You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The codebase has 24 confirmed vulnerabilities with overall risk CRITICAL. Security score: 0/100.
Key Concerns
Found 24 vulnerabilities requiring attention
2 critical and 7 high-severity findings need immediate review
Security Metrics
Security Score: 0/100
Vulnerability Density: Unknown
Mean Time to Remediate: Estimated 48-96 hours total
Trend: unknown
Detailed Findings (24 Total)
[HIGH] OAuth tokens and API keys are stored in plaintext in the local filesystem withou
ID: V-001
Threat ID: N/A
Severity: HIGH
Risk Score: 8.0/10
Confidence: high
OWASP: A00:2021 - Other
Description:
OAuth tokens and API keys are stored in plaintext in the local filesystem without encryption. The getToken and setToken functions in plugins/auth-oauth2/src/store.ts write credentials directly to disk without any cryptographic protection. While PBKDF2 is available in the Rust dependencies (src-tauri/Cargo.lock:3809), it is not being utilized to encrypt stored credentials.
Attack Vector:
An attacker sends concurrent POST requests with large image files to /api/enhance or /api/detect endpoints. Each request triggers expensive model inference operations, and without rate limiting, the attacker can exhaust server resources with a simple script: for i in $(seq 1 100); do curl -X POST -F 'image=@large_image.png' http://target/api/enhance & done
Business Impact:
Critical severity vulnerability requiring attention
Remediation:
Priority: IMMEDIATE | Effort: medium
{'priority': 'immediate', 'effort': 'low', 'steps': ['Add rate limiting middleware to backend/app.py and backend-detection/app.py using slowapi: from slowapi import Limiter; limiter = Limiter(key_func=get_remote_address); app.state.limiter = limiter', "Decorate /api/enhance and /api/detect endpoints with rate limits: @limiter.limit('5/minute')", 'Implement file size validation before processing to prevent large file uploads from bypassing rate limits']}
CWE IDs: CWE-770
[LOW] Plugins execute with full Node.js runtime privileges without any sandboxing or p
ID: V-002
Threat ID: N/A
Severity: LOW
Risk Score: 8.0/10
Confidence: high
OWASP: A00:2021 - Other
Description:
Plugins execute with full Node.js runtime privileges without any sandboxing or permission restrictions. All plugins have unrestricted access to filesystem operations (fs module), network requests, and child process execution. No manifest-based permission system exists to limit plugin capabilities.
Attack Vector:
An attacker sends GET requests to public endpoints: curl http://target:8080/ returns internal Kubernetes service topology including namespace structure (caisat.svc.cluster.local). Similarly, curl http://target:8000/health reveals S3 bucket names and connection error details.
Business Impact:
Critical severity vulnerability requiring attention
Remediation:
Priority: IMMEDIATE | Effort: medium
{'priority': 'short-term', 'effort': 'low', 'steps': ['In backend-detection/app.py:250-260, remove MODEL_ENDPOINT, CLASS_NAMES, and CONFIDENCE_THRESHOLD from the public root response', 'In backend-changedetection/app.py:68-82, remove S3 bucket name and detailed error messages from health response', "Return only basic status information ('healthy'/'unhealthy') for public-facing health endpoints"]}
CWE IDs: CWE-200
[MEDIUM] The gRPCurl command generation uses unsafe string concatenation without proper s
ID: V-003
Threat ID: N/A
Severity: MEDIUM
Risk Score: 6.0/10
Confidence: medium
OWASP: A00:2021 - Other
Description:
The gRPCurl command generation uses unsafe string concatenation without proper shell escaping. User-controlled values from API responses (headers, endpoint, data) are directly interpolated into the command string. An attacker can inject shell metacharacters to execute arbitrary commands when the user pastes and runs the generated command.
Attack Vector:
An attacker uploads a decompression bomb (small PNG that decompresses to gigabytes of pixel data): curl -X POST -F 'image=@decompression_bomb.png' http://target/api/enhance. PIL attempts to decompress the full image, causing out-of-memory conditions. Alternatively, non-image files cause unhandled exceptions that leak error details.
