<< Back to security report

──bianliuzhu/an-cli/en — semgrep Scan

Repositorybianliuzhu/an-cli →

Commitc5909a0 →

VerdictFAIL

Score65

DateAug 31, 2026

──Findings

Severity	Rule	Message	File:Line
HIGH	javascript.lang.security.detect-child-process.detect-child-process	Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.	bianliuzhu/an-cli/en-c476ab84/src/git-local-config/index.ts:34 →
HIGH	javascript.lang.security.detect-child-process.detect-child-process	Detected calls to child_process from a function argument `css`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.	bianliuzhu/an-cli/en-c476ab84/src/standard/install-stylelint.ts:18 →
MEDIUM	problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification	Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used.	bianliuzhu/an-cli/en-c476ab84/src/swagger-codegen/get-data.ts:54 →