0-9a-f]{4}-[0-9a-f]{12}(\\\"|'|`)? languages: - regex message: Sauce Token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets - sauce confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token shortlink: https://sg.run/N4k1 semgrep.dev: rule: r_id: 9071 rv_id: 1262889 rule_id: L1UyZ5 version_id: 44TEjER url: https://semgrep.dev/playground/r/44TEjER/generic.secrets.security.detected-sauce-token.detected-sauce-token origin: community path: generic.secrets.security.detected-sauce-token.detected-sauce-token - id: csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled message: OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information. severity: WARNING metadata: likelihood: LOW impact: MEDIUM confidence: LOW category: security cwe: - 'CWE-1323: Improper Management of Sensitive Trace Data' owasp: A05:2021 - Security Misconfiguration references: - https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance - https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx subcategory: - audit technology: - .net license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled shortlink: https://sg.run/6bP1 semgrep.dev: rule: r_id: 18215 rv_id: 945193 rule_id: nJUyJq version_id: ExTg2rO url: https://semgrep.dev/playground/r/ExTg2rO/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled origin: community path: csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled languages: - generic paths: include: - '*web.config*' patterns: - pattern: | - pattern-inside: | ... - id: java.lang.security.audit.xml-decoder.xml-decoder message: XMLDecoder should not be used to parse untrusted data. Deserializing user input can lead to arbitrary code execution. Use an alternative and explicitly disable external entities. See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html for alternatives and vulnerability prevention. metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XML_DECODER references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xml-decoder.xml-decoder shortlink: https://sg.run/PJjq semgrep.dev: rule: r_id: 9189 rv_id: 1263051 rule_id: qNUj3y version_id: GxTkeY1 url: https://semgrep.dev/playground/r/GxTkeY1/java.lang.security.audit.xml-decoder.xml-decoder origin: community path: java.lang.security.audit.xml-decoder.xml-decoder severity: WARNING languages: - java patterns: - pattern: | $X $METHOD(...) { ... new XMLDecoder(...); ... } - pattern-not: | $X $METHOD(...) { ... new XMLDecoder("..."); ... } - pattern-not: |- $X $METHOD(...) { ... String $STR = "..."; ... new XMLDecoder($STR); ... } - id: python.lang.security.audit.weak-ssl-version.weak-ssl-version message: An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher. metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/insecure_ssl_tls.py#L30 asvs: section: V9 Communications Verification Requirements control_id: 9.1.3 Weak TLS control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements version: '4' references: - https://tools.ietf.org/html/rfc7568 - https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html - https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2 category: security technology: - python subcategory: - audit likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version shortlink: https://sg.run/RoZO semgrep.dev: rule: r_id: 9649 rv_id: 1263520 rule_id: KxUbNG version_id: qkTR7Ev url: https://semgrep.dev/playground/r/qkTR7Ev/python.lang.security.audit.weak-ssl-version.weak-ssl-version origin: community path: python.lang.security.audit.weak-ssl-version.weak-ssl-version languages: - python severity: WARNING pattern-either: - pattern: ssl.PROTOCOL_SSLv2 - pattern: ssl.PROTOCOL_SSLv3 - pattern: ssl.PROTOCOL_TLSv1 - pattern: ssl.PROTOCOL_TLSv1_1 - pattern: pyOpenSSL.SSL.SSLv2_METHOD - pattern: pyOpenSSL.SSL.SSLv23_METHOD - pattern: pyOpenSSL.SSL.SSLv3_METHOD - pattern: pyOpenSSL.SSL.TLSv1_METHOD - pattern: pyOpenSSL.SSL.TLSv1_1_METHOD - id: generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key pattern-regex: '[hH][eE][rR][oO][kK][uU].*[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}' languages: - regex message: Heroku API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - heroku confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key shortlink: https://sg.run/pxXR semgrep.dev: rule: r_id: 9062 rv_id: 1262877 rule_id: x8UnOB version_id: e1Tyj3N url: https://semgrep.dev/playground/r/e1Tyj3N/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key origin: community path: generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key - id: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid message: Dangerously accepting invalid TLS information pattern-either: - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_hostnames(true) - pattern: reqwest::Client::builder(). ... .danger_accept_invalid_certs(true) metadata: references: - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_hostnames - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs technology: - reqwest category: security cwe: 'CWE-295: Improper Certificate Validation' confidence: HIGH likelihood: LOW impact: MEDIUM subcategory: vuln license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid shortlink: https://sg.run/DqrG semgrep.dev: rule: r_id: 40108 rv_id: 946551 rule_id: qNUKDg version_id: 7ZTrQLJ url: https://semgrep.dev/playground/r/7ZTrQLJ/rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid origin: community path: rust.lang.security.reqwest-accept-invalid.reqwest-accept-invalid languages: - rust severity: WARNING - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 message: Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead. languages: - go severity: WARNING metadata: owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' source-rule-url: https://github.com/securego/gosec#available-rules category: security technology: - go references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 shortlink: https://sg.run/1ZAD semgrep.dev: rule: r_id: 9122 rv_id: 1262931 rule_id: v8Unl0 version_id: w8TRoRQ url: https://semgrep.dev/playground/r/w8TRoRQ/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 origin: community path: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4 patterns: - pattern-inside: | import "crypto/rc4" ... - pattern: rc4.NewCipher(...) - id: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe severity: WARNING metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser category: security technology: - java cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe shortlink: https://sg.run/XBwA semgrep.dev: rule: r_id: 9164 rv_id: 1263069 rule_id: OrU35O version_id: 1QTypQZ url: https://semgrep.dev/playground/r/1QTypQZ/java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe origin: community path: java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe message: XML external entities are not explicitly disabled for this XMLInputFactory. This could be vulnerable to XML external entity vulnerabilities. Explicitly disable external entities by setting "javax.xml.stream.isSupportingExternalEntities" to false. patterns: - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", false); ... } - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); ... } - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.FALSE); ... } - pattern-not-inside: | $METHOD(...) { ... $XMLFACTORY.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); ... } - pattern-either: - pattern: javax.xml.stream.XMLInputFactory.newFactory(...) - pattern: new XMLInputFactory(...) languages: - java - id: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size patterns: - pattern-either: - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(..., key_size=$SIZE, ...) - pattern: cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key($EXP, $SIZE, ...) - metavariable-comparison: metavariable: $SIZE comparison: $SIZE < 2048 - focus-metavariable: $SIZE fix: | 2048 message: Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher. metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/ - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf category: security technology: - cryptography subcategory: - audit likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM functional-categories: - crypto::search::key-length::cryptography license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size shortlink: https://sg.run/RoQq semgrep.dev: rule: r_id: 9449 rv_id: 1263356 rule_id: lBU9jn version_id: A8TgdPK url: https://semgrep.dev/playground/r/A8TgdPK/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size origin: community path: python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size languages: - python severity: WARNING - id: generic.secrets.security.detected-private-key.detected-private-key patterns: - pattern-either: - patterns: - pattern: '-----BEGIN $TYPE PRIVATE KEY----- $KEY' - metavariable-regex: metavariable: $TYPE regex: (?i)([dr]sa|ec|openssh|encrypted)? - patterns: - pattern: | -----BEGIN PRIVATE KEY----- $KEY - metavariable-analysis: metavariable: $KEY analyzer: entropy languages: - generic message: Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file. severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key shortlink: https://sg.run/b7dr semgrep.dev: rule: r_id: 9070 rv_id: 1262888 rule_id: 7KUQ0p version_id: 3ZT4X4Y url: https://semgrep.dev/playground/r/3ZT4X4Y/generic.secrets.security.detected-private-key.detected-private-key origin: community path: generic.secrets.security.detected-private-key.detected-private-key - id: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled shortlink: https://sg.run/1wyQ semgrep.dev: rule: r_id: 59622 rv_id: 1263062 rule_id: v8UeQ1 version_id: 6xT29GK url: https://semgrep.dev/playground/r/6xT29GK/java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled origin: community path: java.lang.security.audit.xxe.transformerfactory-dtds-not-disabled.transformerfactory-dtds-not-disabled message: DOCTYPE declarations are enabled for this TransformerFactory. This is vulnerable to XML external entity attacks. Disable this by setting the attributes "accessExternalDTD" and "accessExternalStylesheet" to "". mode: taint pattern-sources: - by-side-effect: true patterns: - pattern-either: - pattern: | $FACTORY = TransformerFactory.newInstance(); - patterns: - pattern: $FACTORY - pattern-inside: | class $C { ... $V $FACTORY = TransformerFactory.newInstance(); ... } - pattern-not-inside: | class $C { ... $V $FACTORY = TransformerFactory.newInstance(); static { ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = TransformerFactory.newInstance(); static { ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = TransformerFactory.newInstance(); static { ... $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = TransformerFactory.newInstance(); static { ... $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); ... } ... } pattern-sinks: - patterns: - pattern: $FACTORY.newTransformer(...); pattern-sanitizers: - by-side-effect: true pattern-either: - patterns: - pattern-either: - pattern: | $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); - pattern: | $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); - pattern: | $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); - pattern: | $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); - focus-metavariable: $FACTORY - patterns: - pattern-either: - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setAttribute("=~/.*accessExternalDTD.*/", ""); ... $FACTORY.setAttribute("=~/.*accessExternalStylesheet.*/", ""); ... } ... } - pattern: $M($X) - focus-metavariable: $X fix: | $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); $FACTORY.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); $FACTORY.newTransformer(...); languages: - java - id: csharp.dotnet.security.use_ecb_mode.use_ecb_mode message: Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305. severity: WARNING metadata: likelihood: HIGH impact: MEDIUM confidence: HIGH category: security cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0 - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0 - https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0 - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes subcategory: - vuln technology: - .net license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode shortlink: https://sg.run/wj9n semgrep.dev: rule: r_id: 36773 rv_id: 1262623 rule_id: 0oUqWP version_id: yeTxpPw url: https://semgrep.dev/playground/r/yeTxpPw/csharp.dotnet.security.use_ecb_mode.use_ecb_mode origin: community path: csharp.dotnet.security.use_ecb_mode.use_ecb_mode languages: - csharp patterns: - pattern-either: - pattern: ($KEYTYPE $KEY).EncryptEcb(...); - pattern: ($KEYTYPE $KEY).DecryptEcb(...); - pattern: ($KEYTYPE $KEY).Mode = CipherMode.ECB; - metavariable-pattern: metavariable: $KEYTYPE pattern-either: - pattern: SymmetricAlgorithm - pattern: Aes - pattern: Rijndael - pattern: DES - pattern: TripleDES - pattern: RC2 - id: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B303 references: - https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5 - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html category: security technology: - cryptography subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM functional-categories: - crypto::search::symmetric-algorithm::cryptography license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 shortlink: https://sg.run/eY88 semgrep.dev: rule: r_id: 33632 rv_id: 1263352 rule_id: lBUopp version_id: JdTzxww url: https://semgrep.dev/playground/r/JdTzxww/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 origin: community path: python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5 severity: WARNING languages: - python patterns: - pattern: cryptography.hazmat.primitives.hashes.$MD5() - metavariable-regex: metavariable: $MD5 regex: ^(MD5)$ - focus-metavariable: $MD5 fix: SHA256 - id: python.lang.security.deserialization.pickle.avoid-shelve metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve shortlink: https://sg.run/dKkZ semgrep.dev: rule: r_id: 9678 rv_id: 1263535 rule_id: 8GUje2 version_id: NdTzyb4 url: https://semgrep.dev/playground/r/NdTzyb4/python.lang.security.deserialization.pickle.avoid-shelve origin: community path: python.lang.security.deserialization.pickle.avoid-shelve languages: - python message: Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. severity: WARNING pattern: shelve.$FUNC(...) - id: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://find-sec-bugs.github.io/bugs.htm#SQL_INJECTION_SPRING_JDBC asvs: section: 'V5: Validation, Sanitization and Encoding Verification Requirements' control_id: 5.3.5 Injection control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements version: '4' category: security technology: - jdbc references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string shortlink: https://sg.run/dKWY semgrep.dev: rule: r_id: 9178 rv_id: 1263026 rule_id: PeUZNX version_id: 9lT4bqk url: https://semgrep.dev/playground/r/9lT4bqk/java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string origin: community path: java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string message: 'Possible JDBC injection detected. Use the parameterized query feature available in queryForObject instead of concatenating or formatting strings: ''jdbc.queryForObject("select * from table where name = ?", Integer.class, parameterName);''' patterns: - pattern-inside: | $JDBC = new JdbcTemplate(...); ... - pattern-either: - pattern: $JDBC.queryForObject($STR + $VAR, ...); - pattern: $JDBC.queryForObject(String.format(...), ...); - pattern: | String $Q = $STR + $VAR; ... $JDBC.queryForObject($Q, ...); - pattern: | String $Q = String.format(...); ... $JDBC.queryForObject($Q, ...); - pattern: | StringBuilder $Q = new StringBuilder(...); ... $Q.append($STR + $VAR); ... $JDBC.queryForObject($Q, ...); - pattern: $JDBC.queryForList($STR + $VAR); - pattern: $JDBC.queryForList(String.format(...)); - pattern: | String $Q = $STR + $VAR; ... $JDBC.queryForList($Q); - pattern: | String $Q = String.format(...); ... $JDBC.queryForList($Q); - pattern: | StringBuilder $Q = new StringBuilder(...); ... $Q.append($STR + $VAR); ... $JDBC.queryForList($Q, ...); - pattern: $JDBC.update($STR + $VAR); - pattern: $JDBC.update(String.format(...)); - pattern: | String $Q = $STR + $VAR; ... $JDBC.update($Q); - pattern: | String $Q = String.format(...); ... $JDBC.update($Q); - pattern: | StringBuilder $Q = new StringBuilder(...); ... $Q.append($STR + $VAR); ... $JDBC.update($Q, ...); - pattern: $JDBC.execute($STR + $VAR); - pattern: $JDBC.execute(String.format(...)); - pattern: | String $Q = $STR + $VAR; ... $JDBC.execute($Q); - pattern: | String $Q = String.format(...); ... $JDBC.execute($Q); - pattern: | StringBuilder $Q = new StringBuilder(...); ... $Q.append($STR + $VAR); ... $JDBC.execute($Q, ...); - pattern: $JDBC.insert($STR + $VAR); - pattern: $JDBC.insert(String.format(...)); - pattern: | String $Q = $STR + $VAR; ... $JDBC.insert($Q); - pattern: | String $Q = String.format(...); ... $JDBC.insert($Q); - pattern: | StringBuilder $Q = new StringBuilder(...); ... $Q.append($STR + $VAR); ... $JDBC.insert($Q, ...); severity: WARNING languages: - java - id: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8 category: security technology: - .net confidence: MEDIUM cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization shortlink: https://sg.run/70pG semgrep.dev: rule: r_id: 11138 rv_id: 1262641 rule_id: wdU87G version_id: QkTGqnA url: https://semgrep.dev/playground/r/QkTGqnA/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization origin: community path: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization message: The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure patterns: - pattern-inside: | using System.Web.UI; ... - pattern: | new LosFormatter(); - id: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn pattern: gets(...) message: Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead. metadata: cwe: - 'CWE-676: Use of Potentially Dangerous Function' references: - https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s category: security technology: - c confidence: MEDIUM subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Dangerous Method or Function source: https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn shortlink: https://sg.run/dKqX semgrep.dev: rule: r_id: 8834 rv_id: 945170 rule_id: GdU7OE version_id: YDTvRlQ url: https://semgrep.dev/playground/r/YDTvRlQ/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn origin: community path: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn languages: - c severity: ERROR - id: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 message: Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B304 references: - https://cwe.mitre.org/data/definitions/326.html - https://www.pycryptodome.org/src/cipher/cipher category: security technology: - pycryptodome subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: HIGH functional-categories: - crypto::search::symmetric-algorithm::pycryptodome - crypto::search::symmetric-algorithm::pycryptodomex license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 shortlink: https://sg.run/nAbY semgrep.dev: rule: r_id: 33636 rv_id: 1263547 rule_id: GdUYlW version_id: LjTkgn6 url: https://semgrep.dev/playground/r/LjTkgn6/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 origin: community path: python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2 options: symbolic_propagation: true severity: WARNING languages: - python pattern-either: - pattern: Cryptodome.Cipher.ARC2.new(...) - pattern: Crypto.Cipher.ARC2.new(...) - id: generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token pattern-regex: ya29\.[0-9A-Za-z\-_]+ languages: - regex message: Google OAuth Access Token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - google confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token shortlink: https://sg.run/ox2n semgrep.dev: rule: r_id: 9060 rv_id: 1262875 rule_id: kxUkpo version_id: xyTjzp6 url: https://semgrep.dev/playground/r/xyTjzp6/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token origin: community path: generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token - id: python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled message: Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection. options: symbolic_propagation: true metadata: cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://flask-wtf.readthedocs.io/en/1.2.x/csrf/ category: security technology: - flask cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW functional-categories: - web::search::csrf-config::flask - web::search::csrf-config::flask-wtf license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site Request Forgery (CSRF) source: https://semgrep.dev/r/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled shortlink: https://sg.run/Q5AQ semgrep.dev: rule: r_id: 9542 rv_id: 1263425 rule_id: ReUgXz version_id: pZT034X url: https://semgrep.dev/playground/r/pZT034X/python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled origin: community path: python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled severity: WARNING languages: - python patterns: - pattern-either: - patterns: - pattern-either: - pattern: $APP.config["WTF_CSRF_ENABLED"] = $FALSE - pattern: $APP.config.WTF_CSRF_ENABLED = $FALSE - patterns: - pattern: | $APP.config.$UPDATE( ..., WTF_CSRF_ENABLED = $FALSE, ... ) - pattern-not-inside: | $APP.config.$UPDATE( ..., TESTING=True, ... ) - pattern-not-inside: | $APP.config.$UPDATE( ..., DEBUG=True, ... ) - metavariable-regex: metavariable: $UPDATE regex: ^(update|from_mapping)$ - pattern: | $OBJ = $CLASS() ... $OBJ.WTF_CSRF_ENABLED = $FALSE ... $APP.config.from_object($OBJ, ...) - pattern: | WTF_CSRF_ENABLED = $FALSE ... $APP.config.from_object(__name__) - metavariable-regex: metavariable: $FALSE regex: ^(False)$ - focus-metavariable: $FALSE fix: 'True' - id: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression message: Detected use of dynamic execution of JavaScript which may come from user-input, which can lead to Cross-Site-Scripting (XSS). Where possible avoid including user-input in functions which dynamically execute user-input. metadata: cwe: - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js references: - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval! category: security technology: - javascript subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression shortlink: https://sg.run/6nwK semgrep.dev: rule: r_id: 9315 rv_id: 1263214 rule_id: yyUngo version_id: WrTqKkJ url: https://semgrep.dev/playground/r/WrTqKkJ/javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression origin: community path: javascript.lang.security.detect-eval-with-expression.detect-eval-with-expression languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | $PROP = new URLSearchParams($WINDOW. ... .location.search).get('...') ... - pattern-inside: | $PROP = new URLSearchParams(location.search).get('...') ... - pattern-inside: | $PROP = new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...') ... - pattern-inside: | $PROP = new URLSearchParams(location.hash.substring(1)).get('...') ... - focus-metavariable: $PROP - patterns: - pattern-either: - pattern-inside: | $PROPS = new URLSearchParams($WINDOW. ... .location.search) ... - pattern-inside: | $PROPS = new URLSearchParams(location.search) ... - pattern-inside: | $PROPS = new URLSearchParams($WINDOW. ... .location.hash.substring(1)) ... - pattern-inside: | $PROPS = new URLSearchParams(location.hash.substring(1)) ... - pattern: $PROPS.get('...') - focus-metavariable: $PROPS - patterns: - pattern-either: - pattern: location.href - pattern: location.hash - pattern: location.search - pattern: $WINDOW. ... .location.href - pattern: $WINDOW. ... .location.hash - pattern: $WINDOW. ... .location.search pattern-sinks: - patterns: - pattern-either: - pattern: eval(<... $SINK ...>) - pattern: window.eval(<... $SINK ...>) - pattern: new Function(<... $SINK ...>) - pattern: new Function(<... $SINK ...>)(...) - pattern: setTimeout(<... $SINK ...>,...) - pattern: setInterval(<... $SINK ...>,...) - focus-metavariable: $SINK pattern-sanitizers: - patterns: - pattern-either: - pattern: location.href = $FUNC(...) - pattern: location.hash = $FUNC(...) - pattern: location.search = $FUNC(...) - pattern: $WINDOW. ... .location.href = $FUNC(...) - pattern: $WINDOW. ... .location.hash = $FUNC(...) - pattern: $WINDOW. ... .location.search = $FUNC(...) - id: javascript.express.security.cors-misconfiguration.cors-misconfiguration message: By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings. metadata: owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe: - 'CWE-346: Origin Validation Error' category: security references: - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS technology: - express subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration shortlink: https://sg.run/nKXO semgrep.dev: rule: r_id: 13580 rv_id: 1263162 rule_id: 5rULJQ version_id: YDTZe8Y url: https://semgrep.dev/playground/r/YDTZe8Y/javascript.express.security.cors-misconfiguration.cors-misconfiguration origin: community path: javascript.express.security.cors-misconfiguration.cors-misconfiguration languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body pattern-sinks: - patterns: - pattern-either: - pattern: $RES.set($HEADER, $X) - pattern: $RES.header($HEADER, $X) - pattern: $RES.setHeader($HEADER, $X) - pattern: | $RES.set({$HEADER: $X}, ...) - pattern: | $RES.writeHead($STATUS, {$HEADER: $X}, ...) - focus-metavariable: $X - metavariable-regex: metavariable: $HEADER regex: .*(Access-Control-Allow-Origin|access-control-allow-origin).* - id: generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block pattern-regex: '-----BEGIN PGP PRIVATE KEY BLOCK-----' languages: - regex message: Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit. severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block shortlink: https://sg.run/ydKd semgrep.dev: rule: r_id: 9068 rv_id: 1262886 rule_id: nJUzXz version_id: gETB7O4 url: https://semgrep.dev/playground/r/gETB7O4/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block origin: community path: generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block - id: csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0 - https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html category: security technology: - .net confidence: LOW cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full shortlink: https://sg.run/rere semgrep.dev: rule: r_id: 18225 rv_id: 1262639 rule_id: JDUlKl version_id: 8KT5rAN url: https://semgrep.dev/playground/r/8KT5rAN/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full origin: community path: csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full message: Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf pattern-either: - patterns: - pattern-either: - pattern: new BinaryServerFormatterSinkProvider { TypeFilterLevel = $LEVEL } - patterns: - pattern-inside: | $TYPE $SP = new BinaryServerFormatterSinkProvider(...); ... - pattern: | $SP.TypeFilterLevel = $LEVEL - metavariable-regex: metavariable: $LEVEL regex: (.*)TypeFilterLevel\.(Full|Low) - patterns: - pattern-inside: | $DICT["typeFilterLevel"] = $VAL; ... - pattern: new BinaryServerFormatterSinkProvider(..., $DICT, ...) - metavariable-regex: metavariable: $VAL regex: (\"Full\"|\"Low\") - id: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 patterns: - pattern: cryptography.hazmat.primitives.hashes.$SHA(...) - metavariable-pattern: metavariable: $SHA pattern: | SHA1 - focus-metavariable: $SHA fix: | SHA256 message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B303 references: - https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1 - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html category: security technology: - cryptography subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM functional-categories: - crypto::search::symmetric-algorithm::cryptography license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 shortlink: https://sg.run/J9Qy semgrep.dev: rule: r_id: 9446 rv_id: 1263353 rule_id: 0oU5dN version_id: 5PTo1l0 url: https://semgrep.dev/playground/r/5PTo1l0/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 origin: community path: python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 severity: WARNING languages: - python - id: typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html message: Overwriting `transformLinkUri` or `transformImageUri` to something insecure, or turning `allowDangerousHtml` on, or turning `escapeHtml` off, will open the code up to XSS vectors. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://www.npmjs.com/package/react-markdown#security category: security technology: - react cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html shortlink: https://sg.run/9qAk semgrep.dev: rule: r_id: 9767 rv_id: 1263919 rule_id: kxURd4 version_id: BjTkZA8 url: https://semgrep.dev/playground/r/BjTkZA8/typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html origin: community path: typescript.react.security.react-markdown-insecure-html.react-markdown-insecure-html languages: - typescript - javascript severity: WARNING patterns: - pattern-either: - pattern-inside: | $X = require('react-markdown/with-html'); ... - pattern-inside: | $X = require('react-markdown'); ... - pattern-inside: | import 'react-markdown/with-html'; ... - pattern-inside: | import 'react-markdown'; ... - pattern-either: - pattern: | <$EL allowDangerousHtml /> - pattern: | <$EL escapeHtml={false} /> - pattern: | <$EL transformLinkUri=... /> - pattern: | <$EL transformImageUri=... /> - id: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jwt - javascript - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret shortlink: https://sg.run/4xN9 semgrep.dev: rule: r_id: 9300 rv_id: 1263189 rule_id: WAUon7 version_id: gETB75D url: https://semgrep.dev/playground/r/gETB75D/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret origin: community path: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern: "$X = '...' \n" - pattern: "$X = '$Y' \n" - patterns: - pattern-either: - pattern-inside: | $JWT.sign($DATA,"...",...); - pattern-inside: | $JWT.verify($DATA,"...",...); pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $JWT = require("jsonwebtoken") ... - pattern-inside: | import $JWT from "jsonwebtoken" ... - pattern-inside: | import * as $JWT from "jsonwebtoken" ... - pattern-inside: | import {...,$JWT,...} from "jsonwebtoken" ... - pattern-either: - pattern-inside: | $JWT.sign($DATA,$VALUE,...); - pattern-inside: | $JWT.verify($DATA,$VALUE,...); - focus-metavariable: $VALUE - id: rust.lang.security.ssl-verify-none.ssl-verify-none message: SSL verification disabled, this allows for MitM attacks pattern: $BUILDER.set_verify(openssl::ssl::SSL_VERIFY_NONE) metadata: references: - https://docs.rs/openssl/latest/openssl/ssl/struct.SslContextBuilder.html#method.set_verify technology: - openssl category: security cwe: 'CWE-295: Improper Certificate Validation' confidence: HIGH likelihood: LOW impact: MEDIUM subcategory: vuln license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/rust.lang.security.ssl-verify-none.ssl-verify-none shortlink: https://sg.run/K2Pn semgrep.dev: rule: r_id: 40111 rv_id: 946554 rule_id: 6JU0Bl version_id: gETe1bo url: https://semgrep.dev/playground/r/gETe1bo/rust.lang.security.ssl-verify-none.ssl-verify-none origin: community path: rust.lang.security.ssl-verify-none.ssl-verify-none languages: - rust severity: WARNING - id: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size message: Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher. metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://www.pycryptodome.org/src/public_key/rsa#rsa - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf category: security technology: - pycryptodome subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: HIGH functional-categories: - crypto::search::key-length::pycryptodome - crypto::search::key-length::pycryptodomex license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size shortlink: https://sg.run/PprY semgrep.dev: rule: r_id: 9689 rv_id: 1263555 rule_id: BYUBWe version_id: 5PTo1jL url: https://semgrep.dev/playground/r/5PTo1jL/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size origin: community path: python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size options: symbolic_propagation: true languages: - python severity: WARNING patterns: - pattern-either: - pattern: Crypto.PublicKey.RSA.generate(..., bits=$SIZE, ...) - pattern: Crypto.PublicKey.RSA.generate($SIZE, ...) - pattern: Cryptodome.PublicKey.RSA.generate(..., bits=$SIZE, ...) - pattern: Cryptodome.PublicKey.RSA.generate($SIZE, ...) - metavariable-comparison: metavariable: $SIZE comparison: $SIZE < 3072 - id: python.django.security.audit.xss.context-autoescape-off.context-autoescape-off message: 'Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove ''autoescape: False'' or set it to ''True''.' metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.1/ref/settings/#templates - https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off shortlink: https://sg.run/nd7Y semgrep.dev: rule: r_id: 9480 rv_id: 1263370 rule_id: 4bUknY version_id: X0Tzye3 url: https://semgrep.dev/playground/r/X0Tzye3/python.django.security.audit.xss.context-autoescape-off.context-autoescape-off origin: community path: python.django.security.audit.xss.context-autoescape-off.context-autoescape-off languages: - python severity: WARNING patterns: - pattern-either: - pattern: | {..., "autoescape": $FALSE, ...