Sighthound scanned github/gh-aw and found 172 potential issues (130 outside test/testdata). Below are the top 5 highest-severity findings (all "Critical" / Command Injection) selected from actionable.json. 1. pkg/workflow/pipvalidation.go:239 Severity: Critical — Command Injection Snippet: exec.Command(uvPath, "pip", "show", pkgName, "--no-cache") Remediation: Validate/allowlist pkgName before use (e.g. restrict to a strict package-name regex) even though exec.Command already avoids a shell; confirm no untrusted data reaches uvPath or flags either. 2. pkg/workflow/pipvalidation.go:88 Severity: Critical — Command Injection Snippet: exec.Command(pipPath, "index", "versions", pkgName, "--pre...
Sighthound security scan flagged 170 findings (38 Critical, 13 High, 77 Medium) in github/gh-aw. Below are the 5 highest-severity findings outside test/testdata paths for triage. 1. pkg/workflow/pipvalidation.go:239 — Critical, Command Injection (CWE-78) exec.Command(uvPath, "pip", "show", pkgName, "--no-cache") pkgName may originate from workflow/user input. Validate/allowlist the package name format (e.g. regex for valid PyPI package names) before passing it to exec.Command. 2. pkg/workflow/dependabotmanifests.go:282 — Critical, Command Injection (CWE-78) exec.Command(npmPath, "install", "--package-lock-only", "--ignore-scripts") Confirm working directory and any interpolated paths/args...
Sighthound Security Scan — Top Findings Automated static analysis (Sighthound) flagged 123 actionable findings (33 Critical, 13 High, 77 Medium) outside test paths. Below are the 5 highest-severity findings for triage. 1. Command Injection (Critical, CWE-78) File: pkg/workflow/pipvalidation.go:230 Snippet: exec.Command(uvPath, "pip", "show", pkgName, "--no-cache") Remediation: Confirm pkgName is validated/sanitized before use (e.g., matched against an allowlist regex for valid package name characters) before being passed to exec.Command. Arguments are already passed as a fixed slice, which mitigates shell injection, but untrusted package names should still be validated. 2. Command Injecti...