Business Impact:
High severity vulnerability requiring attention
Remediation:
Priority: SHORT-TERM | Effort: medium
{'priority': 'immediate', 'effort': 'low', 'steps': ['Add file size validation in both endpoints: if image.size and image.size > MAX_FILE_SIZE: raise HTTPException(413)', 'Set PIL image pixel limit: Image.MAX_IMAGE_PIXELS = 178956970', "Validate content types: if image.content_type not in ['image/png', 'image/jpeg']: raise HTTPException(415)", 'Implement magic byte verification before processing']}
CWE IDs: CWE-434, CWE-20
[MEDIUM] The application uses the nodejs-file-downloader dependency, but there is no ev
ID: V-005
Threat ID: N/A
Severity: MEDIUM
Risk Score: 6.0/10
Confidence: high
OWASP: A00:2021 - Other
Description:
The application uses the nodejs-file-downloader dependency, but there is no evidence of cryptographic verification for downloaded files. Without checksum validation or signature verification, downloaded content (such as plugins or updates) could be tampered with via a Man-in-the-Middle (MITM) attack.
Attack Vector:
An attacker with access to the source repository obtains the default S3 credentials. If deployment uses these defaults (as suggested by the 'change-in-production' comment), the attacker can access S3 storage: aws --endpoint-url http://exposed-s4:7480 s3 ls s3://satellite-images/ --access-key caisat-access-key --secret-key caisat-secret-key-change-in-production
Business Impact:
High severity vulnerability requiring attention
Remediation:
Priority: SHORT-TERM | Effort: medium
{'priority': 'immediate', 'effort': 'low', 'steps': ['In backend-changedetection/app.py:16-18, remove default fallback values for S3_ACCESS_KEY and S3_SECRET_KEY', 'Implement fail-fast validation: raise ValueError if S3 credentials are not provided via environment variables', 'In chart/values.yaml:244-246, reference external secrets or generate random credentials at install time', 'Add secrets scanning to CI/CD pipeline to prevent credential commits']}
[MEDIUM] The file import functionality lacks resource limits and validation. It loads ent
ID: V-004
Threat ID: N/A
Severity: MEDIUM
Risk Score: 4.0/10
Confidence: medium
OWASP: A00:2021 - Other
Description:
The file import functionality lacks resource limits and validation. It loads entire files into memory without size checks and parses JSON without depth limits, making it vulnerable to resource exhaustion from maliciously crafted import files (e.g., deeply nested JSON or files with millions of entries).
Attack Vector:
If CORS is configured with specific origins and credentials remain enabled, an attacker hosts a malicious page that auto-submits forms to /api/detect: <form action='http://target/api/detect' method='POST' enctype='multipart/form-data'><input type='file' name='image'></form>. Currently mitigated by browser CORS policy but represents a latent vulnerability.
Business Impact:
Medium severity vulnerability requiring attention
Remediation:
Priority: LONG-TERM | Effort: medium
{'priority': 'short-term', 'effort': 'low', 'steps': ["Restrict allow_origins to specific frontend domains instead of '*' in all backend services", 'Remove allow_credentials=True if cookie-based authentication is not used', 'Add CSRF middleware if session-based authentication is implemented in the future', 'Document the CORS configuration rationale and risks']}
CWE IDs: CWE-352
[MEDIUM] postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style clos
Description:
@tootallnate/once: @tootallnate/once: Denial of Service due to incorrect control flow scoping with AbortSignal
Attack Vector:
No attack vector described
Business Impact:
Low severity vulnerability requiring attention
Remediation:
Priority: LONG-TERM | Effort: medium
['https://access.redhat.com/security/cve/CVE-2026-3449', 'https://github.com/TooTallNate/once', 'https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a', 'https://github.com/Promise Hang on AbortSignal in @tootallnate/once TooTallNate/once#8', 'https://github.com/TooTallNate/once/releases/tag/v2.0.1', 'https://nvd.nist.gov/vuln/detail/CVE-2026-3449', 'https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612', 'https://www.cve.org/CVERecord?id=CVE-2026-3449']
[LOW] CORS policy allows any origin (using wildcard '*'). This is insecure and should
Security Report
Technical Security Assessment Report
Scan Information
Executive Summary
Overall Risk Level: CRITICAL
The codebase has 24 confirmed vulnerabilities with overall risk CRITICAL. Security score: 0/100.
Key Concerns
Security Metrics
Detailed Findings (24 Total)
[HIGH] OAuth tokens and API keys are stored in plaintext in the local filesystem withou
Description:
OAuth tokens and API keys are stored in plaintext in the local filesystem without encryption. The getToken and setToken functions in plugins/auth-oauth2/src/store.ts write credentials directly to disk without any cryptographic protection. While PBKDF2 is available in the Rust dependencies (src-tauri/Cargo.lock:3809), it is not being utilized to encrypt stored credentials.