} - pattern: | $D["autoescape"] = $FALSE - metavariable-pattern: metavariable: $FALSE pattern: | False - focus-metavariable: $FALSE fix: | True - id: python.lang.security.deserialization.pickle.avoid-cPickle metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-cPickle shortlink: https://sg.run/eLxb semgrep.dev: rule: r_id: 9676 rv_id: 1263533 rule_id: 7KUQNL version_id: rxTAKEq url: https://semgrep.dev/playground/r/rxTAKEq/python.lang.security.deserialization.pickle.avoid-cPickle origin: community path: python.lang.security.deserialization.pickle.avoid-cPickle languages: - python message: Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. severity: WARNING patterns: - pattern: cPickle.$FUNC(...) - pattern-not: cPickle.$FUNC("...") - id: generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value patterns: - pattern-regex: \b(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b - pattern-not-regex: (?i)example|sample|test|fake languages: - regex message: AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file. severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets - aws confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value shortlink: https://sg.run/GeD1 semgrep.dev: rule: r_id: 9048 rv_id: 1262859 rule_id: oqUevO version_id: YDTZenE url: https://semgrep.dev/playground/r/YDTZenE/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value origin: community path: generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value - id: generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token pattern-either: - pattern-regex: EAACEdEose0cBA[0-9A-Za-z]+ - pattern-regex: EAAAACZAVC6ygB[0-9A-Za-z]+ - pattern-regex: EAAAAZAw4[0-9A-Za-z]+ languages: - regex message: Facebook Access Token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets - facebook confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token shortlink: https://sg.run/0QYJ semgrep.dev: rule: r_id: 9054 rv_id: 1262867 rule_id: 10UKBL version_id: 1QTyp7J url: https://semgrep.dev/playground/r/1QTyp7J/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token origin: community path: generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token - id: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token. severity: ERROR metadata: owasp: - A05:2021 - Security Misconfiguration - A07:2021 - Identification and Authentication Failures - A02:2025 - Security Misconfiguration - A07:2025 - Authentication Failures cwe: - 'CWE-287: Improper Authentication' - 'CWE-345: Insufficient Verification of Data Authenticity' - 'CWE-347: Improper Verification of Cryptographic Signature' category: security subcategory: - vuln technology: - jwt-simple - jwt confidence: HIGH likelihood: MEDIUM impact: HIGH references: - https://www.npmjs.com/package/jwt-simple - https://cwe.mitre.org/data/definitions/287 - https://cwe.mitre.org/data/definitions/345 - https://cwe.mitre.org/data/definitions/347 license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues - Improper Authentication source: https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify shortlink: https://sg.run/zdjod semgrep.dev: rule: r_id: 120561 rv_id: 1263191 rule_id: r6UyNLy version_id: 3ZT4Xxv url: https://semgrep.dev/playground/r/3ZT4Xxv/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify origin: community path: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify languages: - javascript - typescript patterns: - pattern-inside: | $JWT = require('jwt-simple'); ... - pattern: $JWT.decode($TOKEN, $SECRET, $NOVERIFY, ...) - metavariable-pattern: metavariable: $NOVERIFY patterns: - pattern-either: - pattern: | true - pattern: | "..." - id: generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token patterns: - pattern: $AUTHTOKEN = $VALUE - metavariable-regex: metavariable: $AUTHTOKEN regex: _(authToken|auth|password) - pattern-not: $AUTHTOKEN = ${...} languages: - generic message: NPM registry authentication token detected paths: include: - '*npmrc*' severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' category: security technology: - secrets - npm confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token shortlink: https://sg.run/Ppg3 semgrep.dev: rule: r_id: 10045 rv_id: 1262883 rule_id: 5rU4pe version_id: 7ZTE3n2 url: https://semgrep.dev/playground/r/7ZTE3n2/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token origin: community path: generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token - id: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ category: security technology: - jwt confidence: HIGH references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: HIGH impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg shortlink: https://sg.run/Av14 semgrep.dev: rule: r_id: 9150 rv_id: 1262981 rule_id: zdUkzR version_id: ZRTKADq url: https://semgrep.dev/playground/r/ZRTKADq/java.java-jwt.security.jwt-none-alg.java-jwt-none-alg origin: community path: java.java-jwt.security.jwt-none-alg.java-jwt-none-alg languages: - java severity: ERROR pattern-either: - pattern: | $JWT.sign(com.auth0.jwt.algorithms.Algorithm.none()); - pattern: | $NONE = com.auth0.jwt.algorithms.Algorithm.none(); ... $JWT.sign($NONE); - pattern: |- class $CLASS { ... $TYPE $NONE = com.auth0.jwt.algorithms.Algorithm.none(); ... $RETURNTYPE $FUNC (...) { ... $JWT.sign($NONE); ... } ... } - id: scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret languages: - scala message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' metadata: category: security cwe: - 'CWE-522: Insufficiently Protected Credentials' owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ technology: - jwt confidence: HIGH references: - https://owasp.org/Top10/A04_2021-Insecure_Design cwe2021-top25: true subcategory: - audit likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret shortlink: https://sg.run/Z40o semgrep.dev: rule: r_id: 15079 rv_id: 1263691 rule_id: OrU6W1 version_id: 7ZTE3kr url: https://semgrep.dev/playground/r/7ZTE3kr/scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret origin: community path: scala.scala-jwt.security.jwt-hardcode.scala-jwt-hardcoded-secret pattern-either: - pattern: | com.auth0.jwt.algorithms.Algorithm.HMAC256("..."); - pattern: | $SECRET = "..."; ... com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET); - pattern: | class $CLASS { ... $DECL $SECRET = "..."; ... def $FUNC (...): $RETURNTYPE = { ... com.auth0.jwt.algorithms.Algorithm.HMAC256($SECRET); ... } ... } - pattern: | com.auth0.jwt.algorithms.Algorithm.HMAC384("..."); - pattern: | $SECRET = "..."; ... com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET); - pattern: | class $CLASS { ... $DECL $SECRET = "..."; ... def $FUNC (...): $RETURNTYPE = { ... com.auth0.jwt.algorithms.Algorithm.HMAC384($SECRET); ... } ... } - pattern: | com.auth0.jwt.algorithms.Algorithm.HMAC512("..."); - pattern: | $SECRET = "..."; ... com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET); - pattern: | class $CLASS { ... $DECL $SECRET = "..."; ... def $FUNC (...): $RETURNTYPE = { ... com.auth0.jwt.algorithms.Algorithm.HMAC512($SECRET); ... } ... } severity: ERROR - id: python.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - python message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: references: - https://owasp.org/www-community/attacks/SQL_Injection category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/wXvA semgrep.dev: rule: r_id: 18273 rv_id: 1263346 rule_id: AbU3LX version_id: 8KT5ron url: https://semgrep.dev/playground/r/8KT5ron/python.aws-lambda.security.tainted-sql-string.tainted-sql-string origin: community path: python.aws-lambda.security.tainted-sql-string.tainted-sql-string mode: taint pattern-sinks: - patterns: - pattern-either: - pattern: | "$SQLSTR" + ... - pattern: | "$SQLSTR" % ... - pattern: | "$SQLSTR".format(...) - pattern: | f"$SQLSTR{...}..." - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*= - pattern-not-inside: | print(...) pattern-sources: - patterns: - pattern: event - pattern-inside: | def $HANDLER(event, context): ... severity: ERROR - id: csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization severity: ERROR languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks category: security technology: - .net confidence: LOW cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization shortlink: https://sg.run/0nJq semgrep.dev: rule: r_id: 11198 rv_id: 1262640 rule_id: PeUkrK version_id: gETB7Jr url: https://semgrep.dev/playground/r/gETB7Jr/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization origin: community path: csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization message: The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server. patterns: - pattern-inside: | using System.Web.Script.Serialization; ... - pattern: | new JavaScriptSerializer((SimpleTypeResolver $RESOLVER)) - id: generic.secrets.security.detected-codeclimate.detected-codeclimate pattern-regex: (?i)codeclima.{0,50}["|'|`]?[0-9a-f]{64}["|'|`]? languages: - regex message: CodeClimate detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets - codeclimate confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate shortlink: https://sg.run/W8yz semgrep.dev: rule: r_id: 9053 rv_id: 1262865 rule_id: j2UvW7 version_id: X0Tzy2o url: https://semgrep.dev/playground/r/X0Tzy2o/generic.secrets.security.detected-codeclimate.detected-codeclimate origin: community path: generic.secrets.security.detected-codeclimate.detected-codeclimate - id: clojure.lang.security.use-of-sha1.use-of-sha1 languages: - clojure severity: WARNING message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications. metadata: references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html technology: - clojure owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - 'CWE-328: Use of Weak Hash' category: security subcategory: - vuln confidence: HIGH likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues - Insecure Hashing Algorithm source: https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1 shortlink: https://sg.run/dvwX semgrep.dev: rule: r_id: 71534 rv_id: 1262610 rule_id: NbUy12 version_id: K3TKk7E url: https://semgrep.dev/playground/r/K3TKk7E/clojure.lang.security.use-of-sha1.use-of-sha1 origin: community path: clojure.lang.security.use-of-sha1.use-of-sha1 patterns: - pattern-either: - pattern: (MessageDigest/getInstance $ALGO) - pattern: (java.security.MessageDigest/getInstance $ALGO) - metavariable-regex: metavariable: $ALGO regex: (((org\.apache\.commons\.codec\.digest\.)?MessageDigestAlgorithms/)?"?(SHA-1|SHA1)"?) - id: php.lang.security.php-permissive-cors.php-permissive-cors patterns: - pattern: header($VALUE,...) - pattern-either: - pattern: header("...",...) - pattern-inside: | $VALUE = "..."; ... - metavariable-regex: metavariable: $VALUE regex: (\'|\")\s*(Access-Control-Allow-Origin|access-control-allow-origin)\s*:\s*(\*)\s*(\'|\") message: Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions. metadata: references: - https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe: - 'CWE-346: Origin Validation Error' category: security technology: - php subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/php.lang.security.php-permissive-cors.php-permissive-cors shortlink: https://sg.run/y1XR semgrep.dev: rule: r_id: 13968 rv_id: 1263296 rule_id: OrU6JZ version_id: 5PTo1KA url: https://semgrep.dev/playground/r/5PTo1KA/php.lang.security.php-permissive-cors.php-permissive-cors origin: community path: php.lang.security.php-permissive-cors.php-permissive-cors languages: - php severity: WARNING - id: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea message: IDEA (International Data Encryption Algorithm) is a block cipher created in 1991. It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys. It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B304 references: - https://tools.ietf.org/html/rfc5469 - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA category: security technology: - cryptography subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM functional-categories: - crypto::search::symmetric-algorithm::cryptography license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea shortlink: https://sg.run/3xyK semgrep.dev: rule: r_id: 9443 rv_id: 1263350 rule_id: BYUNPg version_id: 44TEjNJ url: https://semgrep.dev/playground/r/44TEjNJ/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea origin: community path: python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea severity: WARNING languages: - python patterns: - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$IDEA($KEY) - metavariable-regex: metavariable: $IDEA regex: ^(IDEA)$ - focus-metavariable: $IDEA fix: AES - id: php.lang.security.mcrypt-use.mcrypt-use patterns: - pattern: $FUNC(...); - metavariable-regex: metavariable: $FUNC regex: (mcrypt_|mdecrypt_).+ message: Mcrypt functionality has been deprecated and/or removed in recent PHP versions. Consider using Sodium or OpenSSL. metadata: cwe: - 'CWE-676: Use of Potentially Dangerous Function' references: - https://www.php.net/manual/en/intro.mcrypt.php - https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php category: security technology: - php subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Dangerous Method or Function source: https://semgrep.dev/r/php.lang.security.mcrypt-use.mcrypt-use shortlink: https://sg.run/BkZR semgrep.dev: rule: r_id: 9395 rv_id: 946006 rule_id: 5rUOzK version_id: QkTZz5p url: https://semgrep.dev/playground/r/QkTZz5p/php.lang.security.mcrypt-use.mcrypt-use origin: community path: php.lang.security.mcrypt-use.mcrypt-use languages: - php severity: ERROR - id: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' metadata: cwe: - 'CWE-522: Insufficiently Protected Credentials' owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design references: - https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ category: security technology: - jwt cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret shortlink: https://sg.run/l2E9 semgrep.dev: rule: r_id: 9557 rv_id: 1263452 rule_id: X5U8P5 version_id: PkTR3X3 url: https://semgrep.dev/playground/r/PkTR3X3/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret origin: community path: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret patterns: - pattern: | jwt.encode($_, "...", ...) languages: - python severity: ERROR - id: python.lang.security.audit.md5-used-as-password.md5-used-as-password severity: WARNING message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`. languages: - python metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://tools.ietf.org/html/rfc6151 - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords - https://github.com/returntocorp/semgrep-rules/issues/1609 - https://docs.python.org/3/library/hashlib.html#hashlib.scrypt category: security technology: - pycryptodome - hashlib - md5 subcategory: - vuln likelihood: HIGH impact: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password shortlink: https://sg.run/5DwD semgrep.dev: rule: r_id: 14703 rv_id: 1263504 rule_id: 6JU1w1 version_id: WrTqKDz url: https://semgrep.dev/playground/r/WrTqKDz/python.lang.security.audit.md5-used-as-password.md5-used-as-password origin: community path: python.lang.security.audit.md5-used-as-password.md5-used-as-password mode: taint pattern-sources: - patterns: - pattern-either: - pattern: hashlib.md5 - pattern: hashlib.new(..., name="MD5", ...) - pattern: Cryptodome.Hash.MD5 - pattern: Crypto.Hash.MD5 - pattern: cryptography.hazmat.primitives.hashes.MD5 pattern-sinks: - patterns: - pattern: $FUNCTION(...) - metavariable-regex: metavariable: $FUNCTION regex: (?i)(.*password.*) - id: generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key pattern-regex: (?i)snyk.{0,50}['|"|`]?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}['"\s]? languages: - regex message: Snyk API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' category: security technology: - secrets - snyk confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key shortlink: https://sg.run/lxO9 semgrep.dev: rule: r_id: 12857 rv_id: 1262893 rule_id: OrUD9J version_id: GxTkek0 url: https://semgrep.dev/playground/r/GxTkek0/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key origin: community path: generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key - id: generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key pattern-regex: sk_live_[0-9a-z]{32} languages: - regex message: Picatic API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - picatic confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key shortlink: https://sg.run/rdGA semgrep.dev: rule: r_id: 9069 rv_id: 1262887 rule_id: EwU274 version_id: QkTGqwK url: https://semgrep.dev/playground/r/QkTGqwK/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key origin: community path: generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key - id: problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification message: Checks for redefinitions of functions that check TLS/SSL certificate verification. This can lead to vulnerabilities, as simple errors in the code can result in lack of proper certificate validation. This should only be used for debugging purposes because it leads to vulnerability to MTM attacks. severity: WARNING metadata: likelihood: HIGH impact: MEDIUM confidence: MEDIUM category: security cwe: 'CWE-319: Cleartext Transmission of Sensitive Information' owasp: A03:2017 - Sensitive Data Exposure references: - https://stackoverflow.com/questions/4072585/disabling-ssl-certificate-validation-in-spring-resttemplate - https://stackoverflow.com/questions/35530558/how-to-fix-unsafe-implementation-of-x509trustmanager-in-android-app?rq=1 subcategory: - vuln technology: - spring vulnerability: Insecure Transport license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification shortlink: https://sg.run/W822 semgrep.dev: rule: r_id: 9409 rv_id: 946052 rule_id: zdUkZZ version_id: 44TZkpg url: https://semgrep.dev/playground/r/44TZkpg/problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification origin: community path: problem-based-packs.insecure-transport.java-spring.bypass-tls-verification.bypass-tls-verification languages: - java pattern-either: - pattern: | new HostnameVerifier() { ... public boolean verify(String hostname, SSLSession session) { ... } ... }; - pattern: | public RestTemplate restTemplate() throws KeyStoreException, NoSuchAlgorithmException, KeyManagementException { ... TrustStrategy $FUNCNAME = (X509Certificate[] chain, String authType) -> ...; ... } - pattern: | TrustStrategy $FUNCNAME= new TrustStrategy() { ... public boolean isTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException { ... } ... }; - id: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe message: If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' category: security technology: - xml2json cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe shortlink: https://sg.run/l27o semgrep.dev: rule: r_id: 9357 rv_id: 1263253 rule_id: 10UKpB version_id: GxTkeg8 url: https://semgrep.dev/playground/r/GxTkeg8/javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe origin: community path: javascript.xml2json.security.audit.xml2json-xxe.xml2json-xxe languages: - javascript - typescript severity: WARNING patterns: - pattern: | var $XML = require('xml2json'); ... $XML.toJson(...); - pattern-not: | var $XML = require('xml2json'); ... $XML.toJson("...",...); - pattern-not: |- var $XML = require('xml2json'); ... var $S = "..."; ... $XML.toJson($S,...); - id: java.lang.security.audit.permissive-cors.permissive-cors message: https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS Permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks. metadata: cwe: - 'CWE-183: Permissive List of Allowed Inputs' asvs: section: 'V14: Configuration Verification Requirements' control_id: 14.4.8 Permissive CORS control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x22-V14-Config.md#v144-http-security-headers-requirements version: '4' category: security technology: - java owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design references: - https://owasp.org/Top10/A04_2021-Insecure_Design subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Validation source: https://semgrep.dev/r/java.lang.security.audit.permissive-cors.permissive-cors shortlink: https://sg.run/8y77 semgrep.dev: rule: r_id: 9184 rv_id: 1263033 rule_id: BYUN66 version_id: xyTjz0p url: https://semgrep.dev/playground/r/xyTjz0p/java.lang.security.audit.permissive-cors.permissive-cors origin: community path: java.lang.security.audit.permissive-cors.permissive-cors severity: WARNING languages: - java pattern-either: - pattern: | HttpServletResponse $RES = ...; ... $RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); - pattern: | HttpServletResponse $RES = ...; ... $RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); - pattern: | ServerHttpResponse $RES = ...; ... $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); - pattern: | HttpHeaders $HEADERS = ...; ... $HEADERS.set("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); - pattern: | ServerWebExchange $SWE = ...; ... $SWE.getResponse().getHeaders().add("Access-Control-Allow-Origin", "*"); - pattern: | $X $METHOD(...,HttpServletResponse $RES,...) { ... $RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); ... } - pattern: | $X $METHOD(...,HttpServletResponse $RES,...) { ... $RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); ... } - pattern: | $X $METHOD(...,ServerHttpResponse $RES,...) { ... $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); ... } - pattern: | $X $METHOD(...,ServerWebExchange $SWE,...) { ... $SWE.getResponse().getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i"); ... } - pattern: ResponseEntity.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i") - pattern: ServerResponse.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i") - id: json.aws.security.public-s3-bucket.public-s3-bucket languages: - json message: Detected public S3 bucket. This policy allows anyone to have some kind of access to the bucket. The exact level of access and types of actions allowed will depend on the configuration of bucket policy and ACLs. Please review the bucket configuration to make sure they are set with intended values. metadata: category: security cwe: - 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control references: - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html technology: - aws subcategory: - vuln likelihood: LOW impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/json.aws.security.public-s3-bucket.public-s3-bucket shortlink: https://sg.run/lxv5 semgrep.dev: rule: r_id: 13413 rv_id: 1263254 rule_id: 7KUpLy version_id: RGT0Ld0 url: https://semgrep.dev/playground/r/RGT0Ld0/json.aws.security.public-s3-bucket.public-s3-bucket origin: community path: json.aws.security.public-s3-bucket.public-s3-bucket patterns: - pattern-inside: | $BUCKETNAME: { "Type": "AWS::S3::Bucket", "Properties": { ..., }, ..., } - pattern-either: - pattern: | "PublicAccessBlockConfiguration": { ..., "RestrictPublicBuckets": false, ..., }, - pattern: | "PublicAccessBlockConfiguration": { ..., "IgnorePublicAcls": false, ..., }, - pattern: | "PublicAccessBlockConfiguration": { ..., "BlockPublicAcls": false, ..., }, - pattern: | "PublicAccessBlockConfiguration": { ..., "BlockPublicPolicy": false, ..., }, severity: WARNING - id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV message: Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable severity: WARNING metadata: likelihood: LOW impact: LOW confidence: LOW category: security cwe: - 'CWE-489: Active Debug Code' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://bento.dev/checks/flask/avoid-hardcoded-config/ - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features subcategory: - audit technology: - flask license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Active Debug Code source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV shortlink: https://sg.run/7oXW semgrep.dev: rule: r_id: 9538 rv_id: 1263421 rule_id: PeUZpr version_id: YDTZeKr url: https://semgrep.dev/playground/r/YDTZeKr/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV origin: community path: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV languages: - python pattern-either: - pattern: $M.update(ENV="=~/^development|production$/") - pattern: $M.config['ENV'] = "=~/^development|production$/" - id: javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent message: Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it. metadata: references: - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' category: security technology: - express cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent shortlink: https://sg.run/n8Ag semgrep.dev: rule: r_id: 22080 rv_id: 1263139 rule_id: 2ZUY52 version_id: ZRTKAXb url: https://semgrep.dev/playground/r/ZRTKAXb/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent origin: community path: javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent languages: - javascript - typescript severity: WARNING patterns: - pattern-either: - patterns: - pattern-either: - pattern: $VM.runInContext("$CMD", ...) - pattern: $VM.runInNewContext("$CMD", ...) - pattern: $VM.runInThisContext("$CMD", ...) - pattern: $VM.compileFunction("$CMD", ...) - metavariable-pattern: metavariable: $CMD language: typescript pattern-either: - pattern: | $LIBXML.parseXml($DATA, {..., noent: true, ...}, ...) - patterns: - pattern-inside: | $OPTS = {..., noent: true, ...} ... - pattern: $LIBXML.parseXml( $DATA, $OPTS ) - pattern: | $LIBXML.parseXml($DATA, {..., noent: true, ...}, ...) - patterns: - pattern-inside: | $OPTS = {..., noent: true, ...} ... - pattern: $LIBXML.parseXml( $DATA, $OPTS ) - id: ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ category: security technology: - jwt references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg shortlink: https://sg.run/R8kE semgrep.dev: rule: r_id: 9705 rv_id: 1263591 rule_id: 0oUExR version_id: LjTkgO6 url: https://semgrep.dev/playground/r/LjTkgO6/ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg origin: community path: ruby.jwt.security.jwt-none-alg.ruby-jwt-none-alg languages: - ruby severity: ERROR patterns: - pattern-inside: | require 'jwt' ... - pattern: | JWT.encode($PAYLOAD, $SECRET, 'none', ...) - id: python.django.security.audit.xss.global-autoescape-off.global-autoescape-off message: 'Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove ''autoescape: False'' or set it to ''True''.' metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.1/ref/settings/#templates - https://docs.djangoproject.com/en/3.1/topics/templates/#django.template.backends.django.DjangoTemplates category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off shortlink: https://sg.run/LwG6 semgrep.dev: rule: r_id: 9483 rv_id: 1263374 rule_id: 5rUOXK version_id: yeTxp93 url: https://semgrep.dev/playground/r/yeTxp93/python.django.security.audit.xss.global-autoescape-off.global-autoescape-off origin: community path: python.django.security.audit.xss.global-autoescape-off.global-autoescape-off languages: - python severity: WARNING patterns: - pattern: | {..., 'BACKEND': ..., 'OPTIONS': {..., 'autoescape': $FALSE, ...}, ...} - metavariable-pattern: metavariable: $FALSE pattern: | False - focus-metavariable: $FALSE fix: | True - id: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated pattern: ssl.wrap_socket(...) message: '''ssl.wrap_socket()'' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using ''ssl.SSLContext()'' and use that to wrap a socket.' metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://docs.python.org/3/library/ssl.html#ssl.wrap_socket - https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket category: security technology: - python subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated shortlink: https://sg.run/PJOY semgrep.dev: rule: r_id: 9645 rv_id: 1263516 rule_id: BYUN2e version_id: DkTRbgn url: https://semgrep.dev/playground/r/DkTRbgn/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated origin: community path: python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated languages: - python severity: WARNING - id: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager metadata: cwe: - 'CWE-295: Improper Certificate Validation' owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_TRUST_MANAGER asvs: section: V9 Communications Verification Requirements control_id: 9.2.1 Weak TLS control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements version: '4' references: - https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https category: security technology: - java subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager shortlink: https://sg.run/GePy semgrep.dev: rule: r_id: 9204 rv_id: 1263007 rule_id: YGUR9A version_id: GxTkel1 url: https://semgrep.dev/playground/r/GxTkel1/java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager origin: community path: java.lang.security.audit.crypto.ssl.insecure-trust-manager.insecure-trust-manager message: Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for more information. severity: WARNING languages: - java patterns: - pattern-either: - pattern-inside: | class $CLASS implements X509TrustManager { ... } - pattern-inside: | new X509TrustManager() { ... } - pattern-inside: | class $CLASS implements X509ExtendedTrustManager { ... } - pattern-inside: | new X509ExtendedTrustManager() { ... } - pattern-not: public void checkClientTrusted(...) { $SOMETHING; } - pattern-not: public void checkServerTrusted(...) { $SOMETHING; } - pattern-either: - pattern: public void checkClientTrusted(...) {} - pattern: public void checkServerTrusted(...) {} - pattern: public X509Certificate[] getAcceptedIssuers(...) { return null; } - id: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak patterns: - pattern-regex: ^(AIza[0-9A-Za-z_-]{35}(?!