Open nullify-latest[bot] opened 6 months ago
New code security updates for commit 7b08802cad0eab274223c14606e351ff06708a25
New | Fixed | Allowlisted | Unallowlisted |
---|---|---|---|
2 | 0 | 2 | 0 |
New code security updates for commit be95f0cb87719124235dd5e77764f0e13841afa4
New | Fixed | Allowlisted | Unallowlisted |
---|---|---|---|
1 | 0 | 1 | 0 |
Severity Threshold: 🔵 MEDIUM
1 Potential vulnerability sources found within this repo
🔴 CRITICAL
🟡 HIGH
🔵 MEDIUM
⚪ LOW
ID: 01J0AFXMQB70HYS1ESS1B0ZMKX
Language: Go
Severity: 🔵 MEDIUM
CWE-22
Potential file inclusion via variable
The vulnerability identified, 'Potential file inclusion via variable', refers to a security issue where the file path provided to the
os.ReadFile(path)
function is not being validated or sanitized before use. This means if an attacker can influence the contents of the 'path' variable, they could potentially make the server read a file that should not be accessed. This type of vulnerability is generally referred to as 'Local File Inclusion' (LFI), where an attacker could access or manipulate local files on the server using a vulnerable path or file handling function. Read more: https://cwe.mitre.org/data/definitions/22.html https://github.com/Nullify-Platform/config-file-parser/blob/2aee30a6a885771993a62fa92bd655c1fe056d5a/pkg/parser/load_from_file.go#L10Reply with
/nullify
to interact with me like another developer