\S))$ message: Detects potential Google Maps API keys in code languages: - generic severity: WARNING metadata: description: Detects potential Google Maps API keys in code severity: MEDIUM category: security confidence: MEDIUM impact: HIGH likelihood: MEDIUM subcategory: - audit owasp: - A3:2017 Sensitive Data Exposure references: - https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e cwe: - 'CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory' technology: - Google Maps license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak shortlink: https://sg.run/DL5d semgrep.dev: rule: r_id: 52196 rv_id: 945530 rule_id: EwU3kN version_id: NdTqkGz url: https://semgrep.dev/playground/r/NdTqkGz/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak origin: community path: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak - id: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission message: Detected file permissions that are overly permissive (read, write, and execute). It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. Instead, follow the principle of least privilege and give users only the permissions they need. severity: WARNING languages: - java metadata: cwe: - 'CWE-276: Incorrect Default Permissions' owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control source-rule-url: https://find-sec-bugs.github.io/bugs.htm#OVERLY_PERMISSIVE_FILE_PERMISSION category: security technology: - java references: - https://owasp.org/Top10/A01_2021-Broken_Access_Control cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission shortlink: https://sg.run/LwzJ semgrep.dev: rule: r_id: 9183 rv_id: 1263032 rule_id: AbUzwB version_id: w8TRoNn url: https://semgrep.dev/playground/r/w8TRoNn/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission origin: community path: java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission pattern-either: - pattern: java.nio.file.Files.setPosixFilePermissions($FILE, java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/")); - pattern: | $TYPE $P = java.nio.file.attribute.PosixFilePermissions.fromString("=~/(^......r..$)|(^.......w.$)|(^........x$)/"); ... java.nio.file.Files.setPosixFilePermissions($FILE, $P); - pattern: | $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_READ); ... java.nio.file.Files.setPosixFilePermissions($FILE, $P); - pattern: | $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_WRITE); ... java.nio.file.Files.setPosixFilePermissions($FILE, $P); - pattern: |- $P.add(java.nio.file.attribute.PosixFilePermission.OTHERS_EXECUTE); ... java.nio.file.Files.setPosixFilePermissions($FILE, $P); - id: javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version message: TLS1.0 and TLS1.1 are deprecated and should not be used anymore. By default, NodeJS used TLSv1.2. So, TLS min version must not be downgrade to TLS1.0 or TLS1.1. Enforce TLS1.3 is highly recommended This rule checks TLS configuration only for PostgreSQL, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious. metadata: cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://node-postgres.com/features/ssl - https://nodejs.org/api/tls.html#tls_class_tls_tlssocket - https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options - https://nodejs.org/api/tls.html#tls_tls_default_min_version category: security technology: - sequelize subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version shortlink: https://sg.run/bDrq semgrep.dev: rule: r_id: 9970 rv_id: 1263244 rule_id: wdU8GB version_id: LjTkgJy url: https://semgrep.dev/playground/r/LjTkgJy/javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version origin: community path: javascript.sequelize.security.audit.sequelize-weak-tls-version.sequelize-weak-tls-version languages: - javascript - typescript severity: WARNING patterns: - pattern-inside: | { host: $HOST, database: $DATABASE, dialect: $DIALECT, dialectOptions: { ssl: ... } } - pattern-either: - pattern: | { minVersion: 'TLSv1' } - pattern: | { minVersion: 'TLSv1.1' } - metavariable-regex: metavariable: $DIALECT regex: '[''"](mariadb|mysql|postgres)[''"]' - id: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode patterns: - pattern-either: - patterns: - pattern: | jwt.decode(..., options={..., "verify_signature": $BOOL, ...}, ...) - metavariable-pattern: metavariable: $BOOL pattern: | False - focus-metavariable: $BOOL - patterns: - pattern: | $OPTS = {..., "verify_signature": $BOOL, ...} ... jwt.decode(..., options=$OPTS, ...) - metavariable-pattern: metavariable: $BOOL pattern: | False - focus-metavariable: $BOOL message: Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified. metadata: owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe: - 'CWE-287: Improper Authentication' references: - https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96 category: security technology: - jwt cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode shortlink: https://sg.run/6nyB semgrep.dev: rule: r_id: 9559 rv_id: 1263454 rule_id: 10UKjo version_id: 5PTo12w url: https://semgrep.dev/playground/r/5PTo12w/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode origin: community path: python.jwt.security.unverified-jwt-decode.unverified-jwt-decode fix: | True severity: ERROR languages: - python - id: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 message: Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html category: security technology: - pycryptodome subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: HIGH functional-categories: - crypto::search::hash-algorithm::pycryptodome - crypto::search::hash-algorithm::pycryptodomex license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 shortlink: https://sg.run/7JP2 semgrep.dev: rule: r_id: 33638 rv_id: 1263550 rule_id: AbU0Ex version_id: QkTGqD8 url: https://semgrep.dev/playground/r/QkTGqD8/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 origin: community path: python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2 options: symbolic_propagation: true severity: WARNING languages: - python pattern-either: - pattern: Crypto.Hash.MD2.new(...) - pattern: Cryptodome.Hash.MD2.new (...) - id: rust.lang.security.rustls-dangerous.rustls-dangerous message: Dangerous client config used, ensure SSL verification pattern-either: - pattern: rustls::client::DangerousClientConfig - pattern: $CLIENT.dangerous().set_certificate_verifier(...) - pattern: | let $CLIENT = rustls::client::ClientConfig::dangerous(...); ... $CLIENT.set_certificate_verifier(...); metadata: references: - https://docs.rs/rustls/latest/rustls/client/struct.DangerousClientConfig.html - https://docs.rs/rustls/latest/rustls/client/struct.ClientConfig.html#method.dangerous technology: - rustls category: security cwe: 'CWE-295: Improper Certificate Validation' confidence: HIGH likelihood: LOW impact: MEDIUM subcategory: vuln license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/rust.lang.security.rustls-dangerous.rustls-dangerous shortlink: https://sg.run/01Rw semgrep.dev: rule: r_id: 40110 rv_id: 946553 rule_id: YGU8LK version_id: 8KTKjdO url: https://semgrep.dev/playground/r/8KTKjdO/rust.lang.security.rustls-dangerous.rustls-dangerous origin: community path: rust.lang.security.rustls-dangerous.rustls-dangerous languages: - rust severity: WARNING - id: java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization patterns: - pattern-either: - patterns: - pattern-inside: | ObjectMapper $OM = new ObjectMapper(...); ... - pattern-inside: | $OM.enableDefaultTyping(); ... - pattern: $OM.readValue($JSON, ...); - patterns: - pattern-inside: | class $CLASS { ... @JsonTypeInfo(use = Id.CLASS,...) $TYPE $VAR; ... } - metavariable-regex: metavariable: $TYPE regex: (Object|Serializable|Comparable) - pattern: $OM.readValue($JSON, $CLASS.class); - patterns: - pattern-inside: | class $CLASS { ... ObjectMapper $OM; ... $INITMETHODTYPE $INITMETHOD(...) { ... $OM = new ObjectMapper(); ... $OM.enableDefaultTyping(); ... } ... } - pattern-inside: "$METHODTYPE $METHOD(...) {\n ... \n}\n" - pattern: $OM.readValue($JSON, ...); message: When using Jackson to marshall/unmarshall JSON to Java objects, enabling default typing is dangerous and can lead to RCE. If an attacker can control `$JSON` it might be possible to provide a malicious JSON which can be used to exploit unsecure deserialization. In order to prevent this issue, avoid to enable default typing (globally or by using "Per-class" annotations) and avoid using `Object` and other dangerous types for member variable declaration which creating classes for Jackson based deserialization. languages: - java severity: WARNING metadata: category: security subcategory: - audit cwe: - 'CWE-502: Deserialization of Untrusted Data' confidence: MEDIUM likelihood: LOW impact: HIGH owasp: - A8:2017 Insecure Deserialization - A8:2021 Software and Data Integrity Failures references: - https://swapneildash.medium.com/understanding-insecure-implementation-of-jackson-deserialization-7b3d409d2038 - https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://adamcaudill.com/2017/10/04/exploiting-jackson-rce-cve-2017-7525/ technology: - jackson license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization shortlink: https://sg.run/GDop semgrep.dev: rule: r_id: 56948 rv_id: 945724 rule_id: QrUD20 version_id: 2KTYbA9 url: https://semgrep.dev/playground/r/2KTYbA9/java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization origin: community path: java.lang.security.jackson-unsafe-deserialization.jackson-unsafe-deserialization - id: kotlin.lang.security.weak-rsa.use-of-weak-rsa-key message: RSA keys should be at least 2048 bits based on NIST recommendation. languages: - kt severity: WARNING metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_KEY_SIZE asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms category: security technology: - kotlin subcategory: - audit likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key shortlink: https://sg.run/krq7 semgrep.dev: rule: r_id: 15128 rv_id: 1263269 rule_id: nJUZNL version_id: X0TzypE url: https://semgrep.dev/playground/r/X0TzypE/kotlin.lang.security.weak-rsa.use-of-weak-rsa-key origin: community path: kotlin.lang.security.weak-rsa.use-of-weak-rsa-key patterns: - pattern-either: - pattern: | $KEY = $G.getInstance("RSA") ... $KEY.initialize($BITS) - metavariable-comparison: metavariable: $BITS comparison: $BITS < 2048 - id: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 message: Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B304 references: - https://cwe.mitre.org/data/definitions/326.html - https://www.pycryptodome.org/src/cipher/cipher category: security technology: - pycryptodome subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: HIGH functional-categories: - crypto::search::symmetric-algorithm::pycryptodome - crypto::search::symmetric-algorithm::pycryptodomex license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 shortlink: https://sg.run/Eo6N semgrep.dev: rule: r_id: 33637 rv_id: 1263548 rule_id: ReUnEB version_id: 8KT5rXY url: https://semgrep.dev/playground/r/8KT5rXY/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 origin: community path: python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4 severity: WARNING languages: - python pattern-either: - pattern: Cryptodome.Cipher.ARC4.new(...) - pattern: Crypto.Cipher.ARC4.new(...) - id: generic.ci.security.bash-reverse-shell.bash_reverse_shell metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' category: security technology: - ci confidence: HIGH owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true subcategory: - audit likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell shortlink: https://sg.run/4l9l semgrep.dev: rule: r_id: 16200 rv_id: 1262664 rule_id: gxUJrJ version_id: jQTn5QE url: https://semgrep.dev/playground/r/jQTn5QE/generic.ci.security.bash-reverse-shell.bash_reverse_shell origin: community path: generic.ci.security.bash-reverse-shell.bash_reverse_shell message: Semgrep found a bash reverse shell severity: ERROR languages: - generic pattern-either: - pattern: | sh -i >& /dev/udp/.../... 0>&1 - pattern: | <...>/dev/tcp/.../...; sh <&... >&... 2>& - pattern: | <...>/dev/tcp/.../...; cat <&... | while read line; do $line 2>&... >&...;done - pattern: | sh -i ...<...> /dev/tcp/.../... ...<&... 1>&... 2>& - id: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead. languages: - java severity: WARNING metadata: functional-categories: - crypto::search::hash-algorithm::org.apache.commons owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-328: Use of Weak Hash' source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Insecure Hashing Algorithm source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils shortlink: https://sg.run/AWL2 semgrep.dev: rule: r_id: 39194 rv_id: 1263012 rule_id: BYUGK0 version_id: WrTqK7K url: https://semgrep.dev/playground/r/WrTqK7K/java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils origin: community path: java.lang.security.audit.crypto.use-of-md5-digest-utils.use-of-md5-digest-utils patterns: - pattern: | $DU.$GET_ALGO().digest(...) - metavariable-pattern: metavariable: $GET_ALGO pattern: getMd5Digest - metavariable-pattern: metavariable: $DU pattern: DigestUtils - focus-metavariable: $GET_ALGO fix: | getSha512Digest - id: csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide category: security technology: - .net confidence: LOW cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver shortlink: https://sg.run/yXjP semgrep.dev: rule: r_id: 18224 rv_id: 1262636 rule_id: PeUxb0 version_id: ExTExqN url: https://semgrep.dev/playground/r/ExTExqN/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver origin: community path: csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver message: Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior. patterns: - pattern: | class $MYDCR : DataContractResolver { ... } - id: python.cryptography.security.empty-aes-key.empty-aes-key message: Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption. patterns: - pattern: AES.new("",...) languages: - python severity: WARNING metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' - 'CWE-310: Cryptographic Issues' references: - https://cwe.mitre.org/data/definitions/327.html - https://cwe.mitre.org/data/definitions/310.html category: security subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM owasp: A6:2017 misconfiguration functional-categories: - crypto::search::key-length::pycrypto - crypto::search::key-length::pycryptodome technology: - python - pycrypto - pycryptodome license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key shortlink: https://sg.run/zQ9G semgrep.dev: rule: r_id: 44817 rv_id: 946105 rule_id: OrUADK version_id: 8KTKjRg url: https://semgrep.dev/playground/r/8KTKjRg/python.cryptography.security.empty-aes-key.empty-aes-key origin: community path: python.cryptography.security.empty-aes-key.empty-aes-key - id: generic.unicode.security.bidi.contains-bidirectional-characters patterns: - pattern-either: - pattern-regex: "\u202A" - pattern-regex: "\u202B" - pattern-regex: "\u202D" - pattern-regex: "\u202E" - pattern-regex: "\u2066" - pattern-regex: "\u2067" - pattern-regex: "\u2068" - pattern-regex: "\u202C" - pattern-regex: "\u2069" message: This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters. metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' category: security technology: - unicode references: - https://trojansource.codes/ confidence: LOW owasp: - A03:2021 - Injection - A05:2025 - Injection cwe2022-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters shortlink: https://sg.run/nK4r semgrep.dev: rule: r_id: 14880 rv_id: 1262904 rule_id: d8UeX4 version_id: JdTzxzn url: https://semgrep.dev/playground/r/JdTzxzn/generic.unicode.security.bidi.contains-bidirectional-characters origin: community path: generic.unicode.security.bidi.contains-bidirectional-characters languages: - bash - c - csharp - go - java - javascript - json - kotlin - lua - ocaml - php - python - ruby - rust - scala - sh - typescript - yaml severity: WARNING - id: java.lang.security.audit.java-reverse-shell.java-reverse-shell patterns: - pattern-either: - pattern: | Socket $S=new Socket(...); ... InputStream $SI = $S.getInputStream(); ... while(!$S.isClosed()) { ... while($SI.available()>0)$PO.write($SI.read()); ... $SO.flush(); ... } - pattern-inside: | Process $P=new ProcessBuilder(...).redirectErrorStream(true).start(); ... $P.destroy(); message: Semgrep found potential reverse shell behavior severity: WARNING metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' category: security technology: - java owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/java.lang.security.audit.java-reverse-shell.java-reverse-shell shortlink: https://sg.run/kkrX semgrep.dev: rule: r_id: 11928 rv_id: 1263025 rule_id: KxUY7b version_id: 1QTyp3Z url: https://semgrep.dev/playground/r/1QTyp3Z/java.lang.security.audit.java-reverse-shell.java-reverse-shell origin: community path: java.lang.security.audit.java-reverse-shell.java-reverse-shell languages: - java - id: generic.secrets.security.detected-artifactory-password.detected-artifactory-password patterns: - pattern-regex: (?\bAP[\dABCDEF][a-zA-Z0-9]{8,}) - pattern-regex: .*(?i)arti[-_]?factory.* - pattern-not-regex: .*(?i)sha(1|2|3|118|256|512).* - pattern-not-regex: (?i)-----\s*?BEGIN[ A-Z0-9_-]*? KEY( BLOCK)?-----[\s\S]*?-----\s*?END[ A-Z0-9_-]*?\s*?----- - metavariable-analysis: analyzer: entropy metavariable: $ITEM - pattern-not-regex: (\w|\.|\*)\1{4} languages: - regex paths: exclude: - '*.svg' - '*go.sum' - '*package.json' - '*cargo.lock' - '*package-lock.json' - '*bundle.js' - '*pnpm-lock*' - '*Podfile.lock' - '**/*/openssl/*.h' - '*.xcscmblueprint' message: Artifactory token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/artifactory.py category: security technology: - secrets - artifactory confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password shortlink: https://sg.run/J9KZ semgrep.dev: rule: r_id: 9046 rv_id: 1262857 rule_id: YGUR5K version_id: qkTR7BB url: https://semgrep.dev/playground/r/qkTR7BB/generic.secrets.security.detected-artifactory-password.detected-artifactory-password origin: community path: generic.secrets.security.detected-artifactory-password.detected-artifactory-password - id: csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation severity: WARNING languages: - csharp metadata: cwe: - 'CWE-295: Improper Certificate Validation' owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8 category: security technology: - .net confidence: MEDIUM subcategory: - vuln likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation shortlink: https://sg.run/XZ6B semgrep.dev: rule: r_id: 18220 rv_id: 1262629 rule_id: gxUy01 version_id: xyTjzGW url: https://semgrep.dev/playground/r/xyTjzGW/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation origin: community path: csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation message: Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead. patterns: - pattern-inside: | using System.IdentityModel.Tokens; ... - pattern-either: - patterns: - pattern-either: - pattern-inside: | X509SecurityToken $TOK = $RHS; ... - pattern-inside: | $T $M(..., X509SecurityToken $TOK, ...) { ... } - metavariable-pattern: metavariable: $RHS pattern-either: - pattern: $T as X509SecurityToken - pattern: new X509SecurityToken(...) - patterns: - pattern-either: - pattern-inside: | X509Certificate2 $CERT = new X509Certificate2(...); ... - pattern-inside: | $T $M(..., X509Certificate2 $CERT, ...) { ... } - pattern-inside: | foreach (X509Certificate2 $CERT in $COLLECTION) { ... } - patterns: - pattern-either: - pattern: String.Equals($NAME, "...") - pattern: String.Equals("...", $NAME) - pattern: $NAME.Equals("...") - pattern: $NAME == "..." - pattern: $NAME != "..." - pattern: | "..." == $NAME - pattern: | "..." != $NAME - metavariable-pattern: metavariable: $NAME pattern-either: - pattern: $TOK.Certificate.SubjectName.Name - pattern: $CERT.SubjectName.Name - pattern: $CERT.GetNameInfo(...) - id: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token. metadata: cwe: - 'CWE-345: Insufficient Verification of Data Authenticity' owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ category: security technology: - jwt confidence: MEDIUM references: - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify shortlink: https://sg.run/Bk95 semgrep.dev: rule: r_id: 9151 rv_id: 1262979 rule_id: pKUOE9 version_id: vdT06Lp url: https://semgrep.dev/playground/r/vdT06Lp/java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify origin: community path: java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify languages: - java severity: WARNING patterns: - pattern: | com.auth0.jwt.JWT.decode(...); - pattern-not-inside: |- class $CLASS { ... $RETURNTYPE $FUNC (...) { ... $VERIFIER.verify(...); ... } } - id: yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster pattern: | cluster: ... insecure-skip-tls-verify: true message: 'Cluster is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the ''insecure-skip-tls-verify: true'' key to secure communication.' metadata: cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' references: - https://kubernetes.io/docs/reference/config-api/client-authentication.v1beta1/#client-authentication-k8s-io-v1beta1-Cluster category: security technology: - kubernetes owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster shortlink: https://sg.run/okyn semgrep.dev: rule: r_id: 10116 rv_id: 1263943 rule_id: zdUyWx version_id: O9Tpxbo url: https://semgrep.dev/playground/r/O9Tpxbo/yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster origin: community path: yaml.kubernetes.security.skip-tls-verify-cluster.skip-tls-verify-cluster languages: - yaml severity: WARNING - id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING message: Hardcoded variable `TESTING` detected. Use environment variables or config files instead severity: WARNING metadata: likelihood: LOW impact: LOW confidence: LOW category: security cwe: - 'CWE-489: Active Debug Code' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://bento.dev/checks/flask/avoid-hardcoded-config/ - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features subcategory: - audit technology: - flask license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Active Debug Code source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING shortlink: https://sg.run/ndZ2 semgrep.dev: rule: r_id: 9536 rv_id: 1263419 rule_id: 3qUPoy version_id: qkTR7P1 url: https://semgrep.dev/playground/r/qkTR7P1/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING origin: community path: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING languages: - python pattern-either: - pattern: $M.config['TESTING'] = True - pattern: $M.config['TESTING'] = False - pattern: $M.update(TESTING=True, ...) - pattern: $M.update(TESTING=False, ...) - id: generic.secrets.security.detected-ssh-password.detected-ssh-password pattern-regex: sshpass -p\s*['|\\\"][^%] languages: - regex message: SSH Password detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets - ssh confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password shortlink: https://sg.run/vzDR semgrep.dev: rule: r_id: 9077 rv_id: 1262898 rule_id: PeUZ4d version_id: WrTqKqY url: https://semgrep.dev/playground/r/WrTqKqY/generic.secrets.security.detected-ssh-password.detected-ssh-password origin: community path: generic.secrets.security.detected-ssh-password.detected-ssh-password - id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing shortlink: https://sg.run/PYBz semgrep.dev: rule: r_id: 18245 rv_id: 1263058 rule_id: 10UPQB version_id: K3TKk80 url: https://semgrep.dev/playground/r/K3TKk80/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing origin: community path: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing message: DOCTYPE declarations are enabled for this DocumentBuilderFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities" and "http://xml.org/sax/features/external-parameter-entities" to false. mode: taint pattern-sources: - by-side-effect: true patterns: - pattern-either: - pattern: | $FACTORY = DocumentBuilderFactory.newInstance(); - patterns: - pattern: $FACTORY - pattern-inside: | class $C { ... $V $FACTORY = DocumentBuilderFactory.newInstance(); ... } - pattern-not-inside: | class $C { ... $V $FACTORY = DocumentBuilderFactory.newInstance(); static { ... $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = DocumentBuilderFactory.newInstance(); static { ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = DocumentBuilderFactory.newInstance(); static { ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... } ... } pattern-sinks: - patterns: - pattern: $FACTORY.newDocumentBuilder(); pattern-sanitizers: - by-side-effect: true pattern-either: - patterns: - pattern-either: - pattern: | $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - pattern: | $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - pattern: | $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); - focus-metavariable: $FACTORY - patterns: - pattern-either: - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false); ... } ... } - pattern: $M($X) - focus-metavariable: $X fix: | $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); $FACTORY.newDocumentBuilder(); languages: - java - id: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES message: Detected DES cipher algorithm which is insecure. The algorithm is considered weak and has been deprecated. Use AES instead. languages: - go severity: WARNING metadata: owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' source-rule-url: https://github.com/securego/gosec#available-rules category: security technology: - go references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES shortlink: https://sg.run/jREA semgrep.dev: rule: r_id: 9121 rv_id: 1262930 rule_id: eqU8B3 version_id: kbTzGzA url: https://semgrep.dev/playground/r/kbTzGzA/go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES origin: community path: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-DES patterns: - pattern-inside: | import "crypto/des" ... - pattern-either: - pattern: | des.NewTripleDESCipher(...) - pattern: | des.NewCipher(...) - id: typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard message: 'Unescaped ''.'' character in CORS domain regex $CORS: $PATTERN' metadata: cwe: - 'CWE-183: Permissive List of Allowed Inputs' category: security technology: - cors owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design references: - https://owasp.org/Top10/A04_2021-Insecure_Design subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Validation source: https://semgrep.dev/r/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard shortlink: https://sg.run/w13x semgrep.dev: rule: r_id: 11929 rv_id: 1263908 rule_id: qNUbXo version_id: WrTqKwN url: https://semgrep.dev/playground/r/WrTqKwN/typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard origin: community path: typescript.lang.security.audit.cors-regex-wildcard.cors-regex-wildcard languages: - ts severity: WARNING patterns: - pattern-either: - pattern: $CORS = [...,/$PATTERN/,...] - pattern: $CORS = /$PATTERN/ - focus-metavariable: $PATTERN - metavariable-regex: metavariable: $PATTERN regex: .+?(?|=)\s*(?P[A-Za-z0-9/+=]{16,}) - pattern-not-regex: (?i)example|sample|test|fake - metavariable-analysis: analyzer: entropy metavariable: $TOKEN languages: - regex message: AWS Session Token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go category: security technology: - secrets - aws confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token shortlink: https://sg.run/DoRW semgrep.dev: rule: r_id: 9052 rv_id: 1262863 rule_id: X5U8Er version_id: pZT03Lx url: https://semgrep.dev/playground/r/pZT03Lx/generic.secrets.security.detected-aws-session-token.detected-aws-session-token origin: community path: generic.secrets.security.detected-aws-session-token.detected-aws-session-token - id: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key message: Disabled host key verification detected. This allows man-in-the-middle attacks. Use the 'golang.org/x/crypto/ssh/knownhosts' package to do host key verification. See https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ to learn more about the problem and how to fix it. metadata: cwe: - 'CWE-322: Key Exchange without Entity Authentication' owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/securego/gosec references: - https://skarlso.github.io/2019/02/17/go-ssh-with-host-key-verification/ - https://gist.github.com/Skarlso/34321a230cf0245018288686c9e70b2d category: security technology: - go confidence: MEDIUM subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key shortlink: https://sg.run/Yv6X semgrep.dev: rule: r_id: 9114 rv_id: 1262922 rule_id: r6UrW9 version_id: X0TzyzN url: https://semgrep.dev/playground/r/X0TzyzN/go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key origin: community path: go.lang.security.audit.crypto.insecure_ssh.avoid-ssh-insecure-ignore-host-key languages: - go severity: WARNING pattern: ssh.InsecureIgnoreHostKey() - id: javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite message: 'The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: ''{{{ ... }}}''.' metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://github.com/janl/mustache.js/#variables category: security technology: - express cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite shortlink: https://sg.run/7oWe semgrep.dev: rule: r_id: 9282 rv_id: 1263155 rule_id: GdU7Ew version_id: BjTkZGD url: https://semgrep.dev/playground/r/BjTkZGD/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite origin: community path: javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite languages: - javascript - typescript severity: WARNING pattern-either: - pattern: Mustache.escape = ... - patterns: - pattern-inside: | $MUSTACHE = require("mustache"); ... - pattern: $MUSTACHE.escape = ... - id: python.lang.security.insecure-hash-function.insecure-hash-function message: Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/hashlib_new_insecure_functions.py asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.2 Insecure Custom Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' references: - https://tools.ietf.org/html/rfc6151 - https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html category: security technology: - python subcategory: - audit likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function shortlink: https://sg.run/rdBn semgrep.dev: rule: r_id: 9625 rv_id: 1501841 rule_id: OrU30g version_id: xyT0gk7 url: https://semgrep.dev/playground/r/xyT0gk7/python.lang.security.insecure-hash-function.insecure-hash-function origin: community path: python.lang.security.insecure-hash-function.insecure-hash-function languages: - python severity: WARNING patterns: - pattern-either: - pattern: hashlib.new("=~/[M|m][D|d][4|5]/", ...) - pattern: hashlib.new(..., name="=~/[M|m][D|d][4|5]/", ...) - pattern-not: hashlib.new(..., usedforsecurity=False, ...) - id: yaml.github-actions.security.run-shell-injection.run-shell-injection languages: - yaml message: 'Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".' metadata: category: security cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections - https://securitylab.github.com/research/github-actions-untrusted-input/ technology: - github-actions cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection shortlink: https://sg.run/pkzk semgrep.dev: rule: r_id: 13162 rv_id: 1501844 rule_id: v8UjQj version_id: vdTowy6 url: https://semgrep.dev/playground/r/vdTowy6/yaml.github-actions.security.run-shell-injection.run-shell-injection origin: community path: yaml.github-actions.security.run-shell-injection.run-shell-injection patterns: - pattern-inside: 'steps: [...]' - pattern-inside: | - run: ... ... - pattern: 'run: $SHELL' - metavariable-pattern: language: generic metavariable: $SHELL patterns: - pattern-either: - pattern: ${{ ... github.event.issue.title ... }} - pattern: ${{ ... github.event.issue.body ... }} - pattern: ${{ ... github.event.pull_request.title ... }} - pattern: ${{ ... github.event.pull_request.body ... }} - pattern: ${{ ... github.event.comment.body ... }} - pattern: ${{ ... github.event.review.body ... }} - pattern: ${{ ... github.event.review_comment.body ... }} - pattern: ${{ ... github.event.pages ... .page_name ... }} - pattern: ${{ ... github.event.head_commit.message ... }} - pattern: ${{ ... github.event.head_commit.author.email ... }} - pattern: ${{ ... github.event.head_commit.author.name ... }} - pattern: ${{ ... github.event.commits ... .author.email ... }} - pattern: ${{ ... github.event.commits ... .author.name ... }} - pattern: ${{ ... github.event.commits ... .message ... }} - pattern: ${{ ... github.event.pull_request.head.ref ... }} - pattern: ${{ ... github.event.pull_request.head.label ... }} - pattern: ${{ ... github.event.pull_request.head.repo.default_branch ... }} - pattern: ${{ ... github.ref ... }} - pattern: ${{ ... github.base_ref ... }} - pattern: ${{ ... github.head_ref ... }} - pattern: ${{ ... github.ref_name ... }} - pattern: ${{ ... github.event.inputs ... }} - pattern: ${{ ... github.event.discussion.title ... }} - pattern: ${{ ... github.event.discussion.body ... }} - pattern: ${{ ... github.event.workflow_run.head_branch ... }} - pattern: ${{ ... github.event.workflow_run.head_commit.message ... }} - pattern: ${{ ... github.event.milestone.title ... }} - pattern: ${{ ... github.event.milestone.description ... }} - pattern: ${{ ... github.event.project_card.note ... }} - pattern: ${{ ... github.event.project.name ... }} - pattern: ${{ ... github.event.project_column.name ... }} - pattern: ${{ ... github.event.release.name ... }} - pattern: ${{ ... github.event.release.body ... }} - pattern: ${{ ... github.event.deployment.ref ... }} - pattern: ${{ ... inputs ... }} - pattern-not: ${{ ... github.event.issue.title && ... }} - pattern-not: ${{ ... github.event.issue.body && ... }} - pattern-not: ${{ ... github.event.pull_request.title && ... }} - pattern-not: ${{ ... github.event.pull_request.body && ... }} - pattern-not: ${{ ... github.event.comment.body && ... }} - pattern-not: ${{ ... github.event.review.body && ... }} - pattern-not: ${{ ... github.event.review_comment.body && ... }} - pattern-not: ${{ ... github.event.pages ... .page_name && ... }} - pattern-not: ${{ ... github.event.head_commit.message && ... }} - pattern-not: ${{ ... github.event.head_commit.author.email && ... }} - pattern-not: ${{ ... github.event.head_commit.author.name && ... }} - pattern-not: ${{ ... github.event.commits ... .author.email && ... }} - pattern-not: ${{ ... github.event.commits ... .author.name && ... }} - pattern-not: ${{ ... github.event.commits ... .message && ... }} - pattern-not: ${{ ... github.event.pull_request.head.ref && ... }} - pattern-not: ${{ ... github.event.pull_request.head.label && ... }} - pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch && ... }} - pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ... }} - pattern-not: ${{ ... github.ref && ... }} - pattern-not: ${{ ... github.base_ref && ... }} - pattern-not: ${{ ... github.head_ref && ... }} - pattern-not: ${{ ... github.ref_name && ... }} - pattern-not: ${{ ... github.event.inputs && ... }} - pattern-not: ${{ ... github.event.discussion.title && ... }} - pattern-not: ${{ ... github.event.discussion.body && ... }} - pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }} - pattern-not: ${{ ... github.event.milestone.title && ... }} - pattern-not: ${{ ... github.event.milestone.description && ... }} - pattern-not: ${{ ... github.event.project_card.note && ... }} - pattern-not: ${{ ... github.event.project.name && ... }} - pattern-not: ${{ ... github.event.project_column.name && ... }} - pattern-not: ${{ ... github.event.release.name && ... }} - pattern-not: ${{ ... github.event.release.body && ... }} - pattern-not: ${{ ... github.event.deployment.ref && ... }} severity: ERROR - id: package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age pattern-either: - patterns: - pattern-regex: (?ms)\[install\](?P[^\[]*?)(?=\[|\z) - metavariable-regex: metavariable: $TARGET regex: ^(?![\s\S]*minimumReleaseAge) - focus-metavariable: $TARGET - patterns: - pattern-regex: minimumReleaseAge\s*=\s*\d+ - pattern-regex: =\s*(?P\d+) - metavariable-comparison: metavariable: $AGE comparison: int($AGE) < 604800 - focus-metavariable: $AGE - patterns: - pattern-regex: (?m)minimumReleaseAge[ \t]*=[ \t]*(?P[^\s\d][^\n]*) - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)minimumReleaseAge\s*=\s*$ message: 'This bunfig.toml does not set a minimum release age or sets it too low. Newly published packages can be malicious or unstable. Add `minimumReleaseAge = 604800` under the `[install]` section to wait 7 days before resolving newly published package versions. Added in: v1.3 Reference: https://bun.sh/docs/runtime/bunfig' languages: - generic severity: MEDIUM paths: include: - '**/bunfig.toml' - '**/.bunfig.toml' metadata: category: security technology: - bun - javascript cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' owasp: - A08:2021 - Software and Data Integrity Failures confidence: HIGH likelihood: LOW impact: HIGH subcategory: - audit vulnerability_class: - Insecure Configuration references: - https://bun.sh/docs/runtime/bunfig license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age shortlink: https://sg.run/JqPrR semgrep.dev: rule: r_id: 291646 rv_id: 1423385 rule_id: oqUyJOb version_id: BjTyRe5 url: https://semgrep.dev/playground/r/BjTyRe5/package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age origin: community path: package_managers.bun.bun-missing-minimum-release-age.bun-missing-minimum-release-age - id: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml message: Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html category: security confidence: MEDIUM technology: - react cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml shortlink: https://sg.run/rAx6 semgrep.dev: rule: r_id: 9769 rv_id: 1263912 rule_id: x8UWvK version_id: l4TJR0v url: https://semgrep.dev/playground/r/l4TJR0v/typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml origin: community path: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml languages: - typescript - javascript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | function ...({..., $X, ...}) { ... } - pattern-inside: | function ...(..., $X, ...) { ... } - focus-metavariable: $X - pattern-not-inside: | $F. ... .$SANITIZEUNC(...) pattern-sinks: - patterns: - focus-metavariable: $X - pattern-either: - pattern: | {...,dangerouslySetInnerHTML: {__html: $X},...} - pattern: | <$Y ... dangerouslySetInnerHTML={{__html: $X}} /> - pattern-not: | <$Y ... dangerouslySetInnerHTML={{__html: "..."}} /> - pattern-not: | {...,dangerouslySetInnerHTML:{__html: "..."},...} - metavariable-pattern: patterns: - pattern-not: | {...} metavariable: $X - pattern-not: | <... {__html: "..."} ...> - pattern-not: | <... {__html: `...`} ...> pattern-sanitizers: - patterns: - pattern-either: - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | import * as $S from "underscore.string" ... - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | $S = require("underscore.string") ... - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - pattern-inside: | import $S from "dompurify" ... - pattern-inside: | import { ..., $S,... } from "dompurify" ... - pattern-inside: | import * as $S from "dompurify" ... - pattern-inside: | $S = require("dompurify") ... - pattern-inside: | import $S from "isomorphic-dompurify" ... - pattern-inside: | import * as $S from "isomorphic-dompurify" ... - pattern-inside: | $S = require("isomorphic-dompurify") ... - pattern-either: - patterns: - pattern-inside: | $VALUE = $S(...) ... - pattern: $VALUE.sanitize(...) - patterns: - pattern-inside: | $VALUE = $S.sanitize ... - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'xss'; ... - pattern-inside: | import * as $S from 'xss'; ... - pattern-inside: | $S = require("xss") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'sanitize-html'; ... - pattern-inside: | import * as $S from "sanitize-html"; ... - pattern-inside: | $S = require("sanitize-html") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | $S = new Remarkable() ... - pattern: $S.render(...) - id: javascript.node-expat.security.audit.expat-xxe.expat-xxe message: If unverified user data can reach the XML Parser it can result in XML External or Internal Entity (XXE) Processing vulnerabilities metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' category: security technology: - node-expat cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.node-expat.security.audit.expat-xxe.expat-xxe shortlink: https://sg.run/eLdL semgrep.dev: rule: r_id: 9332 rv_id: 1263224 rule_id: gxU171 version_id: 2KTv2AZ url: https://semgrep.dev/playground/r/2KTv2AZ/javascript.node-expat.security.audit.expat-xxe.expat-xxe origin: community path: javascript.node-expat.security.audit.expat-xxe.expat-xxe languages: - javascript - typescript severity: WARNING patterns: - pattern-either: - pattern: | var $EXPAT = require('node-expat'); ... new $EXPAT.Parser(...); ... $PARSER.parse(...); - pattern: | var $EXPAT = require('node-expat'); ... new $EXPAT.Parser(...); ... $PARSER.write(...); - pattern: | require('node-expat'); ... new Parser(...); ... $PARSER.parse(...); - pattern: | require('node-expat'); ... new Parser(...); ... $PARSER.write(...); - pattern-not: | var $EXPAT = require('node-expat'); ... new $EXPAT.Parser(...); ... $PARSER.parse("..."); - pattern-not: | var $EXPAT = require('node-expat'); ... new $EXPAT.Parser(...); ... $PARSER.write("..."); - pattern-not: | require('node-expat'); ... new Parser(...); ... $PARSER.parse("..."); - pattern-not: | require('node-expat'); ... new Parser(...); ... $PARSER.write("..."); - pattern-not: | $X = "..."; ... $PARSER.parse($X); - pattern-not: |- $X = "..."; ... $PARSER.write($X); - id: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector message: Initialization Vectors (IVs) for block ciphers should be randomly generated each time they are used. Using a static IV means the same plaintext encrypts to the same ciphertext every time, weakening the strength of the encryption. metadata: cwe: - 'CWE-329: Generation of Predictable IV with CBC Mode' owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#STATIC_IV asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' references: - https://cwe.mitre.org/data/definitions/329.html category: security technology: - java subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector shortlink: https://sg.run/BkB5 semgrep.dev: rule: r_id: 9195 rv_id: 1263002 rule_id: ReUgj1 version_id: qkTR7vP url: https://semgrep.dev/playground/r/qkTR7vP/java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector origin: community path: java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector severity: WARNING languages: - java pattern-either: - pattern: | byte[] $IV = { ... }; ... new IvParameterSpec($IV, ...); - pattern: | class $CLASS { byte[] $IV = { ... }; ... $METHOD(...) { ... new IvParameterSpec($IV, ...); ... } } - id: python.django.security.passwords.password-empty-string.password-empty-string message: '''$VAR'' is the empty string and is being used to set the password on ''$MODEL''. If you meant to set an unusable password, set the password to None or call ''set_unusable_password()''.' metadata: cwe: - 'CWE-521: Weak Password Requirements' owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password category: security technology: - django subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string shortlink: https://sg.run/oxnR semgrep.dev: rule: r_id: 9516 rv_id: 1263411 rule_id: 9AU1jW version_id: GxTke5Q url: https://semgrep.dev/playground/r/GxTke5Q/python.django.security.passwords.password-empty-string.password-empty-string origin: community path: python.django.security.passwords.password-empty-string.password-empty-string patterns: - pattern-either: - pattern: | $MODEL.set_password($EMPTY) ... $MODEL.save() - pattern: | $VAR = $EMPTY ... $MODEL.set_password($VAR) ... $MODEL.save() - metavariable-regex: metavariable: $EMPTY regex: (\'\'|\"\") languages: - python severity: ERROR - id: yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume patterns: - pattern-inside: | version: ... ... - pattern-either: - pattern: | volumes: - ... - /var/run/docker.sock:/var/run/docker.sock - ... - pattern: | volumes: - ... - /run/docker.sock:/run/docker.sock - ... - pattern: | volumes: - ... - /var/run/docker.sock:/run/docker.sock - ... - pattern: | volumes: - ... - /run/docker.sock:/var/run/docker.sock - ... - pattern: | volumes: - ... - /var/run/docker.sock - ... - pattern: | volumes: - ... - /run/docker.sock - ... - pattern: | volumes: - ... - ... source: /var/run/docker.sock ... - ... - pattern: | volumes: - ... - ... source: /run/docker.sock ... - ... message: Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from volumes to prevent this. metadata: references: - https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers category: security technology: - docker-compose cwe: - 'CWE-250: Execution with Unnecessary Privileges' owasp: - A06:2017 - Security Misconfiguration - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume shortlink: https://sg.run/O14b semgrep.dev: rule: r_id: 10131 rv_id: 1263920 rule_id: eqUvZ9 version_id: DkTRbje url: https://semgrep.dev/playground/r/DkTRbje/yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume origin: community path: yaml.docker-compose.security.exposing-docker-socket-volume.exposing-docker-socket-volume languages: - yaml severity: WARNING - id: php.lang.security.injection.tainted-sql-string.tainted-sql-string languages: - php severity: ERROR message: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare("INSERT INTO test(id, label) VALUES (?, ?)");`) or a safe library. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/www-community/attacks/SQL_Injection category: security technology: - php cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/php.lang.security.injection.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/lZYG semgrep.dev: rule: r_id: 14757 rv_id: 1263290 rule_id: qNUXdL version_id: gETB7vY url: https://semgrep.dev/playground/r/gETB7vY/php.lang.security.injection.tainted-sql-string.tainted-sql-string origin: community path: php.lang.security.injection.tainted-sql-string.tainted-sql-string mode: taint pattern-sanitizers: - pattern-either: - pattern: mysqli_real_escape_string(...) - pattern: real_escape_string(...) - pattern: $MYSQLI->real_escape_string(...) pattern-sources: - patterns: - pattern-either: - pattern: $_GET - pattern: $_POST - pattern: $_COOKIE - pattern: $_REQUEST pattern-sinks: - pattern-either: - patterns: - pattern: | sprintf($SQLSTR, ...) - metavariable-regex: metavariable: $SQLSTR regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* - patterns: - pattern: | "...$EXPR..." - metavariable-regex: metavariable: $EXPR regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* - patterns: - pattern: | "$SQLSTR".$EXPR - metavariable-regex: metavariable: $SQLSTR regex: (?is).*\b(select|delete|insert|create|update|alter|drop)\b.* - id: generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key patterns: - pattern-regex: '[0-9]+:AA[0-9A-Za-z\-_]{33}' - pattern-not-regex: go\.mod.* - pattern-not-regex: v[\d]+\.[\d]+\.[\d]+.* languages: - regex message: Telegram Bot API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - telegram confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key shortlink: https://sg.run/nd4b semgrep.dev: rule: r_id: 9080 rv_id: 1262901 rule_id: GdU7Nl version_id: qkTR7RB url: https://semgrep.dev/playground/r/qkTR7RB/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key origin: community path: generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key - id: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true patterns: - pattern: subprocess.$FUNC(..., shell=$TRUE, ...) - metavariable-pattern: metavariable: $TRUE pattern: "True \n" - pattern-not: subprocess.$FUNC("...", shell=True, ...) - focus-metavariable: $TRUE message: Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. fix: | False metadata: source-rule-url: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' references: - https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess - https://docs.python.org/3/library/subprocess.html category: security technology: - python cwe2022-top25: true cwe2021-top25: true subcategory: - secure default likelihood: HIGH impact: LOW confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true shortlink: https://sg.run/J92w semgrep.dev: rule: r_id: 9646 rv_id: 1263518 rule_id: DbUpz2 version_id: 0bTKzDK url: https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true origin: community path: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true languages: - python severity: ERROR - id: terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code pattern-either: - patterns: - pattern: password = "..." - pattern-inside: | resource "aws_db_instance" "..." { ... } - patterns: - pattern: master_password = "..." - pattern-inside: | resource "aws_rds_cluster" "..." { ... } languages: - hcl severity: WARNING message: RDS instance or cluster with hardcoded credentials in source code. It is recommended to pass the credentials at runtime, or generate random credentials using the random_password resource. metadata: references: - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_instance#master_password - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster#master_password - https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password cwe: - 'CWE-522: Insufficiently Protected Credentials' category: security technology: - terraform - aws - secrets owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code shortlink: https://sg.run/x4qA semgrep.dev: rule: r_id: 15830 rv_id: 1263896 rule_id: OrUl6W version_id: gETB77b url: https://semgrep.dev/playground/r/gETB77b/terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code origin: community path: terraform.lang.security.rds-insecure-password-storage-in-source-code.rds-insecure-password-storage-in-source-code - id: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#BLOWFISH_KEY_SIZE asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - audit likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size shortlink: https://sg.run/9o74 semgrep.dev: rule: r_id: 9167 rv_id: 1262989 rule_id: d8UjJ3 version_id: 3ZT4X2r url: https://semgrep.dev/playground/r/3ZT4X2r/java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size origin: community path: java.lang.security.audit.blowfish-insufficient-key-size.blowfish-insufficient-key-size message: Using less than 128 bits for Blowfish is considered insecure. Use 128 bits or more, or switch to use AES instead. severity: WARNING languages: - java patterns: - pattern: | $KEYGEN = KeyGenerator.getInstance("Blowfish"); ... $KEYGEN.init($SIZE); - metavariable-comparison: metavariable: $SIZE comparison: $SIZE < 128 - id: ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection pattern: skip_forgery_protection message: This call turns off CSRF protection allowing CSRF attacks against the application languages: - ruby severity: WARNING metadata: cwe: - 'CWE-352: Cross-Site Request Forgery (CSRF)' category: security technology: - rails references: - https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#method-i-skip_forgery_protection owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site Request Forgery (CSRF) source: https://semgrep.dev/r/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection shortlink: https://sg.run/PgwY semgrep.dev: rule: r_id: 16201 rv_id: 1263627 rule_id: QrUnEk version_id: pZT03ZD url: https://semgrep.dev/playground/r/pZT03ZD/ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection origin: community path: ruby.rails.security.audit.rails-skip-forgery-protection.rails-skip-forgery-protection - id: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe languages: - clojure severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://xerces.apache.org/xerces2-j/features.html source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/xxe-clojure-xml/xxe-clojure-xml.yml category: security technology: - clojure - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe shortlink: https://sg.run/v7An semgrep.dev: rule: r_id: 71533 rv_id: 1262608 rule_id: bwU3Gj version_id: WrTqKyD url: https://semgrep.dev/playground/r/WrTqKyD/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe origin: community path: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe message: DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities" and "http://xml.org/sax/features/external-parameter-entities" to false. patterns: - pattern-inside: | (ns ... (:require [clojure.xml :as ...])) ... - pattern-either: - pattern-inside: | (def ... ... ( ... )) - pattern-inside: | (defn ... ... ( ... )) - pattern-either: - pattern: (clojure.xml/parse $INPUT) - patterns: - pattern-inside: | (doto (javax.xml.parsers.SAXParserFactory/newInstance) ...) - pattern: (.setFeature "http://apache.org/xml/features/disallow-doctype-decl" false) - pattern-not-inside: | (doto (javax.xml.parsers.SAXParserFactory/newInstance) ... (.setFeature "http://xml.org/sax/features/external-general-entities" false) ... (.setFeature "http://xml.org/sax/features/external-parameter-entities" false) ...) - pattern-not-inside: | (doto (javax.xml.parsers.SAXParserFactory/newInstance) ... (.setFeature "http://xml.org/sax/features/external-parameter-entities" false) ... (.setFeature "http://xml.org/sax/features/external-general-entities" false) ...) - id: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated message: DES is considered deprecated. AES is the recommended cipher. Upgrade to use AES. See https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard for more information. metadata: functional-categories: - crypto::search::symmetric-algorithm::javax.crypto cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DES_USAGE asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' references: - https://www.nist.gov/news-events/news/2005/06/nist-withdraws-outdated-data-encryption-standard - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms category: security technology: - java subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated shortlink: https://sg.run/5Q73 semgrep.dev: rule: r_id: 9191 rv_id: 1262996 rule_id: PeUZNg version_id: A8TgdEn url: https://semgrep.dev/playground/r/A8TgdEn/java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated origin: community path: java.lang.security.audit.crypto.des-is-deprecated.des-is-deprecated severity: WARNING patterns: - pattern-either: - pattern-inside: $CIPHER.getInstance("=~/DES/.*/") - pattern-inside: $CIPHER.getInstance("DES") - pattern-either: - pattern: | "=~/DES/.*/" - pattern: | "DES" fix: | "AES/GCM/NoPadding" languages: - java - kt - id: javascript.lang.security.audit.md5-used-as-password.md5-used-as-password message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package. metadata: category: security technology: - crypto - md5 references: - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords - https://github.com/returntocorp/semgrep-rules/issues/1609 - https://www.npmjs.com/package/bcrypt owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password shortlink: https://sg.run/GOEn semgrep.dev: rule: r_id: 14692 rv_id: 1263200 rule_id: GdUr5G version_id: DkTRb3p url: https://semgrep.dev/playground/r/DkTRb3p/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password origin: community path: javascript.lang.security.audit.md5-used-as-password.md5-used-as-password languages: - javascript severity: WARNING mode: taint pattern-sources: - pattern: $CRYPTO.createHash("md5") pattern-sinks: - patterns: - pattern: $FUNCTION(...); - metavariable-regex: metavariable: $FUNCTION regex: (?i)(.*password.*) - id: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection metadata: cwe: - 'CWE-300: Channel Accessible by Non-Endpoint' references: - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption category: security technology: - grpc confidence: HIGH owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection shortlink: https://sg.run/5Q5l semgrep.dev: rule: r_id: 9091 rv_id: 1262917 rule_id: JDUy0B version_id: 6xT2923 url: https://semgrep.dev/playground/r/6xT2923/go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection origin: community path: go.grpc.security.grpc-server-insecure-connection.grpc-server-insecure-connection message: Found an insecure gRPC server without 'grpc.Creds()' or options with credentials. This allows for a connection without encryption to this server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Include credentials derived from an SSL certificate in order to create a secure gRPC connection. You can create credentials using 'credentials.NewServerTLSFromFile("cert.pem", "cert.key")'. languages: - go severity: ERROR mode: taint pattern-sinks: - requires: OPTIONS and not CREDS pattern: grpc.NewServer($OPT, ...) - requires: EMPTY_CONSTRUCTOR pattern: grpc.NewServer() pattern-sources: - label: OPTIONS pattern: grpc.ServerOption{ ... } - label: CREDS pattern: grpc.Creds(...) - label: EMPTY_CONSTRUCTOR pattern: grpc.NewServer() - id: python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument message: Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied. languages: - python severity: WARNING patterns: - pattern: | def $FUNC(..., password="...", ...): ... - pattern-not: | def $FUNC(..., password="", ...): ... metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' category: security technology: - python owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument shortlink: https://sg.run/Lw9r semgrep.dev: rule: r_id: 9639 rv_id: 1263480 rule_id: PeUZAW version_id: w8TRoP0 url: https://semgrep.dev/playground/r/w8TRoP0/python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument origin: community path: python.lang.security.audit.hardcoded-password-default-argument.hardcoded-password-default-argument - id: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding metadata: functional-categories: - crypto::search::mode::javax.crypto cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#RSA_NO_PADDING references: - https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/ asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' category: security technology: - java - kotlin subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding shortlink: https://sg.run/DoOj semgrep.dev: rule: r_id: 9196 rv_id: 1263003 rule_id: AbUzoj version_id: l4TJRpK url: https://semgrep.dev/playground/r/l4TJRpK/java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding origin: community path: java.lang.security.audit.crypto.rsa-no-padding.rsa-no-padding message: Using RSA without OAEP mode weakens the encryption. severity: WARNING languages: - java - kt pattern: $CIPHER.getInstance("=~/RSA/[Nn][Oo][Nn][Ee]/NoPadding/") - id: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 pattern: hashlib.sha1(...) fix-regex: regex: sha1 replacement: sha256 message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B303 asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.2 Insecure Custom Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' references: - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html category: security technology: - python subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 shortlink: https://sg.run/ydYx semgrep.dev: rule: r_id: 9624 rv_id: 1263537 rule_id: x8UnBk version_id: w8TRoE7 url: https://semgrep.dev/playground/r/w8TRoE7/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 origin: community path: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 severity: WARNING languages: - python - id: csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://github.com/mgholam/fastJSON#security-warning-update category: security technology: - .net confidence: LOW cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization shortlink: https://sg.run/nqnd semgrep.dev: rule: r_id: 11136 rv_id: 1262637 rule_id: NbUAwk version_id: 7ZTE3Wn url: https://semgrep.dev/playground/r/7ZTE3Wn/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization origin: community path: csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization message: $type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe patterns: - pattern-inside: | using fastJSON; ... - pattern: | new JSONParameters { BadListTypeChecking = false } - id: ruby.lang.security.bad-deserialization.bad-deserialization mode: taint pattern-sources: - pattern-either: - pattern: params - pattern: cookies pattern-sinks: - pattern-either: - pattern: | CSV.load(...) - pattern: | Marshal.load(...) - pattern: | Marshal.restore(...) - pattern: | Oj.object_load(...) - pattern: | Oj.load($X) message: Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fashion instead. metadata: references: - https://groups.google.com/g/rubyonrails-security/c/61bkgvnSGTQ/m/nehwjA8tQ8EJ - https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_deserialize.rb category: security cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures technology: - ruby cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/ruby.lang.security.bad-deserialization.bad-deserialization shortlink: https://sg.run/DJj2 semgrep.dev: rule: r_id: 9708 rv_id: 1263595 rule_id: lBUdQg version_id: 3ZT4Xqp url: https://semgrep.dev/playground/r/3ZT4Xqp/ruby.lang.security.bad-deserialization.bad-deserialization origin: community path: ruby.lang.security.bad-deserialization.bad-deserialization languages: - ruby severity: ERROR - id: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify pattern: OpenSSL::SSL::VERIFY_NONE message: Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks. Use 'OpenSSL::SSL::VERIFY_PEER' instead. fix-regex: regex: VERIFY_NONE replacement: VERIFY_PEER severity: WARNING languages: - ruby metadata: cwe: - 'CWE-295: Improper Certificate Validation' category: security technology: - ruby owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify shortlink: https://sg.run/kLxX semgrep.dev: rule: r_id: 9728 rv_id: 1263617 rule_id: v8U5Yn version_id: DkTRbl4 url: https://semgrep.dev/playground/r/DkTRbl4/ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify origin: community path: ruby.lang.security.ssl-mode-no-verify.ssl-mode-no-verify - id: generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key pattern-regex: sk_live_[0-9a-zA-Z]{24} languages: - regex message: Stripe API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - stripe confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key shortlink: https://sg.run/dKd5 semgrep.dev: rule: r_id: 9078 rv_id: 1262899 rule_id: JDUy0z version_id: 0bTKzK1 url: https://semgrep.dev/playground/r/0bTKzK1/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key origin: community path: generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key - id: yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout languages: - yaml message: This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations. metadata: category: security owasp: A01:2017 - Injection cwe: 'CWE-913: Improper Control of Dynamically-Managed Code Resources' likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM subcategory: - vuln references: - https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ - https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md - https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability technology: - github-actions license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout shortlink: https://sg.run/A0p6 semgrep.dev: rule: r_id: 35494 rv_id: 947046 rule_id: 4bU8E4 version_id: kbTYRwl url: https://semgrep.dev/playground/r/kbTYRwl/yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout origin: community path: yaml.github-actions.security.workflow-run-target-code-checkout.workflow-run-target-code-checkout patterns: - pattern-inside: | on: ... workflow_run: ... ... ... - pattern-inside: | jobs: ... $JOBNAME: ... steps: ... - pattern: | ... uses: "$ACTION" with: ... ref: $EXPR - metavariable-regex: metavariable: $ACTION regex: actions/checkout@.* - metavariable-pattern: language: generic metavariable: $EXPR patterns: - pattern: ${{ github.event.workflow_run ... }} severity: WARNING - id: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller patterns: - pattern-inside: | class $CONTROLLER < ApplicationController ... http_basic_authenticate_with ..., :password => "$SECRET", ... end - focus-metavariable: $SECRET message: Detected hardcoded password used in basic authentication in a controller class. Including this password in version control could expose this credential. Consider refactoring to use environment variables or configuration files. severity: WARNING metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/basic_auth/index.markdown category: security technology: - ruby - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller shortlink: https://sg.run/6r0w semgrep.dev: rule: r_id: 9715 rv_id: 1263606 rule_id: X5UZWK version_id: 0bTKzNK url: https://semgrep.dev/playground/r/0bTKzNK/ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller origin: community path: ruby.lang.security.hardcoded-http-auth-in-controller.hardcoded-http-auth-in-controller languages: - ruby - id: ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size message: The RSA key size $SIZE is insufficent by NIST standards. It is recommended to use a key length of 2048 or higher. languages: - ruby severity: WARNING metadata: technology: - ruby category: security references: - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size shortlink: https://sg.run/O4Re semgrep.dev: rule: r_id: 20731 rv_id: 1263608 rule_id: NbUe4N version_id: qkTR76v url: https://semgrep.dev/playground/r/qkTR76v/ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size origin: community path: ruby.lang.security.insufficient-rsa-key-size.insufficient-rsa-key-size patterns: - pattern-either: - pattern: OpenSSL::PKey::RSA.generate($SIZE,...) - pattern: OpenSSL::PKey::RSA.new($SIZE, ...) - patterns: - pattern-either: - patterns: - pattern-inside: | $ASSIGN = $SIZE ... - pattern-either: - pattern: OpenSSL::PKey::RSA.new($ASSIGN, ...) - pattern: OpenSSL::PKey::RSA.generate($ASSIGN, ...) - patterns: - pattern-inside: | def $METHOD1(...) ... $ASSIGN = $SIZE ... end ... - pattern-either: - pattern: OpenSSL::PKey::RSA.new($ASSIGN, ...) - pattern: OpenSSL::PKey::RSA.generate($ASSIGN, ...) - metavariable-comparison: metavariable: $SIZE comparison: $SIZE < 2048 - id: javascript.sax.security.audit.sax-xxe.sax-xxe message: Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML. metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' references: - https://github.com/Leonidas-from-XIV/node-xml2js/issues/415 - https://github.com/isaacs/sax-js category: security technology: - sax cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.sax.security.audit.sax-xxe.sax-xxe shortlink: https://sg.run/5QEj semgrep.dev: rule: r_id: 9347 rv_id: 1263239 rule_id: qNUj7e version_id: d6Tyxn9 url: https://semgrep.dev/playground/r/d6Tyxn9/javascript.sax.security.audit.sax-xxe.sax-xxe origin: community path: javascript.sax.security.audit.sax-xxe.sax-xxe languages: - javascript - typescript severity: WARNING pattern-either: - pattern: | require('sax'); ... $PARSER.ondoctype = ...; - pattern: |- require('sax'); ... $PARSER.on('doctype',...); - id: csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug message: ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `` severity: WARNING metadata: likelihood: LOW impact: LOW confidence: LOW category: security cwe: - 'CWE-11: ASP.NET Misconfiguration: Creating Debug Binary' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/ - https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx subcategory: - audit technology: - .net license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Active Debug Code source: https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug shortlink: https://sg.run/yPWx semgrep.dev: rule: r_id: 17324 rv_id: 1262620 rule_id: 0oUrvj version_id: jQTn53E url: https://semgrep.dev/playground/r/jQTn53E/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug origin: community path: csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug languages: - generic paths: include: - '*web.config*' patterns: - pattern: | - pattern-inside: | ... - id: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials patterns: - pattern-inside: | provider "aws" { ... secret_key = "$SECRET" } - focus-metavariable: $SECRET message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). languages: - hcl severity: WARNING metadata: technology: - secrets - aws - terraform category: security cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials shortlink: https://sg.run/L3kn semgrep.dev: rule: r_id: 16439 rv_id: 1263735 rule_id: d8U4n0 version_id: rxTAK76 url: https://semgrep.dev/playground/r/rxTAK76/terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials origin: community path: terraform.aws.security.aws-provider-static-credentials.aws-provider-static-credentials - id: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor message: Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B304 references: - https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption category: security technology: - pycryptodome subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor shortlink: https://sg.run/L0yr semgrep.dev: rule: r_id: 9683 rv_id: 1263549 rule_id: PeUk5W version_id: gETB7j3 url: https://semgrep.dev/playground/r/gETB7j3/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor origin: community path: python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor severity: WARNING languages: - python pattern-either: - pattern: Cryptodome.Cipher.XOR.new(...) - pattern: Crypto.Cipher.XOR.new(...) - id: javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify message: Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token. metadata: cwe: - 'CWE-345: Insufficient Verification of Data Authenticity' owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.3 Insecue Stateless Session Tokens control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jwt subcategory: - audit likelihood: LOW impact: LOW confidence: LOW references: - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify shortlink: https://sg.run/J9YP semgrep.dev: rule: r_id: 9302 rv_id: 1263187 rule_id: KxUbL3 version_id: LjTkgpe url: https://semgrep.dev/playground/r/LjTkgpe/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify origin: community path: javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify languages: - javascript - typescript severity: WARNING patterns: - pattern-inside: | $JWT = require('jsonwebtoken'); ... - pattern-not-inside: | ... $JWT.verify($TOKEN, ...) ... - pattern-not-inside: | ... if (<... $JWT.verify($TOKEN, ...) ...>) { ... } ... - pattern: $JWT.decode($TOKEN, ...) - id: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind metadata: cwe: - 'CWE-287: Improper Authentication' owasp: - A02:2017 - Broken Authentication - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#LDAP_ANONYMOUS category: security technology: - java references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind shortlink: https://sg.run/jR6A semgrep.dev: rule: r_id: 9165 rv_id: 1262988 rule_id: eqU8J3 version_id: QkTGqE0 url: https://semgrep.dev/playground/r/QkTGqE0/java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind origin: community path: java.lang.security.audit.anonymous-ldap-bind.anonymous-ldap-bind message: Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information. severity: WARNING pattern: | $ENV.put($CTX.SECURITY_AUTHENTICATION, "none"); ... $DCTX = new InitialDirContext($ENV, ...); languages: - java - id: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event message: Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities metadata: owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' category: security technology: - express references: - https://www.npmjs.com/package/xml2json cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event shortlink: https://sg.run/x1AA semgrep.dev: rule: r_id: 9274 rv_id: 1263146 rule_id: 8GUjkk version_id: QkTGqgo url: https://semgrep.dev/playground/r/QkTGqgo/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event origin: community path: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: function ... ($REQ, $RES) {...} - pattern-inside: function ... ($REQ, $RES, $NEXT) {...} - patterns: - pattern-either: - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...}) - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...}) - metavariable-regex: metavariable: $METHOD regex: ^(get|post|put|head|delete|options)$ - pattern-either: - pattern: $REQ.query - pattern: $REQ.body - pattern: $REQ.params - pattern: $REQ.cookies - pattern: $REQ.headers - patterns: - pattern-either: - pattern-inside: | ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) => {...} - pattern-inside: | ({ $REQ }: Request,$RES: Response) => {...} - focus-metavariable: $REQ - pattern-either: - pattern: params - pattern: query - pattern: cookies - pattern: headers - pattern: body pattern-sinks: - patterns: - pattern-either: - pattern-inside: | require('xml2json'); ... - pattern-inside: | import 'xml2json'; ... - pattern: $REQ.on('...', function(...) { ... $EXPAT.toJson($INPUT,...); ... }) - focus-metavariable: $INPUT - id: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure message: SSLv3 is insecure because it has known vulnerabilities. Starting with go1.14, SSLv3 will be removed. Instead, use 'tls.VersionTLS13'. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go references: - https://golang.org/doc/go1.14#crypto/tls - https://www.us-cert.gov/ncas/alerts/TA14-290A category: security technology: - go confidence: HIGH subcategory: - vuln likelihood: MEDIUM impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure shortlink: https://sg.run/zvE1 semgrep.dev: rule: r_id: 9117 rv_id: 1262926 rule_id: kxUkJ2 version_id: yeTxpxj url: https://semgrep.dev/playground/r/yeTxpxj/go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure origin: community path: go.lang.security.audit.crypto.ssl.ssl-v3-is-insecure languages: - go severity: WARNING fix-regex: regex: VersionSSL30 replacement: VersionTLS13 pattern: 'tls.Config{..., MinVersion: $TLS.VersionSSL30, ...}' - id: typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any message: Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions. metadata: cwe: - 'CWE-183: Permissive List of Allowed Inputs' asvs: section: 'V14: Configuration Verification Requirements' control_id: 14.4.8 Permissive CORS control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x22-V14-Config.md#v144-http-security-headers-requirements version: '4' category: security technology: - nestjs owasp: - A04:2021 - Insecure Design - A06:2025 - Insecure Design references: - https://owasp.org/Top10/A04_2021-Insecure_Design subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Validation source: https://semgrep.dev/r/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any shortlink: https://sg.run/ljBL semgrep.dev: rule: r_id: 9757 rv_id: 1263909 rule_id: pKUG17 version_id: 0bTKzXw url: https://semgrep.dev/playground/r/0bTKzXw/typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any origin: community path: typescript.nestjs.security.audit.nestjs-header-cors-any.nestjs-header-cors-any languages: - typescript severity: WARNING pattern-either: - pattern: | class $CN { @Header("=~/[Aa][Cc][Cc][Ee][Ss][Ss]-[Cc][Oo][Nn][Tt][Rr][Oo][Ll]-[Aa][Ll][Ll][Oo][Ww]-[Oo][Rr][Ii][Gg][Ii][Nn]/", '*') $FN(...) { ... } } - pattern: | NestFactory.create($MODULE, {cors: true}) - pattern: | NestFactory.create($MODULE, {cors: {origin: '*'}}) - pattern: | $APP.enableCors() - pattern: | $APP.enableCors({origin: '*'}) - id: python.flask.security.dangerous-template-string.dangerous-template-string message: Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks. metadata: cwe: - 'CWE-96: Improper Neutralization of Directives in Statically Saved Code (''Static Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html - https://pequalsnp-team.github.io/cheatsheet/flask-jinja2-ssti category: security technology: - flask subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/python.flask.security.dangerous-template-string.dangerous-template-string shortlink: https://sg.run/b79E semgrep.dev: rule: r_id: 9526 rv_id: 1263427 rule_id: v8UnZJ version_id: X0Tzy0L url: https://semgrep.dev/playground/r/X0Tzy0L/python.flask.security.dangerous-template-string.dangerous-template-string origin: community path: python.flask.security.dangerous-template-string.dangerous-template-string languages: - python severity: ERROR pattern-either: - pattern: | $V = "...".format(...) ... flask.render_template_string($V, ...) - pattern: | $V = "...".format(...) ... return flask.render_template_string($V, ...), $MORE - pattern: | $V = "..." % $S ... flask.render_template_string($V, ...) - pattern: | $V = "..." % $S ... return flask.render_template_string($V, ...), $MORE - pattern: | $V = "..." ... $V += $O ... flask.render_template_string($V, ...) - pattern: | $V = "..." ... $V += $O ... return flask.render_template_string($V, ...), $MORE - pattern: | $V = f"...{$X}..." ... flask.render_template_string($V, ...) - pattern: | $V = f"...{$X}..." ... return flask.render_template_string($V, ...), $CODE - id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG message: Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable severity: WARNING metadata: likelihood: LOW impact: LOW confidence: LOW category: security cwe: - 'CWE-489: Active Debug Code' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://bento.dev/checks/flask/avoid-hardcoded-config/ - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features subcategory: - audit technology: - flask license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Active Debug Code source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG shortlink: https://sg.run/LwPo semgrep.dev: rule: r_id: 9539 rv_id: 1263422 rule_id: JDUyJR version_id: 6xT29w6 url: https://semgrep.dev/playground/r/6xT29w6/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG origin: community path: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG languages: - python pattern-either: - pattern: $M.update(DEBUG=True) - pattern: $M.update(DEBUG=False) - pattern: $M.config['DEBUG'] = True - pattern: $M.config['DEBUG'] = False - id: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout languages: - yaml message: This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations. metadata: category: security owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software and Data Integrity Failures cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' references: - https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ - https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target - https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md technology: - github-actions subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout shortlink: https://sg.run/jkdn semgrep.dev: rule: r_id: 13365 rv_id: 1413423 rule_id: d8Ulkd version_id: O9TQ2nX url: https://semgrep.dev/playground/r/O9TQ2nX/yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout origin: community path: yaml.github-actions.security.pull-request-target-code-checkout.pull-request-target-code-checkout patterns: - pattern-either: - pattern-inside: | on: ... pull_request_target: ... ... ... - pattern-inside: | on: [..., pull_request_target, ...] ... - pattern-inside: | on: pull_request_target ... - pattern-inside: | jobs: ... $JOBNAME: ... steps: ... - pattern: | ... uses: "$ACTION" with: ... ref: $EXPR - metavariable-regex: metavariable: $ACTION regex: actions/checkout@.* - metavariable-pattern: language: generic metavariable: $EXPR patterns: - pattern-inside: ${{ ... }} - pattern-either: - pattern: github.event.pull_request ... - pattern: github.head_ref ... severity: ERROR - id: generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key pattern-regex: '[0-9a-f]{32}-us[0-9]{1,2}' languages: - regex message: MailChimp API Key detected severity: ERROR metadata: source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security cwe: - 'CWE-798: Use of Hard-coded Credentials' technology: - secrets - mailchimp confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key shortlink: https://sg.run/XBde semgrep.dev: rule: r_id: 9064 rv_id: 1262881 rule_id: eqU8QR version_id: nWT2LoR url: https://semgrep.dev/playground/r/nWT2LoR/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key origin: community path: generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key - id: trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal message: Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker languages: - python severity: ERROR metadata: category: security cwe: 'CWE-22: Improper Limitation of a Pathname to a Restricted Directory (''Path Traversal'')' subcategory: - vuln confidence: MEDIUM likelihood: MEDIUM impact: MEDIUM technology: - --no-technology-- description: Potential path traversal in call to `extractall` for a `tarfile` references: - https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall license: AGPL-3.0 license vulnerability_class: - Path Traversal source: https://semgrep.dev/r/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal shortlink: https://sg.run/2RLD semgrep.dev: rule: r_id: 11763 rv_id: 833310 rule_id: GdUZxq version_id: pZTXjAW url: https://semgrep.dev/playground/r/pZTXjAW/trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal origin: community path: trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal patterns: - pattern-either: - pattern: | with tarfile.open(...) as $TAR: ... $TAR.extractall(...) - pattern: | tarfile.open(...).extractall(...) - pattern: | $TAR = tarfile.open(...) ... $TAR.extractall(...) - pattern-not: | with tarfile.open(...) as $TAR: ... $TAR.extractall(..., members=$MEMBERS, ...) - pattern-not: | tarfile.open(...).extractall(..., members=$MEMBERS, ...) - pattern-not: | $TAR = tarfile.open(...) ... $TAR.extractall(..., members=$MEMBERS, ...) - id: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier message: Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks. metadata: cwe: - 'CWE-295: Improper Certificate Validation' owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_HOSTNAME_VERIFIER asvs: section: V9 Communications Verification Requirements control_id: 9.2.1 Weak TLS control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements version: '4' category: security technology: - java references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier shortlink: https://sg.run/5QoD semgrep.dev: rule: r_id: 9203 rv_id: 1263006 rule_id: lBU9n8 version_id: 5PTo17W url: https://semgrep.dev/playground/r/5PTo17W/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier origin: community path: java.lang.security.audit.crypto.ssl.insecure-hostname-verifier.insecure-hostname-verifier severity: WARNING languages: - java pattern-either: - pattern: | class $CLASS implements HostnameVerifier { ... public boolean verify(...) { return true; } } - pattern: |- new HostnameVerifier(...){ public boolean verify(...) { return true; } } - pattern: import org.apache.http.conn.ssl.NoopHostnameVerifier; - id: generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token pattern-regex: (?:api_live(?:_[a-zA-Z]{2})?\.[a-zA-Z0-9-_]{11}\.[-_a-zA-Z0-9]{32}) languages: - regex message: Onfido live API Token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' category: security technology: - secrets - onfido confidence: HIGH references: - https://documentation.onfido.com/api/latest/#api-tokens subcategory: - audit likelihood: HIGH impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token shortlink: https://sg.run/lBoKD semgrep.dev: rule: r_id: 141957 rv_id: 945509 rule_id: WAUW9q3 version_id: A8TJzE2 url: https://semgrep.dev/playground/r/A8TJzE2/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token origin: community path: generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token - id: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true shortlink: https://sg.run/5Lv0 semgrep.dev: rule: r_id: 18247 rv_id: 1263060 rule_id: yyUNeo version_id: l4TJRoL url: https://semgrep.dev/playground/r/l4TJRoL/java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true origin: community path: java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true message: External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-parameter-entities" to false. pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", true); fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); languages: - java - id: python.boto3.security.hardcoded-token.hardcoded-token message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html - https://bento.dev/checks/boto3/hardcoded-access-token/ - https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/ owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures category: security technology: - boto3 - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token shortlink: https://sg.run/LwQ6 semgrep.dev: rule: r_id: 9439 rv_id: 1263347 rule_id: 5rUOwK version_id: gETB78n url: https://semgrep.dev/playground/r/gETB78n/python.boto3.security.hardcoded-token.hardcoded-token origin: community path: python.boto3.security.hardcoded-token.hardcoded-token languages: - python severity: WARNING mode: taint pattern-sources: - pattern: | "..." pattern-sinks: - patterns: - pattern-either: - pattern: $W(...,$TOKEN="$VALUE",...) - pattern: $BOTO. ... .$W(...,$TOKEN="$VALUE",...) - metavariable-regex: metavariable: $TOKEN regex: (aws_session_token|aws_access_key_id|aws_secret_access_key) - metavariable-pattern: language: generic metavariable: $VALUE patterns: - pattern-either: - pattern-regex: ^AKI - pattern-regex: ^[A-Za-z0-9/+=]+$ - metavariable-analysis: metavariable: $VALUE analyzer: entropy - id: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection message: Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' category: security technology: - grpc references: - https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection shortlink: https://sg.run/5QkD semgrep.dev: rule: r_id: 9291 rv_id: 1263180 rule_id: lBU9D8 version_id: e1TyjAl url: https://semgrep.dev/playground/r/e1TyjAl/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection origin: community path: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection languages: - javascript - typescript severity: ERROR pattern-either: - pattern: | require('grpc'); ... $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...); - pattern: | require('grpc'); ... new $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...); - pattern: |- require('grpc'); ... $CREDS = <... $CREDENTIALS.createInsecure() ...>; ... $GRPC($ADDR,...,$CREDS,...); - pattern: |- require('grpc'); ... $CREDS = <... $CREDENTIALS.createInsecure() ...>; ... new $GRPC($ADDR,...,$CREDS,...); - id: php.lang.security.md5-loose-equality.md5-loose-equality mode: taint pattern-sinks: - pattern: | $VAR1 == $VAR2 - pattern: | $VAR1 != $VAR2 pattern-sources: - pattern: $PHAR->getSignature() - pattern: $RARENTRY->getCrc() - pattern: base_convert(...) - pattern: bin2hex(...) - pattern: dechex(...) - pattern: hash_file(...) - pattern: hash_final(...) - pattern: hash_hmac_file(...) - pattern: hash_hmac(...) - pattern: hash_pbkdf2(...) - pattern: hash(...) - pattern: md5_file(...) - pattern: md5(...) - pattern: openssl_x509_fingerprint(...) - pattern: rnp_locate_key(...) - pattern: sha1_file(...) - pattern: sha1(...) - pattern: sodium_bin2hex(...) pattern-sanitizers: - pattern: strlen(...) message: Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues metadata: cwe: - 'CWE-697: Incorrect Comparison' references: - https://www.php.net/manual/en/types.comparisons.php - https://web.archive.org/web/20210430183236/https://www.whitehatsec.com/blog/magic-hashes/ category: security technology: - php subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/php.lang.security.md5-loose-equality.md5-loose-equality shortlink: https://sg.run/Do4G semgrep.dev: rule: r_id: 9396 rv_id: 1024161 rule_id: GdU7RO version_id: 9lTWdQq url: https://semgrep.dev/playground/r/9lTWdQq/php.lang.security.md5-loose-equality.md5-loose-equality origin: community path: php.lang.security.md5-loose-equality.md5-loose-equality languages: - php severity: ERROR - id: javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration message: The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. metadata: owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-345: Insufficient Verification of Data Authenticity' category: security technology: - browser subcategory: - audit likelihood: HIGH impact: MEDIUM confidence: MEDIUM references: - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration shortlink: https://sg.run/PJ4p semgrep.dev: rule: r_id: 9245 rv_id: 1263125 rule_id: KxUbq4 version_id: jQTn5ND url: https://semgrep.dev/playground/r/jQTn5ND/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration origin: community path: javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration languages: - javascript - typescript severity: WARNING pattern: $OBJECT.postMessage(...,'*',...) - id: json.aws.security.public-s3-policy-statement.public-s3-policy-statement pattern: | { "Effect": "Allow", "Principal": "*", "Resource": [ ..., "=~/arn:aws:s3.*/", ... ], ... } message: Detected public S3 bucket policy. This policy allows anyone to access certain properties of or items in the bucket. Do not do this unless you will never have sensitive data inside the bucket. metadata: owasp: - A01:2021 - Broken Access Control - A01:2025 - Broken Access Control cwe: - 'CWE-264: CWE CATEGORY: Permissions, Privileges, and Access Controls' references: - https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteAccessPermissionsReqd.html category: security technology: - aws subcategory: - vuln likelihood: LOW impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/json.aws.security.public-s3-policy-statement.public-s3-policy-statement shortlink: https://sg.run/Yv1d semgrep.dev: rule: r_id: 9358 rv_id: 1263255 rule_id: 9AU1br version_id: A8Tgdxq url: https://semgrep.dev/playground/r/A8Tgdxq/json.aws.security.public-s3-policy-statement.public-s3-policy-statement origin: community path: json.aws.security.public-s3-policy-statement.public-s3-policy-statement severity: WARNING languages: - json - id: python.django.security.audit.xss.template-autoescape-off.template-autoescape-off message: Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.djangoproject.com/en/3.1/ref/templates/builtins/#autoescape category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off shortlink: https://sg.run/Q5WZ semgrep.dev: rule: r_id: 9486 rv_id: 1263377 rule_id: AbUzAZ version_id: NdTzy0A url: https://semgrep.dev/playground/r/NdTzy0A/python.django.security.audit.xss.template-autoescape-off.template-autoescape-off origin: community path: python.django.security.audit.xss.template-autoescape-off.template-autoescape-off languages: - regex paths: include: - '*.html' severity: WARNING pattern-regex: '{%\s+autoescape\s+off\s+%}' - id: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 message: Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html category: security technology: - pycryptodome subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: HIGH functional-categories: - crypto::search::hash-algorithm::pycryptodome - crypto::search::hash-algorithm::pycryptodomex license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 shortlink: https://sg.run/Lve6 semgrep.dev: rule: r_id: 33639 rv_id: 1263551 rule_id: BYUJy4 version_id: 3ZT4Xnp url: https://semgrep.dev/playground/r/3ZT4Xnp/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 origin: community path: python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4 options: symbolic_propagation: true severity: WARNING languages: - python pattern-either: - pattern: Crypto.Hash.MD4.new(...) - pattern: Cryptodome.Hash.MD4.new (...) - id: python.django.security.injection.tainted-sql-string.tainted-sql-string message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries. metadata: cwe: - 'CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes' owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection category: security technology: - django subcategory: - audit impact: LOW likelihood: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mass Assignment source: https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/PbZp semgrep.dev: rule: r_id: 14701 rv_id: 1263408 rule_id: lBU8Ad version_id: YDTZeje url: https://semgrep.dev/playground/r/YDTZeje/python.django.security.injection.tainted-sql-string.tainted-sql-string origin: community path: python.django.security.injection.tainted-sql-string.tainted-sql-string severity: ERROR languages: - python mode: taint pattern-sources: - patterns: - pattern: request.$ANYTHING - pattern-not: request.build_absolute_uri pattern-sinks: - patterns: - pattern-either: - pattern: | "$SQLSTR" + ... - pattern: | "$SQLSTR" % ... - pattern: | "$SQLSTR".format(...) - pattern: | f"$SQLSTR{...}..." - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.* - id: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html category: security technology: - pycryptodome subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: HIGH functional-categories: - crypto::search::hash-algorithm::pycryptodome - crypto::search::hash-algorithm::pycryptodomex license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 shortlink: https://sg.run/85JN semgrep.dev: rule: r_id: 33640 rv_id: 1263552 rule_id: DbUXwo version_id: 44TEjpk url: https://semgrep.dev/playground/r/44TEjpk/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 origin: community path: python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5 options: symbolic_propagation: true severity: WARNING languages: - python pattern-either: - pattern: Crypto.Hash.MD5.new(...) - pattern: Cryptodome.Hash.MD5.new (...) - id: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled patterns: - pattern-either: - pattern: $SR = new SAXReader(...) - pattern: | $SF = SAXParserFactory.newInstance(...) ... $SR = $SF.newSAXParser(...) - patterns: - pattern: $SR = SAXParserFactory.newInstance(...) - pattern-not-inside: | ... $X = $SR.newSAXParser(...) - pattern: $SR = SAXParserFactory.newInstance(...).newSAXParser(...) - pattern: $SR = new SAXBuilder(...) - pattern-not-inside: | ... $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - pattern-not-inside: | ... $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) ... $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) - pattern-not-inside: | ... $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) ... $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) - pattern-not-inside: | ... $SR.setFeature("http://xml.org/sax/features/external-general-entities", false) ... $SR.setFeature("http://xml.org/sax/features/external-parameter-entities", false) ... $SR.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) message: XML processor being instantiated without calling the `setFeature` functions that are generally used for disabling entity processing. User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like the disclosure of confidential data, denial of service, Server Side Request Forgery (SSRF), port scanning. Make sure to disable entity processing functionality. languages: - scala severity: WARNING metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://cheatsheetseries.owasp.org//cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html category: security technology: - scala confidence: HIGH references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled shortlink: https://sg.run/QbYP semgrep.dev: rule: r_id: 19042 rv_id: 1263678 rule_id: KxUrkq version_id: rxTAKWY url: https://semgrep.dev/playground/r/rxTAKWY/scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled origin: community path: scala.lang.security.audit.sax-dtd-enabled.sax-dtd-enabled - id: package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age pattern-either: - patterns: - pattern-inside: | "packageRules": [ ... ] - pattern-either: - pattern: | { ..., "matchPackageNames": [...], ... } - pattern: | { ..., "matchPackagePatterns": [...], ... } - pattern: | { ..., "matchDepTypes": [...], ... } - pattern-not: | { ..., "minimumReleaseAge": $AGE, ... } - pattern-not: | { ..., "minimumReleaseAge": false, ... } - patterns: - pattern-inside: | "packageRules": [ ... ] - pattern-regex: '"minimumReleaseAge":\s*"(?P\d+) days?"' - metavariable-comparison: metavariable: $AGE comparison: int($AGE) < 7 - focus-metavariable: $AGE - patterns: - pattern-inside: | "packageRules": [ ... ] - pattern: | "minimumReleaseAge": "$AGE" - metavariable-regex: metavariable: $AGE regex: ^(?!\d+ days?$) - focus-metavariable: $AGE message: 'This Renovate configuration does not set a minimum release age. Newly published packages can be malicious or unstable. Add `"minimumReleaseAge": "7 days"` within a `packageRules` entry to wait 7 days before proposing updates to newly published package versions. Set `"minimumReleaseAge": false` to set an exception for minimal release age for the package rule. Added in: v42' languages: - json severity: MEDIUM paths: include: - '**/renovate.json' - '**/renovate.json5' - '**/.renovaterc' - '**/.renovaterc.json' - '**/.renovaterc.json5' metadata: category: security technology: - renovate cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' owasp: - A08:2021 - Software and Data Integrity Failures confidence: HIGH likelihood: LOW impact: HIGH subcategory: - audit vulnerability_class: - Insecure Configuration references: - https://docs.renovatebot.com/configuration-options/#minimumreleaseage license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age shortlink: https://sg.run/D8l2q semgrep.dev: rule: r_id: 291652 rv_id: 1443454 rule_id: 10UbQrX version_id: jQT1KAX url: https://semgrep.dev/playground/r/jQT1KAX/package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age origin: community path: package_managers.renovate.renovate-missing-minimum-release-age.renovate-missing-minimum-release-age - id: java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled message: Detected an element with disabled HTML escaping. If external data can reach this, this is a cross-site scripting (XSS) vulnerability. Ensure no external data can reach here, or remove 'escape=false' from this element. metadata: owasp: A07:2017 - Cross-Site Scripting (XSS) cwe: - 'CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences' references: - https://stackoverflow.com/a/7442668 category: security technology: - jsf subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Validation source: https://semgrep.dev/r/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled shortlink: https://sg.run/qxne semgrep.dev: rule: r_id: 9212 rv_id: 945709 rule_id: 10UKqE version_id: GxTP74Y url: https://semgrep.dev/playground/r/GxTP74Y/java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled origin: community path: java.lang.security.audit.xss.jsf.autoescape-disabled.autoescape-disabled pattern-regex: .*escape.*?=.*?false.* paths: include: - '*.html' - '*.xhtml' languages: - regex severity: WARNING - id: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key pattern-regex: rk_live_[0-9a-zA-Z]{24} languages: - regex message: Stripe Restricted API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - stripe confidence: MEDIUM owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key shortlink: https://sg.run/ZvdL semgrep.dev: rule: r_id: 9079 rv_id: 1262900 rule_id: 5rUOWq version_id: K3TKkKj url: https://semgrep.dev/playground/r/K3TKkKj/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key origin: community path: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key - id: yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands languages: - yaml severity: WARNING message: The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files for more information. metadata: cwe: - 'CWE-749: Exposed Dangerous Method or Function' owasp: A06:2017 - Security Misconfiguration references: - https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/ - https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w - https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files category: security technology: - github-actions subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Dangerous Method or Function source: https://semgrep.dev/r/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands shortlink: https://sg.run/qq78 semgrep.dev: rule: r_id: 13412 rv_id: 947039 rule_id: EwUQ9x version_id: jQTzq34 url: https://semgrep.dev/playground/r/jQTzq34/yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands origin: community path: yaml.github-actions.security.allowed-unsecure-commands.allowed-unsecure-commands patterns: - pattern-either: - patterns: - pattern-inside: '{env: ...}' - pattern: 'ACTIONS_ALLOW_UNSECURE_COMMANDS: true' - id: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string languages: - ruby severity: ERROR message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries. metadata: cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection category: security technology: - rails references: - https://rorsecurity.info/portfolio/ruby-on-rails-sql-injection-cheat-sheet cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/Y85o semgrep.dev: rule: r_id: 14714 rv_id: 1263667 rule_id: bwU8gl version_id: YDTZeLL url: https://semgrep.dev/playground/r/YDTZeLL/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string origin: community path: ruby.rails.security.injection.tainted-sql-string.tainted-sql-string mode: taint pattern-sources: - patterns: - pattern-either: - pattern: params - pattern: request pattern-sanitizers: - pattern: | $PARAMS.slice(...) pattern-sinks: - patterns: - pattern-either: - patterns: - pattern-either: - patterns: - pattern: | $RECORD.where($X,...) - pattern: | $RECORD.find(..., :conditions => $X,...) - focus-metavariable: $X - patterns: - pattern: | "$SQLVERB#{$EXPR}..." - pattern-not-inside: | $FUNC("...", "...#{$EXPR}...",...) - focus-metavariable: $SQLVERB - pattern-regex: (?i)(select|delete|insert|create|update|alter|drop)\b - patterns: - pattern-either: - pattern: Kernel::sprintf("$SQLSTR", $EXPR) - pattern: | "$SQLSTR" + $EXPR - pattern: | "$SQLSTR" % $EXPR - pattern-not-inside: | $FUNC("...", "...#{$EXPR}...",...) - focus-metavariable: $EXPR - metavariable-regex: metavariable: $SQLSTR regex: (?i)(select|delete|insert|create|update|alter|drop)\b - id: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.2 Static API keys or secret control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jwt - nodejs - secrets cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret shortlink: https://sg.run/vz70 semgrep.dev: rule: r_id: 9333 rv_id: 1263225 rule_id: QrUzq6 version_id: X0TzyoE url: https://semgrep.dev/playground/r/X0TzyoE/javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret origin: community path: javascript.passport-jwt.security.passport-hardcode.hardcoded-passport-secret languages: - javascript - typescript severity: WARNING mode: taint pattern-sources: - by-side-effect: true patterns: - pattern-either: - pattern: | {..., clientSecret: "...", ...} - pattern: | {..., secretOrKey: "...", ...} - pattern: | {..., consumerSecret: "...", ...} - patterns: - pattern-inside: | $OBJ = {} ... - pattern-either: - pattern: | $OBJ.clientSecret = "..." - pattern: | $OBJ.secretOrKey = "..." - pattern: | $OBJ.consumerSecret = "..." - pattern: $OBJ - patterns: - pattern-inside: | $SECRET = '...' ... - pattern-either: - pattern: | {..., clientSecret: $SECRET, ...} - pattern: | {..., secretOrKey: $SECRET, ...} - pattern: | {..., consumerSecret: $SECRET, ...} - patterns: - pattern-inside: | $SECRET = '...' ... - pattern-either: - pattern-inside: | $VALUE = {..., clientSecret: $SECRET, ...} ... - pattern-inside: | $VALUE = {..., secretOrKey: $SECRET, ...} ... - pattern-inside: | $VALUE = {..., consumerSecret: $SECRET, ...} ... - pattern: $VALUE pattern-sinks: - patterns: - pattern-either: - pattern-inside: | $F = require("$I").Strategy ... - pattern-inside: | $F = require("$I") ... - pattern-inside: | import { $STRAT as $F } from '$I' ... - pattern-inside: | import $F from '$I' ... - metavariable-regex: metavariable: $I regex: (passport-.*) - pattern-inside: | new $F($VALUE,...) - focus-metavariable: $VALUE - id: java.jjwt.security.jwt-none-alg.jjwt-none-alg message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ asvs: section: 'V3: Session Management Verification Requirements' control_id: 3.5.3 Insecue Stateless Session Tokens control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v35-token-based-session-management version: '4' category: security technology: - jwt confidence: LOW references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.jjwt.security.jwt-none-alg.jjwt-none-alg shortlink: https://sg.run/0Q7b semgrep.dev: rule: r_id: 9154 rv_id: 1262987 rule_id: j2Uvol version_id: gETB7re url: https://semgrep.dev/playground/r/gETB7re/java.jjwt.security.jwt-none-alg.jjwt-none-alg origin: community path: java.jjwt.security.jwt-none-alg.jjwt-none-alg languages: - java severity: ERROR patterns: - pattern: | io.jsonwebtoken.Jwts.builder(); - pattern-not-inside: |- $RETURNTYPE $FUNC(...) { ... $JWTS.signWith(...); ... } - id: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key message: RSA keys should be at least 2048 bits languages: - go severity: WARNING metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/securego/gosec/blob/master/rules/rsa.go references: - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#algorithms category: security technology: - go confidence: HIGH subcategory: - audit likelihood: HIGH impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key shortlink: https://sg.run/9oY4 semgrep.dev: rule: r_id: 9123 rv_id: 1262932 rule_id: d8UjY3 version_id: xyTjz8L url: https://semgrep.dev/playground/r/xyTjz8L/go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key origin: community path: go.lang.security.audit.crypto.use_of_weak_rsa_key.use-of-weak-rsa-key patterns: - pattern-either: - pattern: | rsa.GenerateKey(..., $BITS) - pattern: | rsa.GenerateMultiPrimeKey(..., $BITS) - metavariable-comparison: metavariable: $BITS comparison: $BITS < 2048 - focus-metavariable: - $BITS fix: | 2048 - id: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY message: Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead severity: ERROR metadata: likelihood: LOW impact: LOW confidence: LOW category: security cwe: - 'CWE-489: Active Debug Code' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://bento.dev/checks/flask/avoid-hardcoded-config/ - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#builtin-configuration-values - https://flask.palletsprojects.com/en/1.1.x/config/?highlight=configuration#environment-and-debug-features subcategory: - audit technology: - flask license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Active Debug Code source: https://semgrep.dev/r/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY shortlink: https://sg.run/Ekde semgrep.dev: rule: r_id: 9537 rv_id: 1263420 rule_id: 4bUkX0 version_id: l4TJRA9 url: https://semgrep.dev/playground/r/l4TJRA9/python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY origin: community path: python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY languages: - python pattern-either: - pattern: $M.update(SECRET_KEY="=~/.*/") - pattern: $M.config['SECRET_KEY'] = "=~/.*/" - id: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection metadata: cwe: - 'CWE-300: Channel Accessible by Non-Endpoint' references: - https://blog.gopheracademy.com/advent-2019/go-grps-and-tls/#connection-without-encryption category: security technology: - grpc confidence: HIGH owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection shortlink: https://sg.run/J9yZ semgrep.dev: rule: r_id: 9090 rv_id: 1262916 rule_id: PeUZ4X version_id: YDTZeZB url: https://semgrep.dev/playground/r/YDTZeZB/go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection origin: community path: go.grpc.security.grpc-client-insecure-connection.grpc-client-insecure-connection message: 'Found an insecure gRPC connection using ''grpc.WithInsecure()''. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the ''grpc.WithTransportCredentials()'' function. You can create a create credentials using a ''tls.Config{}'' struct with ''credentials.NewTLS()''. The final fix looks like this: ''grpc.WithTransportCredentials(credentials.NewTLS())''.' languages: - go severity: ERROR pattern: $GRPC.Dial($ADDR, ..., $GRPC.WithInsecure(...), ...) fix-regex: regex: (.*)WithInsecure\(.*?\) replacement: \1WithTransportCredentials(credentials.NewTLS()) - id: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher metadata: functional-categories: - crypto::search::mode::javax.crypto cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher shortlink: https://sg.run/Ro9K semgrep.dev: rule: r_id: 9193 rv_id: 1262998 rule_id: 5rUOb6 version_id: DkTRbwL url: https://semgrep.dev/playground/r/DkTRbwL/java.lang.security.audit.crypto.ecb-cipher.ecb-cipher origin: community path: java.lang.security.audit.crypto.ecb-cipher.ecb-cipher message: Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY. severity: WARNING languages: - java patterns: - pattern: | Cipher $VAR = $CIPHER.getInstance($MODE); - metavariable-regex: metavariable: $MODE regex: .*ECB.* - id: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration message: You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead. severity: ERROR metadata: likelihood: HIGH impact: MEDIUM confidence: HIGH category: security cwe: - 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)' owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0 - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key subcategory: - vuln technology: - .net license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration shortlink: https://sg.run/xjrA semgrep.dev: rule: r_id: 36774 rv_id: 1262624 rule_id: KxU3Nq version_id: rxTAK2O url: https://semgrep.dev/playground/r/rxTAK2O/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration origin: community path: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration languages: - csharp mode: taint pattern-sources: - patterns: - pattern-inside: (System.Random $RNG).NextBytes($KEY); ... - pattern: $KEY pattern-sinks: - pattern-either: - patterns: - pattern: ($KEYTYPE $CIPHER).Key = $SINK; - focus-metavariable: $SINK - metavariable-pattern: metavariable: $KEYTYPE pattern-either: - pattern: SymmetricAlgorithm - pattern: Aes - pattern: Rijndael - pattern: DES - pattern: TripleDES - pattern: RC2 - pattern: new AesGcm(...) - pattern: new AesCcm(...) - pattern: new ChaCha20Poly1305(...) - id: ruby.lang.security.weak-hashes-md5.weak-hashes-md5 message: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. metadata: cwe: - 'CWE-328: Use of Weak Hash' references: - https://www.ibm.com/support/pages/security-bulletin-vulnerability-md5-signature-and-hash-algorithm-affects-sterling-integrator-and-sterling-file-gateway-cve-2015-7575 category: security technology: - ruby owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures subcategory: - vuln likelihood: LOW impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Insecure Hashing Algorithm source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-md5.weak-hashes-md5 shortlink: https://sg.run/O1re semgrep.dev: rule: r_id: 9731 rv_id: 1263619 rule_id: nJUYxZ version_id: 0bTKzN8 url: https://semgrep.dev/playground/r/0bTKzN8/ruby.lang.security.weak-hashes-md5.weak-hashes-md5 origin: community path: ruby.lang.security.weak-hashes-md5.weak-hashes-md5 languages: - ruby severity: WARNING pattern-either: - pattern: Digest::MD5.base64digest $X - pattern: Digest::MD5.hexdigest $X - pattern: Digest::MD5.digest $X - pattern: Digest::MD5.new - pattern: OpenSSL::Digest::MD5.base64digest $X - pattern: OpenSSL::Digest::MD5.hexdigest $X - pattern: OpenSSL::Digest::MD5.digest $X - pattern: OpenSSL::Digest::MD5.new - id: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure metadata: owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XSS_REQUEST_WRAPPER category: security technology: - java references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure shortlink: https://sg.run/J96Q semgrep.dev: rule: r_id: 9190 rv_id: 1263056 rule_id: lBU9Gj version_id: WrTqKGK url: https://semgrep.dev/playground/r/WrTqKGK/java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure origin: community path: java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure message: It looks like you're using an implementation of XSSRequestWrapper from dzone. (https://www.javacodegeeks.com/2012/07/anti-cross-site-scripting-xss-filter.html) The XSS filtering in this code is not secure and can be bypassed by malicious actors. It is recommended to use a stack that automatically escapes in your view or templates instead of filtering yourself. severity: WARNING languages: - java pattern-either: - pattern: | class XSSRequestWrapper extends HttpServletRequestWrapper { ... } - pattern: |- $P = $X.compile("", $X.CASE_INSENSITIVE); $V = $P.matcher(...).replaceAll(""); - id: dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount message: The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine. languages: - dockerfile - yaml severity: ERROR metadata: cwe: - 'CWE-862: Missing Authorization' - 'CWE-269: Improper Privilege Management' confidence: HIGH likelihood: MEDIUM impact: HIGH subcategory: - audit technology: - dockerfile category: security references: - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html - https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/ - https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount shortlink: https://sg.run/10AAQ semgrep.dev: rule: r_id: 146566 rv_id: 945266 rule_id: oqUgAAk version_id: WrTEoEq url: https://semgrep.dev/playground/r/WrTEoEq/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount origin: community path: dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount pattern-either: - patterns: - pattern: VOLUME $X - metavariable-regex: metavariable: $X regex: /var/run/docker.sock - patterns: - pattern-regex: '- "/var/run/docker.sock:.*"' - pattern-inside: | volumes: ... - id: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false shortlink: https://sg.run/4Dv5 semgrep.dev: rule: r_id: 18244 rv_id: 1263057 rule_id: j2UrJ8 version_id: 0bTKzgX url: https://semgrep.dev/playground/r/0bTKzgX/java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false origin: community path: java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false message: DOCTYPE declarations are enabled for $DBFACTORY. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature "http://apache.org/xml/features/disallow-doctype-decl" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features "http://xml.org/sax/features/external-general-entities" and "http://xml.org/sax/features/external-parameter-entities" to false. patterns: - pattern: $DBFACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false); - pattern-not-inside: | $RETURNTYPE $METHOD(...){ ... $DBF.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... } - pattern-not-inside: | $RETURNTYPE $METHOD(...){ ... $DBF.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $DBF.setFeature("http://xml.org/sax/features/external-general-entities", false); ... } - pattern-not-inside: | $RETURNTYPE $METHOD(...){ ... $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); ... } - pattern-not-inside: | $RETURNTYPE $METHOD(...){ ... $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); ... $DBF.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); ... } languages: - java - id: yaml.github-actions.security.github-script-injection.github-script-injection languages: - yaml message: 'Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`''s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".' metadata: category: security cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#understanding-the-risk-of-script-injections - https://securitylab.github.com/research/github-actions-untrusted-input/ - https://github.com/actions/github-script technology: - github-actions cwe2022-top25: true subcategory: - vuln likelihood: HIGH impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/yaml.github-actions.security.github-script-injection.github-script-injection shortlink: https://sg.run/g1G0 semgrep.dev: rule: r_id: 31441 rv_id: 1501843 rule_id: OrUQvK version_id: e1TboJK url: https://semgrep.dev/playground/r/e1TboJK/yaml.github-actions.security.github-script-injection.github-script-injection origin: community path: yaml.github-actions.security.github-script-injection.github-script-injection patterns: - pattern-inside: 'steps: [...]' - pattern-inside: | uses: $ACTION ... - pattern-inside: | with: ... script: ... ... - pattern: 'script: $SHELL' - metavariable-regex: metavariable: $ACTION regex: actions/github-script@.* - metavariable-pattern: language: generic metavariable: $SHELL patterns: - pattern-either: - pattern: ${{ ... github.event.issue.title ... }} - pattern: ${{ ... github.event.issue.body ... }} - pattern: ${{ ... github.event.pull_request.title ... }} - pattern: ${{ ... github.event.pull_request.body ... }} - pattern: ${{ ... github.event.comment.body ... }} - pattern: ${{ ... github.event.review.body ... }} - pattern: ${{ ... github.event.review_comment.body ... }} - pattern: ${{ ... github.event.pages ... .page_name ... }} - pattern: ${{ ... github.event.head_commit.message ... }} - pattern: ${{ ... github.event.head_commit.author.email ... }} - pattern: ${{ ... github.event.head_commit.author.name ... }} - pattern: ${{ ... github.event.commits ... .author.email ... }} - pattern: ${{ ... github.event.commits ... .author.name ... }} - pattern: ${{ ... github.event.commits ... .message ... }} - pattern: ${{ ... github.event.pull_request.head.ref ... }} - pattern: ${{ ... github.event.pull_request.head.label ... }} - pattern: ${{ ... github.event.pull_request.head.repo.default_branch ... }} - pattern: ${{ ... github.ref ... }} - pattern: ${{ ... github.base_ref ... }} - pattern: ${{ ... github.head_ref ... }} - pattern: ${{ ... github.ref_name ... }} - pattern: ${{ ... github.event.inputs ... }} - pattern: ${{ ... github.event.discussion.title ... }} - pattern: ${{ ... github.event.discussion.body ... }} - pattern: ${{ ... github.event.workflow_run.head_branch ... }} - pattern: ${{ ... github.event.workflow_run.head_commit.message ... }} - pattern: ${{ ... github.event.milestone.title ... }} - pattern: ${{ ... github.event.milestone.description ... }} - pattern: ${{ ... github.event.project_card.note ... }} - pattern: ${{ ... github.event.project.name ... }} - pattern: ${{ ... github.event.project_column.name ... }} - pattern: ${{ ... github.event.release.name ... }} - pattern: ${{ ... github.event.release.body ... }} - pattern: ${{ ... github.event.deployment.ref ... }} - pattern: ${{ ... inputs ... }} - pattern-not: ${{ ... github.event.issue.title && ... }} - pattern-not: ${{ ... github.event.issue.body && ... }} - pattern-not: ${{ ... github.event.pull_request.title && ... }} - pattern-not: ${{ ... github.event.pull_request.body && ... }} - pattern-not: ${{ ... github.event.comment.body && ... }} - pattern-not: ${{ ... github.event.review.body && ... }} - pattern-not: ${{ ... github.event.review_comment.body && ... }} - pattern-not: ${{ ... github.event.pages ... .page_name && ... }} - pattern-not: ${{ ... github.event.head_commit.message && ... }} - pattern-not: ${{ ... github.event.head_commit.author.email && ... }} - pattern-not: ${{ ... github.event.head_commit.author.name && ... }} - pattern-not: ${{ ... github.event.commits ... .author.email && ... }} - pattern-not: ${{ ... github.event.commits ... .author.name && ... }} - pattern-not: ${{ ... github.event.commits ... .message && ... }} - pattern-not: ${{ ... github.event.pull_request.head.ref && ... }} - pattern-not: ${{ ... github.event.pull_request.head.label && ... }} - pattern-not: ${{ ... github.event.pull_request.head.repo.default_branch && ... }} - pattern-not: ${{ ... github.ref && ... }} - pattern-not: ${{ ... github.base_ref && ... }} - pattern-not: ${{ ... github.head_ref && ... }} - pattern-not: ${{ ... github.ref_name && ... }} - pattern-not: ${{ ... github.event.inputs && ... }} - pattern-not: ${{ ... github.event.discussion.title && ... }} - pattern-not: ${{ ... github.event.discussion.body && ... }} - pattern-not: ${{ ... github.event.workflow_run.head_branch && ... }} - pattern-not: ${{ ... github.event.workflow_run.head_commit.message && ... }} - pattern-not: ${{ ... github.event.milestone.title && ... }} - pattern-not: ${{ ... github.event.milestone.description && ... }} - pattern-not: ${{ ... github.event.project_card.note && ... }} - pattern-not: ${{ ... github.event.project.name && ... }} - pattern-not: ${{ ... github.event.project_column.name && ... }} - pattern-not: ${{ ... github.event.release.name && ... }} - pattern-not: ${{ ... github.event.release.body && ... }} - pattern-not: ${{ ... github.event.deployment.ref && ... }} severity: ERROR - id: javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation message: Set "rejectUnauthorized" to false is a convenient way to resolve certificate error. But this method is unsafe because it disables the server certificate verification, making the Node app open to MITM attack. "rejectUnauthorized" option must be alway set to True (default value). With self -signed certificate or custom CA, use "ca" option to define Root Certificate. This rule checks TLS configuration only for Postgresql, MariaDB and MySQL. SQLite is not really concerned by TLS configuration. This rule could be extended for MSSQL, but the dialectOptions is specific for Tedious. metadata: cwe: - 'CWE-94: Improper Control of Generation of Code (''Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://node-postgres.com/features/ssl - https://nodejs.org/api/tls.html#tls_class_tls_tlssocket - https://nodejs.org/api/tls.html#tls_tls_createsecurecontext_options category: security technology: - sequelize cwe2022-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation shortlink: https://sg.run/rAkj semgrep.dev: rule: r_id: 9969 rv_id: 1263243 rule_id: kxUR80 version_id: 7ZTE3w1 url: https://semgrep.dev/playground/r/7ZTE3w1/javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation origin: community path: javascript.sequelize.security.audit.sequelize-tls-disabled-cert-validation.sequelize-tls-disabled-cert-validation languages: - javascript - typescript severity: ERROR patterns: - pattern: | { host: $HOST, database: $DATABASE, dialect: $DIALECT, dialectOptions: { ssl: { rejectUnauthorized: false } } } - metavariable-regex: metavariable: $DIALECT regex: '[''"](mariadb|mysql|postgres)[''"]' - id: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher message: Detected an insecure CipherSuite via the 'tls' module. This suite is considered weak. Use the function 'tls.CipherSuites()' to get a list of good cipher suites. See https://golang.org/pkg/crypto/tls/#InsecureCipherSuites for why and what other cipher suites to use. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls.go references: - https://golang.org/pkg/crypto/tls/#InsecureCipherSuites category: security technology: - go confidence: HIGH subcategory: - vuln likelihood: HIGH impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher shortlink: https://sg.run/px8N semgrep.dev: rule: r_id: 9118 rv_id: 1262927 rule_id: wdUJYk version_id: rxTAKAZ url: https://semgrep.dev/playground/r/rxTAKAZ/go.lang.security.audit.crypto.tls.tls-with-insecure-cipher origin: community path: go.lang.security.audit.crypto.tls.tls-with-insecure-cipher languages: - go severity: WARNING pattern-either: - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA256, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...}} - pattern: | tls.Config{..., CipherSuites: []$TYPE{..., tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...}} - pattern: | tls.CipherSuite{..., TLS_RSA_WITH_RC4_128_SHA, ...} - pattern: | tls.CipherSuite{..., TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...} - pattern: | tls.CipherSuite{..., TLS_RSA_WITH_AES_128_CBC_SHA256, ...} - pattern: | tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, ...} - pattern: | tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_RC4_128_SHA, ...} - pattern: | tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, ...} - pattern: | tls.CipherSuite{..., TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, ...} - pattern: | tls.CipherSuite{..., TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, ...} - id: python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator message: 'Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources.' metadata: cwe: - 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection category: security technology: - airflow references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Command Injection source: https://semgrep.dev/r/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator shortlink: https://sg.run/ndBY semgrep.dev: rule: r_id: 9436 rv_id: 1263330 rule_id: 4bUkOY version_id: yeTxpb3 url: https://semgrep.dev/playground/r/yeTxpb3/python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator origin: community path: python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator languages: - python severity: ERROR pattern-either: - pattern: | airflow.operators.bash_operator.BashOperator(..., bash_command="..." + $CONCAT, ...) - pattern: | airflow.operators.bash_operator.BashOperator(..., bash_command="...".format(...), ...) - pattern: | airflow.operators.bash_operator.BashOperator(..., bash_command=f"...", ...) - pattern: | airflow.operators.bash_operator.BashOperator(..., bash_command="..." % $PARAMS, ...) - pattern: | $CMD = "..." % $PARAMS ... airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...) - pattern: | $CMD = $STR.format(...) ... airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...) - pattern: | $CMD = f"..." ... airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...) - pattern: | $CMD = "..." + $CONCAT ... airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...) - pattern: | $CMD = "..." ... $CMD += $CONCAT ... airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...) - id: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated message: Triple DES (3DES or DESede) is considered deprecated. AES is the recommended cipher. Upgrade to use AES. metadata: functional-categories: - crypto::search::symmetric-algorithm::javax.crypto cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#TDES_USAGE references: - https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA category: security technology: - java subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated shortlink: https://sg.run/Geqn semgrep.dev: rule: r_id: 9192 rv_id: 1262997 rule_id: JDUy8J version_id: BjTkZyQ url: https://semgrep.dev/playground/r/BjTkZyQ/java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated origin: community path: java.lang.security.audit.crypto.desede-is-deprecated.desede-is-deprecated severity: WARNING patterns: - pattern-either: - pattern: | $CIPHER.getInstance("=~/DESede.*/") - pattern: | $CRYPTO.KeyGenerator.getInstance("DES") languages: - java - kt - id: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish message: Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys. The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B304 references: - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers - https://tools.ietf.org/html/rfc5469 category: security technology: - cryptography subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM functional-categories: - crypto::search::symmetric-algorithm::cryptography license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish shortlink: https://sg.run/OdzL semgrep.dev: rule: r_id: 33631 rv_id: 1263349 rule_id: qNULvO version_id: 3ZT4XK7 url: https://semgrep.dev/playground/r/3ZT4XK7/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish origin: community path: python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish severity: WARNING languages: - python patterns: - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$BLOWFISH($KEY) - metavariable-regex: metavariable: $BLOWFISH regex: ^(Blowfish)$ - focus-metavariable: $BLOWFISH fix: AES - id: package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies message: 'Missing or incorrect blockExoticSubdeps. Set `blockExoticSubdeps: true` to transitive dependencies from being installed from untrusted sources. Added in: v10.26.0 Reference: https://pnpm.io/settings#blockexoticsubdeps' languages: - yaml severity: MEDIUM paths: include: - '**/pnpm-workspace.yaml' pattern-either: - patterns: - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^blockExoticSubdeps\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) - focus-metavariable: $TARGET - patterns: - pattern: | blockExoticSubdeps: $VAL - metavariable-regex: metavariable: $VAL regex: ^(?!true$).+ - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)^\s*blockExoticSubdeps\s*:\s*$ metadata: category: security technology: - pnpm cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' owasp: - A08:2021 - Software and Data Integrity Failures confidence: HIGH likelihood: LOW impact: HIGH subcategory: - audit vulnerability_class: - Insecure Configuration references: - https://pnpm.io/settings#blockexoticsubdeps license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies shortlink: https://sg.run/RrWRv semgrep.dev: rule: r_id: 291649 rv_id: 1423388 rule_id: 2ZUQEZ5 version_id: 0bTGnwj url: https://semgrep.dev/playground/r/0bTGnwj/package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies origin: community path: package_managers.pnpm.pnpm-block-exotic-sub-dependencies.pnpm-block-exotic-sub-dependencies - id: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown pattern-either: - patterns: - pattern-regex: (?ms)\[tool\.uv\](?P[^\[]*?)(?=\[|\z) - metavariable-regex: metavariable: $TARGET regex: ^(?![\s\S]*exclude-newer) - focus-metavariable: $TARGET - patterns: - pattern-regex: exclude-newer\s*=\s*"(?P\d+)\s*d(?:ays?)?" - metavariable-comparison: metavariable: $DAYS comparison: int($DAYS) < 7 - focus-metavariable: $DAYS - patterns: - pattern-regex: exclude-newer\s*=\s*"(?P[^"]+)" - metavariable-regex: metavariable: $VAL regex: (?i)^(?!\d+\s*d(?:ays?)?\b)(?!\d+\s*(?:weeks?|wks?|w|months?|mos?|mo|years?|yrs?|y)\b)(?!P[^Tt]*[WMY])(?!P(?:[7-9]|[1-9]\d+)D\b) - focus-metavariable: $VAL message: 'This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns' languages: - generic severity: MEDIUM paths: include: - '**/pyproject.toml' - '**/uv.toml' metadata: category: security technology: - uv - python cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' owasp: - A08:2021 - Software and Data Integrity Failures confidence: HIGH likelihood: LOW impact: HIGH subcategory: - audit vulnerability_class: - Insecure Configuration references: - https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown shortlink: https://sg.run/WeY0Z semgrep.dev: rule: r_id: 291653 rv_id: 1501839 rule_id: 9AUo6vE version_id: kbT3B1J url: https://semgrep.dev/playground/r/kbT3B1J/package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown origin: community path: package_managers.uv.uv-missing-dependency-cooldown.uv-missing-dependency-cooldown - id: python.jwt.security.jwt-none-alg.jwt-python-none-alg message: Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'. metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ category: security technology: - jwt references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg shortlink: https://sg.run/Yvp4 semgrep.dev: rule: r_id: 9558 rv_id: 1263453 rule_id: j2UvKw version_id: JdTzxYj url: https://semgrep.dev/playground/r/JdTzxYj/python.jwt.security.jwt-none-alg.jwt-python-none-alg origin: community path: python.jwt.security.jwt-none-alg.jwt-python-none-alg languages: - python severity: ERROR pattern-either: - pattern: | jwt.encode(...,algorithm="none",...) - pattern: jwt.decode(...,algorithms=[...,"none",...],...) - id: kotlin.lang.security.ecb-cipher.ecb-cipher metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#ECB_MODE category: security technology: - kotlin references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/kotlin.lang.security.ecb-cipher.ecb-cipher shortlink: https://sg.run/DzLj semgrep.dev: rule: r_id: 14696 rv_id: 1263263 rule_id: DbU1Zd version_id: YDTZexg url: https://semgrep.dev/playground/r/YDTZexg/kotlin.lang.security.ecb-cipher.ecb-cipher origin: community path: kotlin.lang.security.ecb-cipher.ecb-cipher message: Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY. severity: WARNING languages: - kt patterns: - pattern-either: - pattern: | val $VAR : Cipher = $CIPHER.getInstance($MODE) - pattern: | var $VAR : Cipher = $CIPHER.getInstance($MODE) - pattern: | val $VAR = $CIPHER.getInstance($MODE) - pattern: | var $VAR = $CIPHER.getInstance($MODE) - metavariable-regex: metavariable: $MODE regex: .*ECB.* - id: kotlin.lang.security.use-of-md5.use-of-md5 message: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. languages: - kt severity: WARNING metadata: owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-328: Use of Weak Hash' source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_MD5 category: security technology: - kotlin references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Insecure Hashing Algorithm source: https://semgrep.dev/r/kotlin.lang.security.use-of-md5.use-of-md5 shortlink: https://sg.run/4eQx semgrep.dev: rule: r_id: 14700 rv_id: 1263267 rule_id: qNUXPj version_id: pZT03Jd url: https://semgrep.dev/playground/r/pZT03Jd/kotlin.lang.security.use-of-md5.use-of-md5 origin: community path: kotlin.lang.security.use-of-md5.use-of-md5 pattern-either: - pattern: | java.security.MessageDigest.getInstance("MD5") - pattern: | org.apache.commons.codec.digest.DigestUtils.getMd5Digest() - id: package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age message: 'This pnpm workspace configuration does not set a minimum release age. Newly published packages can be malicious or unstable. Add `minimumReleaseAge: 10080` (minutes) to wait at least seven days before installing newly published package versions. Added in: v10.16.0 Reference: https://pnpm.io/settings#minimumreleaseage' languages: - yaml severity: MEDIUM paths: include: - '**/pnpm-workspace.yaml' pattern-either: - patterns: - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^minimumReleaseAge\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) - focus-metavariable: $TARGET - patterns: - pattern-regex: ^\s*minimumReleaseAge\s*:\s*(?P\d+) - metavariable-comparison: metavariable: $AGE comparison: int($AGE) < 10080 - focus-metavariable: $AGE - patterns: - pattern: | minimumReleaseAge: $AGE - metavariable-regex: metavariable: $AGE regex: ^\D - focus-metavariable: $AGE - patterns: - pattern-regex: (?m)^\s*minimumReleaseAge\s*:\s*$ metadata: category: security technology: - pnpm cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' owasp: - A08:2021 - Software and Data Integrity Failures confidence: HIGH likelihood: LOW impact: HIGH subcategory: - audit vulnerability_class: - Insecure Configuration references: - https://pnpm.io/settings#minimumreleaseage license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age shortlink: https://sg.run/Aj0o0 semgrep.dev: rule: r_id: 291650 rv_id: 1423389 rule_id: X5Uwn1n version_id: K3TgxrW url: https://semgrep.dev/playground/r/K3TgxrW/package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age origin: community path: package_managers.pnpm.pnpm-missing-minimum-release-age.pnpm-minimum-release-age - id: python.flask.security.audit.debug-enabled.debug-enabled patterns: - pattern-inside: | import flask ... - pattern: $APP.run(..., debug=True, ...) message: Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables. metadata: cwe: - 'CWE-489: Active Debug Code' owasp: A06:2017 - Security Misconfiguration references: - https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/ category: security technology: - flask subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Active Debug Code source: https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled shortlink: https://sg.run/dKrd semgrep.dev: rule: r_id: 9534 rv_id: 946206 rule_id: gxU1bd version_id: 8KTKjwR url: https://semgrep.dev/playground/r/8KTKjwR/python.flask.security.audit.debug-enabled.debug-enabled origin: community path: python.flask.security.audit.debug-enabled.debug-enabled severity: WARNING languages: - python - id: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html - https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability - http://2012.sharcs.org/slides/stevens.pdf - https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html category: security technology: - pycryptodome subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 shortlink: https://sg.run/3ALr semgrep.dev: rule: r_id: 9687 rv_id: 1263553 rule_id: ReUPO3 version_id: PkTR3vk url: https://semgrep.dev/playground/r/PkTR3vk/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 origin: community path: python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1 severity: WARNING languages: - python pattern-either: - pattern: Crypto.Hash.SHA.new(...) - pattern: Cryptodome.Hash.SHA.new (...) - id: ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret message: 'Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)' metadata: cwe: - 'CWE-522: Insufficiently Protected Credentials' owasp: - A02:2017 - Broken Authentication - A04:2021 - Insecure Design - A06:2025 - Insecure Design source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ category: security technology: - jwt references: - https://owasp.org/Top10/A04_2021-Insecure_Design cwe2021-top25: true subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret shortlink: https://sg.run/GW2B semgrep.dev: rule: r_id: 9704 rv_id: 1263590 rule_id: WAUZz5 version_id: 7ZTE3d7 url: https://semgrep.dev/playground/r/7ZTE3d7/ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret origin: community path: ruby.jwt.security.jwt-hardcode.ruby-jwt-hardcoded-secret patterns: - pattern-inside: | require 'jwt' ... - pattern-either: - pattern: | JWT.encode($PAYLOAD,"...",...) - pattern: | JWT.decode($PAYLOAD,"...",...) - pattern: | JWT.encode($PAYLOAD,nil,...) - pattern: | JWT.decode($PAYLOAD,nil,...) - pattern: | $SECRET = "..." ... JWT.encode($PAYLOAD,$SECRET,...) - pattern: | $SECRET = "..." ... JWT.decode($PAYLOAD,$SECRET,...) - pattern-not: | JWT.encode($PAYLOAD, nil, ... , jwks: ..., ...) - pattern-not: | JWT.decode($PAYLOAD, nil, ..., jwks: ..., ...) languages: - ruby severity: ERROR - id: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 message: ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output. Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key. Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead. metadata: source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98 cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures bandit-code: B304 references: - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers category: security technology: - cryptography subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM functional-categories: - crypto::search::symmetric-algorithm::cryptography license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 shortlink: https://sg.run/xoZL semgrep.dev: rule: r_id: 33630 rv_id: 1263348 rule_id: KxU8gK version_id: QkTGq3Q url: https://semgrep.dev/playground/r/QkTGq3Q/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 origin: community path: python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4 severity: WARNING languages: - python patterns: - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$ARC4($KEY) - pattern-inside: cryptography.hazmat.primitives.ciphers.Cipher(...) - metavariable-regex: metavariable: $ARC4 regex: ^(ARC4)$ - focus-metavariable: $ARC4 fix: AES - id: java.jboss.security.session_sqli.find-sql-string-concatenation message: In $METHOD, $X is used to construct a SQL query via string concatenation. languages: - java severity: ERROR pattern-either: - pattern: | $RETURN $METHOD(...,String $X,...){ ... Session $SESSION = ...; ... String $QUERY = ... + $X + ...; ... PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY); ... ResultSet $RESULT = $PS.executeQuery(); ... } - pattern: | $RETURN $METHOD(...,String $X,...){ ... String $QUERY = ... + $X + ...; ... Session $SESSION = ...; ... PreparedStatement $PS = $SESSION.connection().prepareStatement($QUERY); ... ResultSet $RESULT = $PS.executeQuery(); ... } metadata: category: security technology: - jboss confidence: MEDIUM cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection references: - https://owasp.org/Top10/A03_2021-Injection cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/java.jboss.security.session_sqli.find-sql-string-concatenation shortlink: https://sg.run/W8kA semgrep.dev: rule: r_id: 9153 rv_id: 1262986 rule_id: X5U8rQ version_id: 8KT5r3v url: https://semgrep.dev/playground/r/8KT5r3v/java.jboss.security.session_sqli.find-sql-string-concatenation origin: community path: java.jboss.security.session_sqli.find-sql-string-concatenation - id: generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key pattern-regex: SK[0-9a-fA-F]{32} languages: - regex message: Twilio API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - twilio confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key shortlink: https://sg.run/Ek2o semgrep.dev: rule: r_id: 9081 rv_id: 1262902 rule_id: ReUgJn version_id: l4TJRJJ url: https://semgrep.dev/playground/r/l4TJRJJ/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key origin: community path: generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key - id: package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy message: 'Missing or incorrect trustPolicy. Set `trustPolicy: no-downgrade` to prevent malicious package updates from downgrading security settings. Added in: v10.21.0 Reference: https://pnpm.io/settings#trustpolicy' languages: - yaml severity: MEDIUM paths: include: - '**/pnpm-workspace.yaml' pattern-either: - patterns: - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?P^(?:packages|catalog)\s*:)(?:(?!^trustPolicy\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) - focus-metavariable: $TARGET - patterns: - pattern: | trustPolicy: $VAL - metavariable-regex: metavariable: $VAL regex: ^(?!no-downgrade$).+ - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)^\s*trustPolicy\s*:\s*$ metadata: category: security technology: - pnpm cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' owasp: - A08:2021 - Software and Data Integrity Failures confidence: HIGH likelihood: LOW impact: HIGH subcategory: - audit vulnerability_class: - Insecure Configuration references: - https://pnpm.io/settings#minimumreleaseage license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy shortlink: https://sg.run/B2Kz7 semgrep.dev: rule: r_id: 291651 rv_id: 1423390 rule_id: j2U6J8N version_id: qkTvDQn url: https://semgrep.dev/playground/r/qkTvDQn/package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy origin: community path: package_managers.pnpm.pnpm-trust-policy.pnpm-trust-policy - id: php.lang.security.assert-use.assert-use mode: taint pattern-sources: - pattern-either: - patterns: - pattern-either: - pattern: $_GET - pattern: $_POST - pattern: $_COOKIE - pattern: $_REQUEST - pattern: $_SERVER - patterns: - pattern: | Route::$METHOD($ROUTENAME, function(..., $ARG, ...) { ... }) - focus-metavariable: $ARG pattern-sinks: - patterns: - pattern: assert($SINK, ...); - pattern-not: assert("...", ...); - pattern: $SINK message: Calling assert with user input is equivalent to eval'ing. metadata: owasp: - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' references: - https://www.php.net/manual/en/function.assert - https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/AssertsSniff.php category: security technology: - php confidence: HIGH subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/php.lang.security.assert-use.assert-use shortlink: https://sg.run/3xXW semgrep.dev: rule: r_id: 9387 rv_id: 1263272 rule_id: DbUpjk version_id: 9lT4bLx url: https://semgrep.dev/playground/r/9lT4bLx/php.lang.security.assert-use.assert-use origin: community path: php.lang.security.assert-use.assert-use languages: - php severity: ERROR - id: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true shortlink: https://sg.run/JgPy semgrep.dev: rule: r_id: 18246 rv_id: 1263059 rule_id: 9AUJ6r version_id: qkTR7Lk url: https://semgrep.dev/playground/r/qkTR7Lk/java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true origin: community path: java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true message: External entities are allowed for $DBFACTORY. This is vulnerable to XML external entity attacks. Disable this by setting the feature "http://xml.org/sax/features/external-general-entities" to false. pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities", true); fix: $DBFACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); languages: - java - id: package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate pattern-either: - patterns: - pattern-regex: (?ms)(?:\A|^---$\n)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?P^(?:nodeLinker|yarnPath|enableGlobalCache|npmScopes|npmRegistryServer)\s*:)(?:(?!^npmMinimalAgeGate\s*:)(?!^---$)[\s\S])*?(?=^---$|\z) - focus-metavariable: $TARGET - patterns: - pattern-regex: (?m)npmMinimalAgeGate\s*:\s*['"]?(?P\d+)d['"]? - metavariable-comparison: metavariable: $DAYS comparison: int($DAYS) < 7 - focus-metavariable: $DAYS - patterns: - pattern-regex: (?m)npmMinimalAgeGate[ \t]*:[ \t]*(?P\S+) - metavariable-regex: metavariable: $VAL regex: ^(?!['"]?\d+d['"]?$) - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)^npmMinimalAgeGate\s*:\s*$ message: 'This .yarnrc.yml does not set a minimal age gate or sets it too low. Newly published packages can be malicious or unstable. Add `npmMinimalAgeGate: "7d"` to wait 7 days before resolving newly published package versions. Added in: 4.10 Reference: https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate' languages: - yaml severity: MEDIUM paths: include: - '**/.yarnrc.yml' metadata: category: security technology: - yarn - javascript cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' owasp: - A08:2021 - Software and Data Integrity Failures confidence: HIGH likelihood: LOW impact: HIGH subcategory: - audit vulnerability_class: - Insecure Configuration references: - https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate shortlink: https://sg.run/0gvNq semgrep.dev: rule: r_id: 291654 rv_id: 1423393 rule_id: yyUBeEz version_id: JdTnXlj url: https://semgrep.dev/playground/r/JdTnXlj/package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate origin: community path: package_managers.yarn.yarn-missing-minimal-age-gate.yarn-missing-minimal-age-gate - id: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified message: Detected the decoding of a JWT token without a verify step. Don't use `ParseUnverified` unless you know what you're doing This method parses the token but doesn't validate the signature. It's only ever useful in cases where you know the signature is valid (because it has been checked previously in the stack) and you want to extract values from it. metadata: cwe: - 'CWE-345: Insufficient Verification of Data Authenticity' owasp: - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures source-rule-url: https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/ category: security technology: - jwt confidence: MEDIUM references: - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures subcategory: - audit likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified shortlink: https://sg.run/Av66 semgrep.dev: rule: r_id: 9094 rv_id: 1262918 rule_id: ReUgJJ version_id: o5TbDbq url: https://semgrep.dev/playground/r/o5TbDbq/go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified origin: community path: go.jwt-go.security.audit.jwt-parse-unverified.jwt-go-parse-unverified languages: - go severity: WARNING patterns: - pattern-inside: | import "github.com/dgrijalva/jwt-go" ... - pattern: | $JWT.ParseUnverified(...) - id: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher patterns: - pattern-either: - pattern: new NullCipher(...); - pattern: new javax.crypto.NullCipher(...); metadata: cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://find-sec-bugs.github.io/bugs.htm#NULL_CIPHER asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher shortlink: https://sg.run/AvA4 semgrep.dev: rule: r_id: 9194 rv_id: 1263001 rule_id: GdU7pw version_id: K3TKkgB url: https://semgrep.dev/playground/r/K3TKkgB/java.lang.security.audit.crypto.no-null-cipher.no-null-cipher origin: community path: java.lang.security.audit.crypto.no-null-cipher.no-null-cipher message: 'NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' severity: WARNING languages: - java - id: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb pattern: $CIPHER.getInstance("=~/AES/ECB.*/") metadata: functional-categories: - crypto::search::mode::javax.crypto cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb shortlink: https://sg.run/dB2Y semgrep.dev: rule: r_id: 48734 rv_id: 1263009 rule_id: WAU2yA version_id: A8TgdEo url: https://semgrep.dev/playground/r/A8TgdEo/java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb origin: community path: java.lang.security.audit.crypto.use-of-aes-ecb.use-of-aes-ecb message: 'Use of AES with ECB mode detected. ECB doesn''t provide message confidentiality and is not semantically secure so should not be used. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' severity: WARNING languages: - java - id: python.flask.security.audit.render-template-string.render-template-string pattern: flask.render_template_string(...) metadata: cwe: - 'CWE-96: Improper Neutralization of Directives in Statically Saved Code (''Static Code Injection'')' owasp: - A03:2021 - Injection - A05:2025 - Injection references: - https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html category: security technology: - flask subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string shortlink: https://sg.run/8yjE semgrep.dev: rule: r_id: 9540 rv_id: 1263423 rule_id: 5rUOv1 version_id: o5TbDp4 url: https://semgrep.dev/playground/r/o5TbDp4/python.flask.security.audit.render-template-string.render-template-string origin: community path: python.flask.security.audit.render-template-string.render-template-string message: Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks. languages: - python severity: WARNING - id: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown pattern-either: - patterns: - pattern-inside: | updates: ... - pattern: | - package-ecosystem: $ECOSYSTEM ... - pattern-not: | - package-ecosystem: $ECOSYSTEM ... cooldown: ... ... - patterns: - pattern-inside: | updates: ... - pattern-regex: default-days\s*:\s*(?P\d+) - metavariable-comparison: metavariable: $DAYS comparison: int($DAYS) < 7 - focus-metavariable: $DAYS - patterns: - pattern-inside: | updates: ... - pattern: | cooldown: default-days: $DAYS - metavariable-regex: metavariable: $DAYS regex: ^\D - focus-metavariable: $DAYS message: 'This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown' languages: - yaml severity: MEDIUM paths: include: - '**/.github/dependabot.yml' - '**/.github/dependabot.yaml' metadata: category: security technology: - dependabot cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' owasp: - A08:2021 - Software and Data Integrity Failures confidence: HIGH likelihood: LOW impact: HIGH subcategory: - audit vulnerability_class: - Insecure Configuration references: - https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown shortlink: https://sg.run/5WvGK semgrep.dev: rule: r_id: 291647 rv_id: 1423386 rule_id: zdUArOL version_id: DkTwEGl url: https://semgrep.dev/playground/r/DkTwEGl/package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown origin: community path: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown - id: generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key pattern-regex: k2sk_v[0-9]_[0-9a-zA-Z]{24} languages: - regex message: Kolide API Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' category: security technology: - secrets - kolide confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key shortlink: https://sg.run/d2YQ semgrep.dev: rule: r_id: 14734 rv_id: 1262880 rule_id: JDULYW version_id: ZRTKApA url: https://semgrep.dev/playground/r/ZRTKApA/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key origin: community path: generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key - id: php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors patterns: - pattern-inside: | use Symfony\Component\HttpFoundation\Response; ... - pattern-either: - patterns: - pattern-either: - pattern: | new Symfony\Component\HttpFoundation\Response($X, $Y, $HEADERS, ...) - pattern: new Response($X, $Y, $HEADERS, ...) - pattern-either: - pattern: new $R($X, $Y, [$KEY => $VALUE], ...) - pattern-inside: | $HEADERS = [$KEY => $VALUE]; ... - patterns: - pattern: $RES->headers->set($KEY, $VALUE) - metavariable-regex: metavariable: $KEY regex: (\'|\")\s*(Access-Control-Allow-Origin|access-control-allow-origin)\s*(\'|\") - metavariable-regex: metavariable: $VALUE regex: (\'|\")\s*(\*)\s*(\'|\") message: Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions. metadata: references: - https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe: - 'CWE-346: Origin Validation Error' category: security technology: - symfony subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors shortlink: https://sg.run/kr92 semgrep.dev: rule: r_id: 13972 rv_id: 1263317 rule_id: ZqUOlR version_id: K3TKkAW url: https://semgrep.dev/playground/r/K3TKkAW/php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors origin: community path: php.symfony.security.audit.symfony-permissive-cors.symfony-permissive-cors languages: - php severity: WARNING - id: go.aws-lambda.security.tainted-sql-string.tainted-sql-string languages: - go severity: ERROR message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries. metadata: references: - https://owasp.org/www-community/attacks/SQL_Injection category: security owasp: - A01:2017 - Injection - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')' technology: - aws-lambda cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - SQL Injection source: https://semgrep.dev/r/go.aws-lambda.security.tainted-sql-string.tainted-sql-string shortlink: https://sg.run/vX3Y semgrep.dev: rule: r_id: 18233 rv_id: 1262910 rule_id: 0oUwqg version_id: DkTRbRL url: https://semgrep.dev/playground/r/DkTRbRL/go.aws-lambda.security.tainted-sql-string.tainted-sql-string origin: community path: go.aws-lambda.security.tainted-sql-string.tainted-sql-string mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | func $HANDLER($CTX $CTXTYPE, $EVENT $TYPE, ...) {...} ... lambda.Start($HANDLER, ...) - patterns: - pattern-inside: | func $HANDLER($EVENT $TYPE) {...} ... lambda.Start($HANDLER, ...) - pattern-not-inside: | func $HANDLER($EVENT context.Context) {...} ... lambda.Start($HANDLER, ...) - focus-metavariable: $EVENT pattern-sinks: - patterns: - pattern-either: - patterns: - pattern: | "$SQLSTR" + ... - metavariable-regex: metavariable: $SQLSTR regex: (?i)(\s*select|\s*delete|\s*insert|\s*create|\s*update|\s*alter|\s*drop).* - patterns: - pattern-either: - pattern: fmt.Fprintf($F, "$SQLSTR", ...) - pattern: fmt.Sprintf("$SQLSTR", ...) - pattern: fmt.Printf("$SQLSTR", ...) - metavariable-regex: metavariable: $SQLSTR regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).* - pattern-not-inside: | log.$PRINT(...) pattern-sanitizers: - pattern: strconv.Atoi(...) - id: package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age pattern-either: - patterns: - pattern-regex: (?:(?:^---\n)(?:[^\n]*\n)|^)(?P(?:(?!\n---)[\s\S])*\S(?:(?!\n---)[\s\S])*) - pattern-not-regex: min-release-age - focus-metavariable: $TARGET - patterns: - pattern-regex: min-release-age\s*=\s*\d+ - pattern-regex: =\s*(?P\d+) - metavariable-comparison: metavariable: $AGE comparison: int($AGE) < 7 - focus-metavariable: $AGE - patterns: - pattern-regex: (?m)min-release-age[ \t]*=[ \t]*(?P[^\s\d][^\n]*) - focus-metavariable: $VAL - patterns: - pattern-regex: (?m)min-release-age\s*=\s*$ message: 'This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or unstable. Add `min-release-age = 7` to wait 7 days before resolving newly published package versions. Added in: v11.10 Reference: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/' languages: - generic severity: MEDIUM paths: include: - '**/.npmrc' metadata: category: security technology: - npm - javascript cwe: - 'CWE-829: Inclusion of Functionality from Untrusted Control Sphere' owasp: - A08:2021 - Software and Data Integrity Failures confidence: HIGH likelihood: LOW impact: HIGH subcategory: - audit vulnerability_class: - Insecure Configuration references: - https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/ - https://github.com/npm/cli/pull/8965 license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age shortlink: https://sg.run/GRo1z semgrep.dev: rule: r_id: 291648 rv_id: 1423387 rule_id: pKU6A82 version_id: WrT7LdL url: https://semgrep.dev/playground/r/WrT7LdL/package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age origin: community path: package_managers.npm.npm-missing-minimum-release-age.npm-missing-minimum-release-age - id: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase message: Found the use of an hardcoded passphrase for RSA. The passphrase can be easily discovered, and therefore should not be stored in source-code. It is recommended to remove the passphrase from source-code, and use system environment variables or a restricted configuration file. languages: - ruby severity: WARNING metadata: technology: - ruby - secrets category: security references: - https://cwe.mitre.org/data/definitions/522.html cwe: - 'CWE-798: Use of Hard-coded Credentials' owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase shortlink: https://sg.run/xPEe semgrep.dev: rule: r_id: 20730 rv_id: 1263607 rule_id: bwULyN version_id: K3TKkEo url: https://semgrep.dev/playground/r/K3TKkEo/ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase origin: community path: ruby.lang.security.hardcoded-secret-rsa-passphrase.hardcoded-secret-rsa-passphrase patterns: - pattern-either: - pattern: OpenSSL::PKey::RSA.new(..., '...') - pattern: OpenSSL::PKey::RSA.new(...).to_pem(..., '...') - pattern: OpenSSL::PKey::RSA.new(...).export(..., '...') - patterns: - pattern-inside: | $OPENSSL = OpenSSL::PKey::RSA.new(...) ... - pattern-either: - pattern: | $OPENSSL.export(...,'...') - pattern: | $OPENSSL.to_pem(...,'...') - patterns: - pattern-either: - patterns: - pattern-inside: | $ASSIGN = '...' ... - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN) - patterns: - pattern-inside: | def $METHOD1(...) ... $ASSIGN = '...' ... end ... def $METHOD2(...) ... end - pattern: OpenSSL::PKey::RSA.new(..., $ASSIGN) - patterns: - pattern-inside: | $ASSIGN = '...' ... def $METHOD(...) $OPENSSL = OpenSSL::PKey::RSA.new(...) ... end ... - pattern-either: - pattern: $OPENSSL.export(...,$ASSIGN) - pattern: $OPENSSL.to_pem(...,$ASSIGN) - patterns: - pattern-inside: | def $METHOD1(...) ... $OPENSSL = OpenSSL::PKey::RSA.new(...) ... $ASSIGN = '...' ... end ... - pattern-either: - pattern: $OPENSSL.export(...,$ASSIGN) - pattern: $OPENSSL.to_pem(...,$ASSIGN) - patterns: - pattern-inside: | def $METHOD1(...) ... $ASSIGN = '...' ... end ... def $METHOD2(...) ... $OPENSSL = OpenSSL::PKey::RSA.new(...) ... end ... - pattern-either: - pattern: $OPENSSL.export(...,$ASSIGN) - pattern: $OPENSSL.to_pem(...,$ASSIGN) - id: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization metadata: owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures cwe: - 'CWE-502: Deserialization of Untrusted Data' references: - https://docs.python.org/3/library/pickle.html category: security technology: - django cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization shortlink: https://sg.run/9oyr semgrep.dev: rule: r_id: 9467 rv_id: 1409400 rule_id: OrU3e6 version_id: GxTlb9e url: https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization origin: community path: python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization message: Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities. languages: - python severity: ERROR mode: taint pattern-sources: - pattern-either: - patterns: - pattern-inside: | def $INSIDE(..., $PARAM, ...): ... - pattern-either: - pattern: request.$REQFUNC(...) - pattern: request.$REQFUNC.get(...) - pattern: request.$REQFUNC[...] pattern-sinks: - pattern-either: - patterns: - pattern-either: - pattern: | pickle.$PICKLEFUNC(...) - pattern: | _pickle.$PICKLEFUNC(...) - pattern: | cPickle.$PICKLEFUNC(...) - pattern: | shelve.$PICKLEFUNC(...) - metavariable-regex: metavariable: $PICKLEFUNC regex: dumps|dump|load|loads - patterns: - pattern: dill.$DILLFUNC(...) - metavariable-regex: metavariable: $DILLFUNC regex: dump|dump_session|dumps|load|load_session|loads - patterns: - pattern: yaml.$YAMLFUNC(...) - pattern-not: yaml.$YAMLFUNC(..., Dumper=SafeDumper, ...) - pattern-not: yaml.$YAMLFUNC(..., Dumper=yaml.SafeDumper, ...) - pattern-not: yaml.$YAMLFUNC(..., Loader=SafeLoader, ...) - pattern-not: yaml.$YAMLFUNC(..., Loader=yaml.SafeLoader, ...) - metavariable-regex: metavariable: $YAMLFUNC regex: dump|dump_all|load|load_all - id: bash.curl.security.curl-eval.curl-eval severity: WARNING languages: - bash message: Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity. metadata: owasp: - A03:2021 - Injection - A05:2025 - Injection cwe: - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (''Eval Injection'')' category: security technology: - bash - curl confidence: MEDIUM references: - https://owasp.org/Top10/A03_2021-Injection subcategory: - vuln likelihood: MEDIUM impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Code Injection source: https://semgrep.dev/r/bash.curl.security.curl-eval.curl-eval shortlink: https://sg.run/0yqJ semgrep.dev: rule: r_id: 14554 rv_id: 1262601 rule_id: KxU7Rq version_id: JdTzxL2 url: https://semgrep.dev/playground/r/JdTzxL2/bash.curl.security.curl-eval.curl-eval origin: community path: bash.curl.security.curl-eval.curl-eval mode: taint pattern-sources: - pattern: | $(curl ...) - pattern: | `curl ...` pattern-sinks: - pattern: eval ... - id: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module). metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' references: - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures technology: - java - secrets - jwt category: security cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret shortlink: https://sg.run/RoDK semgrep.dev: rule: r_id: 9149 rv_id: 1262980 rule_id: oqUeAn version_id: d6Tyx8j url: https://semgrep.dev/playground/r/d6Tyx8j/java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret origin: community path: java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret languages: - java severity: WARNING patterns: - pattern-either: - pattern: | (Algorithm $ALG) = $ALGO.$HMAC("$Y"); - pattern: | $SECRET = "$Y"; ... (Algorithm $ALG) = $ALGO.$HMAC($SECRET); - pattern: | class $CLASS { ... $TYPE $SECRET = "$Y"; ... $RETURNTYPE $FUNC (...) { ... (Algorithm $ALG) = $ALGO.$HMAC($SECRET); ... } ... } - focus-metavariable: $Y - metavariable-regex: metavariable: $HMAC regex: (HMAC384|HMAC256|HMAC512) - id: scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings patterns: - pattern: secure = false - pattern-inside: | session = { ... } message: Session cookie `Secure` flag is explicitly disabled. The `secure` flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the `Secure` flag by setting `secure` to `true` in configuration file. languages: - generic severity: WARNING paths: include: - '*.conf' metadata: category: security references: - https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security - https://www.playframework.com/documentation/2.8.x/SettingsSession#Session-Configuration technology: - play - scala cwe: - 'CWE-614: Sensitive Cookie in HTTPS Session Without ''Secure'' Attribute' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration confidence: MEDIUM subcategory: - vuln likelihood: LOW impact: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cookie Security source: https://semgrep.dev/r/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings shortlink: https://sg.run/8z8N semgrep.dev: rule: r_id: 18284 rv_id: 1263685 rule_id: GdUDJO version_id: e1TyjJv url: https://semgrep.dev/playground/r/e1TyjJv/scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings origin: community path: scala.play.security.conf-insecure-cookie-settings.conf-insecure-cookie-settings - id: python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc pattern-either: - pattern: import xmlrpclib - pattern: import SimpleXMLRPCServer - pattern: import xmlrpc message: Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead. metadata: cwe: - 'CWE-776: Improper Restriction of Recursive Entity References in DTDs (''XML Entity Expansion'')' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration source-rule-url: https://github.com/PyCQA/bandit/blob/07f84cb5f5e7c1055e6feaa0fe93afa471de0ac3/bandit/blacklists/imports.py#L160 references: - https://pypi.org/project/defusedxml/ - https://docs.python.org/3/library/xml.html#xml-vulnerabilities category: security technology: - python subcategory: - audit likelihood: LOW impact: MEDIUM confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc shortlink: https://sg.run/weqY semgrep.dev: rule: r_id: 9629 rv_id: 1263543 rule_id: ZqU5EZ version_id: ZRTKA8z url: https://semgrep.dev/playground/r/ZRTKA8z/python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc origin: community path: python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc severity: ERROR languages: - python - id: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv message: The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, though they're not completely broken. Use 'createCipheriv' or 'createDecipheriv' instead. metadata: cwe: - 'CWE-1204: Generation of Weak Initialization Vector (IV)' category: security subcategory: - vuln technology: - node-crypto likelihood: HIGH impact: MEDIUM confidence: HIGH references: - https://nodejs.org/api/crypto.html#cryptocreatecipheralgorithm-password-options - https://nodejs.org/api/crypto.html#cryptocreatedecipheralgorithm-password-options license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Other source: https://semgrep.dev/r/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv shortlink: https://sg.run/bw33r semgrep.dev: rule: r_id: 146570 rv_id: 945898 rule_id: X5UQRR7 version_id: ZRT3510 url: https://semgrep.dev/playground/r/ZRT3510/javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv origin: community path: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv languages: - javascript - typescript severity: ERROR patterns: - pattern-either: - pattern: | $CRYPTO.createCipher(...) - pattern: | $CRYPTO.createDecipher(...) - id: kotlin.lang.security.use-of-sha1.use-of-sha1 message: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. languages: - kt severity: WARNING metadata: owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' source-rule-url: https://find-sec-bugs.github.io/bugs.htm#WEAK_MESSAGE_DIGEST_SHA1 asvs: section: V6 Stored Cryptography Verification Requirements control_id: 6.2.5 Insecure Algorithm control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms version: '4' category: security technology: - kotlin references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/kotlin.lang.security.use-of-sha1.use-of-sha1 shortlink: https://sg.run/N1pp semgrep.dev: rule: r_id: 15127 rv_id: 1263268 rule_id: ZqUOdd version_id: 2KTv2XZ url: https://semgrep.dev/playground/r/2KTv2XZ/kotlin.lang.security.use-of-sha1.use-of-sha1 origin: community path: kotlin.lang.security.use-of-sha1.use-of-sha1 pattern-either: - patterns: - pattern: | $VAR = $MD.getInstance("$ALGO") - metavariable-regex: metavariable: $ALGO regex: (SHA1|SHA-1) - pattern: | $DU.getSha1Digest().digest(...) - id: yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath patterns: - pattern-inside: | volumes: ... - pattern: | hostPath: ... path: /var/run/docker.sock message: Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this. metadata: cwe: - 'CWE-250: Execution with Unnecessary Privileges' references: - https://kubernetes.io/docs/concepts/storage/volumes/#hostpath - https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers category: security technology: - kubernetes subcategory: - vuln likelihood: LOW impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath shortlink: https://sg.run/v0pR semgrep.dev: rule: r_id: 10133 rv_id: 947054 rule_id: d8Uz6v version_id: nWTpYZe url: https://semgrep.dev/playground/r/nWTpYZe/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath origin: community path: yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath languages: - yaml severity: WARNING - id: java.lang.security.audit.md5-used-as-password.md5-used-as-password languages: - java severity: WARNING message: It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as PBKDF2 or bcrypt. You can use `javax.crypto.SecretKeyFactory` with `SecretKeyFactory.getInstance("PBKDF2WithHmacSHA1")` or, if using Spring, `org.springframework.security.crypto.bcrypt`. metadata: category: security technology: - java - md5 references: - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html - https://github.com/returntocorp/semgrep-rules/issues/1609 - https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory - https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' subcategory: - vuln likelihood: HIGH impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.md5-used-as-password.md5-used-as-password shortlink: https://sg.run/JxEQ semgrep.dev: rule: r_id: 14690 rv_id: 1263029 rule_id: JDULAW version_id: bZT53QB url: https://semgrep.dev/playground/r/bZT53QB/java.lang.security.audit.md5-used-as-password.md5-used-as-password origin: community path: java.lang.security.audit.md5-used-as-password.md5-used-as-password mode: taint pattern-sources: - patterns: - pattern-inside: | $TYPE $MD = MessageDigest.getInstance("MD5"); ... - pattern: $MD.digest(...); pattern-sinks: - patterns: - pattern: $MODEL.$METHOD(...); - metavariable-regex: metavariable: $METHOD regex: (?i)(.*password.*) - id: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing severity: ERROR metadata: cwe: - 'CWE-611: Improper Restriction of XML External Entity Reference' owasp: - A04:2017 - XML External Entities (XXE) - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration asvs: section: V5 Validation, Sanitization and Encoding control_id: 5.5.2 Insecue XML Deserialization control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v55-deserialization-prevention version: '4' references: - https://semgrep.dev/blog/2022/xml-security-in-java - https://semgrep.dev/docs/cheat-sheets/java-xxe/ - https://blog.sonarsource.com/secure-xml-processor - https://xerces.apache.org/xerces2-j/features.html category: security technology: - java - xml cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - XML Injection source: https://semgrep.dev/r/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing shortlink: https://sg.run/Gj32 semgrep.dev: rule: r_id: 59048 rv_id: 1263061 rule_id: j2Udpk version_id: YDTZeko url: https://semgrep.dev/playground/r/YDTZeko/java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing origin: community path: java.lang.security.audit.xxe.saxparserfactory-disallow-doctype-decl-missing.saxparserfactory-disallow-doctype-decl-missing message: DOCTYPE declarations are enabled for this SAXParserFactory. This is vulnerable to XML external entity attacks. Disable this by setting the feature `http://apache.org/xml/features/disallow-doctype-decl` to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features `http://xml.org/sax/features/external-general-entities` and `http://xml.org/sax/features/external-parameter-entities` to false. NOTE - The previous links are not meant to be clicked. They are the literal config key values that are supposed to be used to disable these features. For more information, see https://semgrep.dev/docs/cheat-sheets/java-xxe/#3a-documentbuilderfactory. mode: taint pattern-sources: - by-side-effect: true patterns: - pattern-either: - pattern: | $FACTORY = SAXParserFactory.newInstance(); - patterns: - pattern: $FACTORY - pattern-inside: | class $C { ... $V $FACTORY = SAXParserFactory.newInstance(); ... } - pattern-not-inside: | class $C { ... $V $FACTORY = SAXParserFactory.newInstance(); static { ... $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = SAXParserFactory.newInstance(); static { ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... } ... } - pattern-not-inside: | class $C { ... $V $FACTORY = SAXParserFactory.newInstance(); static { ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... } ... } pattern-sinks: - patterns: - pattern: $FACTORY.newSAXParser(); pattern-sanitizers: - by-side-effect: true pattern-either: - patterns: - pattern-either: - pattern: | $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - pattern: | $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - pattern: | $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); - focus-metavariable: $FACTORY - patterns: - pattern-either: - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... } ... } - pattern-inside: | class $C { ... $T $M(...) { ... $FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false); ... $FACTORY.setFeature("http://xml.org/sax/features/external-general-entities",false); ... } ... } - pattern: $M($X) - focus-metavariable: $X fix: | $FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); $FACTORY.newSAXParser(); languages: - java - id: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size message: Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher. metadata: cwe: - 'CWE-326: Inadequate Encryption Strength' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures source-rule-url: https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py references: - https://www.pycryptodome.org/src/public_key/dsa - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf category: security technology: - pycryptodome subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: HIGH functional-categories: - crypto::search::key-length::pycryptodome - crypto::search::key-length::pycryptodomex license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size shortlink: https://sg.run/4y8l semgrep.dev: rule: r_id: 9688 rv_id: 1263554 rule_id: AbUWje version_id: JdTzxbQ url: https://semgrep.dev/playground/r/JdTzxbQ/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size origin: community path: python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size options: symbolic_propagation: true languages: - python severity: WARNING patterns: - pattern-either: - pattern: Crypto.PublicKey.DSA.generate(..., bits=$SIZE, ...) - pattern: Crypto.PublicKey.DSA.generate($SIZE, ...) - pattern: Cryptodome.PublicKey.DSA.generate(..., bits=$SIZE, ...) - pattern: Cryptodome.PublicKey.DSA.generate($SIZE, ...) - metavariable-comparison: metavariable: $SIZE comparison: $SIZE < 2048 - id: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded message: A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy. severity: WARNING metadata: likelihood: LOW impact: HIGH confidence: MEDIUM category: security subcategory: - vuln cwe: - 'CWE-798: Use of Hard-coded Credentials' cwe2020-top25: true cwe2021-top25: true cwe2022-top25: true owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures technology: - secrets vulnerability_class: - Hard-coded Secrets source_rule_url: https://semgrep.dev/playground/r/d8Ur5BA/achufistov6_personal_org.build-gradle-password-hardcoded license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded shortlink: https://sg.run/qN29x semgrep.dev: rule: r_id: 137856 rv_id: 1263257 rule_id: ReUD6Kg version_id: DkTRbLX url: https://semgrep.dev/playground/r/DkTRbLX/kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded origin: community path: kotlin.gradle.security.build-gradle-password-hardcoded.build-gradle-password-hardcoded languages: - kotlin options: symbolic_propagation: true patterns: - pattern-either: - pattern: '$PASS = env[...] ?: $VALUE' - metavariable-regex: metavariable: $PASS regex: (password|pass|passwd|loginPassword) - metavariable-pattern: language: generic metavariable: $VALUE patterns: - pattern-either: - pattern-regex: ^[A-Za-z0-9/+=]+$ paths: include: - '*build.gradle.kts' - id: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2 pattern: $CIPHER.getInstance("RC2") metadata: functional-categories: - crypto::search::symmetric-algorithm::javax.crypto cwe: - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm' owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures category: security technology: - java references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2 shortlink: https://sg.run/EEvA semgrep.dev: rule: r_id: 48737 rv_id: 1263014 rule_id: qNUzXG version_id: K3TKkg0 url: https://semgrep.dev/playground/r/K3TKkg0/java.lang.security.audit.crypto.use-of-rc2.use-of-rc2 origin: community path: java.lang.security.audit.crypto.use-of-rc2.use-of-rc2 message: 'Use of RC2 was detected. RC2 is vulnerable to related-key attacks, and is therefore considered non-compliant. Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.' severity: WARNING languages: - java - id: generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key pattern-regex: da2-[a-z0-9]{26} languages: - regex message: AWS AppSync GraphQL Key detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - appsync confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key shortlink: https://sg.run/AvJ6 semgrep.dev: rule: r_id: 9050 rv_id: 1262861 rule_id: pKUOoZ version_id: o5TbD9o url: https://semgrep.dev/playground/r/o5TbD9o/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key origin: community path: generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key - id: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service pattern: | spec: ... insecureSkipTLSVerify: true message: 'Service is disabling TLS certificate verification when communicating with the server. This makes your HTTPS connections insecure. Remove the ''insecureSkipTLSVerify: true'' key to secure communication.' metadata: cwe: - 'CWE-319: Cleartext Transmission of Sensitive Information' references: - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#apiservice-v1-apiregistration-k8s-io category: security technology: - kubernetes owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Mishandled Sensitive Information source: https://semgrep.dev/r/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service shortlink: https://sg.run/zk10 semgrep.dev: rule: r_id: 10117 rv_id: 1263944 rule_id: pKUGXr version_id: e1TyjnR url: https://semgrep.dev/playground/r/e1TyjnR/yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service origin: community path: yaml.kubernetes.security.skip-tls-verify-service.skip-tls-verify-service languages: - yaml severity: WARNING - id: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1 message: Should not use SHA1 to generate hashes. There is a proven SHA1 hash collision by Google, which could lead to vulnerabilities. Use SHA256, SHA3 or other hashing functions instead. metadata: cwe: - 'CWE-328: Use of Weak Hash' references: - https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html - https://shattered.io/ category: security technology: - ruby owasp: - A03:2017 - Sensitive Data Exposure - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures subcategory: - vuln likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Insecure Hashing Algorithm source: https://semgrep.dev/r/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1 shortlink: https://sg.run/e4qX semgrep.dev: rule: r_id: 9732 rv_id: 1263620 rule_id: EwU4jq version_id: K3TKkEZ url: https://semgrep.dev/playground/r/K3TKkEZ/ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1 origin: community path: ruby.lang.security.weak-hashes-sha1.weak-hashes-sha1 languages: - ruby severity: WARNING pattern-either: - pattern: Digest::SHA1.$FUNC - pattern: OpenSSL::Digest::SHA1.$FUNC - pattern: OpenSSL::HMAC.$FUNC("sha1",...) - id: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse metadata: functional-categories: - crypto::search::randomness::javax.crypto cwe: - 'CWE-323: Reusing a Nonce, Key Pair in Encryption' category: security source-rule-url: https://www.youtube.com/watch?v=r1awgAl90wM technology: - java owasp: - A02:2021 - Cryptographic Failures - A04:2025 - Cryptographic Failures references: - https://owasp.org/Top10/A02_2021-Cryptographic_Failures subcategory: - vuln likelihood: MEDIUM impact: MEDIUM confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cryptographic Issues source: https://semgrep.dev/r/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse shortlink: https://sg.run/Dww2 semgrep.dev: rule: r_id: 11908 rv_id: 1263000 rule_id: GdUZZ3 version_id: 0bTKzGk url: https://semgrep.dev/playground/r/0bTKzGk/java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse origin: community path: java.lang.security.audit.crypto.gcm-nonce-reuse.gcm-nonce-reuse languages: - java message: 'GCM IV/nonce is reused: encryption can be totally useless' patterns: - pattern-either: - pattern: new GCMParameterSpec(..., "...".getBytes(...), ...); - pattern: byte[] $NONCE = "...".getBytes(...); ... new GCMParameterSpec(..., $NONCE, ...); severity: ERROR - id: python.lang.security.unverified-ssl-context.unverified-ssl-context patterns: - pattern-either: - pattern: ssl._create_unverified_context(...) - pattern: ssl._create_default_https_context = ssl._create_unverified_context fix-regex: regex: _create_unverified_context replacement: create_default_context message: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. metadata: owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures cwe: - 'CWE-295: Improper Certificate Validation' references: - https://docs.python.org/3/library/ssl.html#ssl-security - https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection category: security technology: - python subcategory: - audit likelihood: LOW impact: MEDIUM confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context shortlink: https://sg.run/N4lp semgrep.dev: rule: r_id: 9627 rv_id: 1263540 rule_id: v8UnkQ version_id: e1Tyjlj url: https://semgrep.dev/playground/r/e1Tyjlj/python.lang.security.unverified-ssl-context.unverified-ssl-context origin: community path: python.lang.security.unverified-ssl-context.unverified-ssl-context severity: ERROR languages: - python - id: generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token pattern-regex: amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} languages: - regex message: Amazon MWS Auth Token detected severity: ERROR metadata: cwe: - 'CWE-798: Use of Hard-coded Credentials' source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json category: security technology: - secrets - aws confidence: LOW owasp: - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures cwe2022-top25: true cwe2021-top25: true subcategory: - audit likelihood: LOW impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Hard-coded Secrets source: https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token shortlink: https://sg.run/PJzE semgrep.dev: rule: r_id: 9045 rv_id: 1262856 rule_id: lBU9bw version_id: K3TKkGj url: https://semgrep.dev/playground/r/K3TKkGj/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token origin: community path: generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token - id: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization severity: WARNING languages: - C# metadata: cwe: - 'CWE-502: Deserialization of Untrusted Data' owasp: - A08:2017 - Insecure Deserialization - A08:2021 - Software and Data Integrity Failures - A08:2025 - Software or Data Integrity Failures references: - https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide category: security technology: - .net confidence: HIGH cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: MEDIUM impact: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - 'Insecure Deserialization ' source: https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization shortlink: https://sg.run/ZeXW semgrep.dev: rule: r_id: 11135 rv_id: 1262635 rule_id: bwUOjK version_id: nWT2LGp url: https://semgrep.dev/playground/r/nWT2LGp/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization origin: community path: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization message: The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure patterns: - pattern-inside: | using System.Runtime.Serialization.Formatters.Binary; ... - pattern: | new BinaryFormatter(); - id: json.aws.security.wildcard-assume-role.wildcard-assume-role patterns: - pattern-inside: | "Statement": [...] - pattern-inside: | {..., "Effect": "Allow", ..., "Action": "sts:AssumeRole", ...} - pattern: | "Principal": {..., "AWS": "*", ...} message: 'Detected wildcard access granted to sts:AssumeRole. This means anyone with your AWS account ID and the name of the role can assume the role. Instead, limit to a specific identity in your account, like this: `arn:aws:iam:::root`.' metadata: cwe: - 'CWE-250: Execution with Unnecessary Privileges' category: security technology: - aws references: - https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/ owasp: - A06:2017 - Security Misconfiguration - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration subcategory: - vuln likelihood: HIGH impact: HIGH confidence: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/json.aws.security.wildcard-assume-role.wildcard-assume-role shortlink: https://sg.run/7YEZ semgrep.dev: rule: r_id: 15138 rv_id: 1263256 rule_id: JDULx5 version_id: BjTkZoy url: https://semgrep.dev/playground/r/BjTkZoy/json.aws.security.wildcard-assume-role.wildcard-assume-role origin: community path: json.aws.security.wildcard-assume-role.wildcard-assume-role languages: - json severity: ERROR - id: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust message: Detected the use of `$TRUST`. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. If you have to use `$TRUST`, ensure it does not come from user-input or use the appropriate prevention mechanism e.g. input validation or sanitization depending on the context. metadata: cwe: - 'CWE-79: Improper Neutralization of Input During Web Page Generation (''Cross-site Scripting'')' references: - https://angular.io/api/platform-browser/DomSanitizer - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html owasp: - A07:2017 - Cross-Site Scripting (XSS) - A03:2021 - Injection - A05:2025 - Injection confidence: MEDIUM category: security technology: - angular - browser cwe2022-top25: true cwe2021-top25: true subcategory: - vuln likelihood: LOW impact: MEDIUM license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Cross-Site-Scripting (XSS) source: https://semgrep.dev/r/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust shortlink: https://sg.run/KWxP semgrep.dev: rule: r_id: 9755 rv_id: 1263902 rule_id: oqUzgA version_id: 5PTo1zk url: https://semgrep.dev/playground/r/5PTo1zk/typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust origin: community path: typescript.angular.security.audit.angular-domsanitizer.angular-bypasssecuritytrust languages: - typescript severity: WARNING mode: taint pattern-sources: - patterns: - pattern-either: - pattern-inside: | function ...({..., $X: string, ...}) { ... } - pattern-inside: | function ...(..., $X: string, ...) { ... } - focus-metavariable: $X pattern-sinks: - patterns: - pattern-either: - pattern: $X.$TRUST($Y) - focus-metavariable: $Y - pattern-not: | $X.$TRUST(`...`) - pattern-not: | $X.$TRUST("...") - metavariable-regex: metavariable: $TRUST regex: (bypassSecurityTrustHtml|bypassSecurityTrustStyle|bypassSecurityTrustScript|bypassSecurityTrustUrl|bypassSecurityTrustResourceUrl) pattern-sanitizers: - patterns: - pattern-either: - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | import * as $S from "underscore.string" ... - pattern-inside: | import $S from "underscore.string" ... - pattern-inside: | $S = require("underscore.string") ... - pattern-either: - pattern: $S.escapeHTML(...) - patterns: - pattern-either: - pattern-inside: | import $S from "dompurify" ... - pattern-inside: | import { ..., $S,... } from "dompurify" ... - pattern-inside: | import * as $S from "dompurify" ... - pattern-inside: | $S = require("dompurify") ... - pattern-inside: | import $S from "isomorphic-dompurify" ... - pattern-inside: | import * as $S from "isomorphic-dompurify" ... - pattern-inside: | $S = require("isomorphic-dompurify") ... - pattern-either: - patterns: - pattern-inside: | $VALUE = $S(...) ... - pattern: $VALUE.sanitize(...) - patterns: - pattern-inside: | $VALUE = $S.sanitize ... - pattern: $S(...) - pattern: $S.sanitize(...) - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'xss'; ... - pattern-inside: | import * as $S from 'xss'; ... - pattern-inside: | $S = require("xss") ... - pattern: $S(...) - patterns: - pattern-either: - pattern-inside: | import $S from 'sanitize-html'; ... - pattern-inside: | import * as $S from "sanitize-html"; ... - pattern-inside: | $S = require("sanitize-html") ... - pattern: $S(...) - patterns: - pattern: sanitizer.sanitize(...) - pattern-not: sanitizer.sanitize(SecurityContext.NONE, ...); - id: python.fastapi.security.wildcard-cors.wildcard-cors languages: - python message: CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided. mode: taint pattern-sources: - pattern: '[..., "*", ...]' pattern-sinks: - patterns: - pattern: | $APP.add_middleware( CORSMiddleware, allow_origins=$ORIGIN, ...); - focus-metavariable: $ORIGIN severity: WARNING metadata: cwe: - 'CWE-942: Permissive Cross-domain Policy with Untrusted Domains' owasp: - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration category: security technology: - python - fastapi references: - https://owasp.org/Top10/A05_2021-Security_Misconfiguration - https://cwe.mitre.org/data/definitions/942.html likelihood: HIGH impact: LOW confidence: MEDIUM vulnerability_class: - Configuration subcategory: - vuln license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license source: https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors shortlink: https://sg.run/KxApY semgrep.dev: rule: r_id: 112311 rv_id: 1263413 rule_id: lBU4JQ3 version_id: A8Tgd1R url: https://semgrep.dev/playground/r/A8Tgd1R/python.fastapi.security.wildcard-cors.wildcard-cors origin: community path: python.fastapi.security.wildcard-cors.wildcard-cors - id: python.requests.security.disabled-cert-validation.disabled-cert-validation message: Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. metadata: cwe: - 'CWE-295: Improper Certificate Validation' owasp: - A03:2017 - Sensitive Data Exposure - A07:2021 - Identification and Authentication Failures - A07:2025 - Authentication Failures references: - https://stackoverflow.com/questions/41740361/is-it-safe-to-disable-ssl-certificate-verification-in-pythonss-requests-lib category: security technology: - requests subcategory: - audit likelihood: LOW impact: LOW confidence: LOW license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authentication source: https://semgrep.dev/r/python.requests.security.disabled-cert-validation.disabled-cert-validation shortlink: https://sg.run/AlYp semgrep.dev: rule: r_id: 9694 rv_id: 1263574 rule_id: qNUoYR version_id: 1QTypBw url: https://semgrep.dev/playground/r/1QTypBw/python.requests.security.disabled-cert-validation.disabled-cert-validation origin: community path: python.requests.security.disabled-cert-validation.disabled-cert-validation languages: - python severity: ERROR pattern-either: - pattern: requests.put(..., verify=False, ...) - pattern: requests.patch(..., verify=False, ...) - pattern: requests.delete(..., verify=False, ...) - pattern: requests.head(..., verify=False, ...) - pattern: requests.options(..., verify=False, ...) - pattern: requests.request(..., verify=False, ...) - pattern: requests.get(..., verify=False, ...) - pattern: requests.post(..., verify=False, ...) fix-regex: regex: verify(\s)*=(\s)*False replacement: verify=True - id: yaml.docker-compose.security.privileged-service.privileged-service patterns: - pattern-inside: | version: ... ... services: ... $SERVICE: ... privileged: $TRUE - focus-metavariable: $TRUE - metavariable-regex: metavariable: $TRUE regex: (true) fix: | false message: Service '$SERVICE' is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability. metadata: cwe: - 'CWE-250: Execution with Unnecessary Privileges' owasp: - A06:2017 - Security Misconfiguration - A05:2021 - Security Misconfiguration - A02:2025 - Security Misconfiguration references: - https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html - https://containerjournal.com/topics/container-security/why-running-a-privileged-container-is-not-a-good-idea/ category: security technology: - docker-compose subcategory: - vuln likelihood: HIGH impact: HIGH confidence: HIGH license: Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license vulnerability_class: - Improper Authorization source: https://semgrep.dev/r/yaml.docker-compose.security.privileged-service.privileged-service shortlink: https://sg.run/AlX0 semgrep.dev: rule: r_id: 10006 rv_id: 1263922 rule_id: DbUW17 version_id: 0bTKzXZ url: https://semgrep.dev/playground/r/0bTKzXZ/yaml.docker-compose.security.privileged-service.privileged-service origin: community path: yaml.docker-compose.security.privileged-service.privileged-service languages: - yaml severity: WARNING