Attack Vector:
An attacker sends concurrent POST requests with large image files to /api/enhance or /api/detect endpoints. Each request triggers expensive model inference operations, and without rate limiting, the attacker can exhaust server resources with a simple script:
for i in $(seq 1 100); do curl -X POST -F 'image=@large_image.png' http://target/api/enhance & doneBusiness Impact:
Critical severity vulnerability requiring attention
Remediation:
from slowapi import Limiter; limiter = Limiter(key_func=get_remote_address); app.state.limiter = limiter', "Decorate /api/enhance and /api/detect endpoints with rate limits:@limiter.limit('5/minute')", 'Implement file size validation before processing to prevent large file uploads from bypassing rate limits']}CWE IDs: CWE-770
[LOW] Plugins execute with full Node.js runtime privileges without any sandboxing or p
Description:
Plugins execute with full Node.js runtime privileges without any sandboxing or permission restrictions. All plugins have unrestricted access to filesystem operations (fs module), network requests, and child process execution. No manifest-based permission system exists to limit plugin capabilities.
Attack Vector:
An attacker sends GET requests to public endpoints:
curl http://target:8080/returns internal Kubernetes service topology including namespace structure (caisat.svc.cluster.local). Similarly,curl http://target:8000/healthreveals S3 bucket names and connection error details.Business Impact:
Critical severity vulnerability requiring attention
Remediation:
CWE IDs: CWE-200
[MEDIUM] The gRPCurl command generation uses unsafe string concatenation without proper s
Description:
The gRPCurl command generation uses unsafe string concatenation without proper shell escaping. User-controlled values from API responses (headers, endpoint, data) are directly interpolated into the command string. An attacker can inject shell metacharacters to execute arbitrary commands when the user pastes and runs the generated command.
Attack Vector:
An attacker uploads a decompression bomb (small PNG that decompresses to gigabytes of pixel data):
curl -X POST -F 'image=@decompression_bomb.png' http://target/api/enhance. PIL attempts to decompress the full image, causing out-of-memory conditions. Alternatively, non-image files cause unhandled exceptions that leak error details.Business Impact:
High severity vulnerability requiring attention
Remediation:
if image.size and image.size > MAX_FILE_SIZE: raise HTTPException(413)', 'Set PIL image pixel limit:Image.MAX_IMAGE_PIXELS = 178956970', "Validate content types:if image.content_type not in ['image/png', 'image/jpeg']: raise HTTPException(415)", 'Implement magic byte verification before processing']}CWE IDs: CWE-434, CWE-20
[MEDIUM] The application uses the
nodejs-file-downloaderdependency, but there is no evDescription:
The application uses the
nodejs-file-downloaderdependency, but there is no evidence of cryptographic verification for downloaded files. Without checksum validation or signature verification, downloaded content (such as plugins or updates) could be tampered with via a Man-in-the-Middle (MITM) attack.Attack Vector:
An attacker with access to the source repository obtains the default S3 credentials. If deployment uses these defaults (as suggested by the 'change-in-production' comment), the attacker can access S3 storage:
aws --endpoint-url http://exposed-s4:7480 s3 ls s3://satellite-images/ --access-key caisat-access-key --secret-key caisat-secret-key-change-in-productionBusiness Impact:
High severity vulnerability requiring attention
Remediation:
CWE IDs: CWE-798
[HIGH] nodejs-nth-check: inefficient regular expression complexity
Description:
nodejs-nth-check: inefficient regular expression complexity
Attack Vector:
No attack vector described
Business Impact:
High severity vulnerability requiring attention
Remediation:
[HIGH] Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.to
Description:
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
Attack Vector:
No attack vector described
Business Impact:
High severity vulnerability requiring attention
Remediation:
[HIGH] SVGO removeScripts plugin leaves some executable scripts intact
Description:
SVGO removeScripts plugin leaves some executable scripts intact
Attack Vector:
No attack vector described
Business Impact:
High severity vulnerability requiring attention
Remediation:
[HIGH] Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.to
Description:
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
Attack Vector:
No attack vector described
Business Impact:
High severity vulnerability requiring attention
Remediation:
[HIGH] Underscore.js: Underscore.js: Denial of Service via recursive data structures in
Description:
Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions
Attack Vector:
No attack vector described
Business Impact:
High severity vulnerability requiring attention
Remediation:
[MEDIUM] The file import functionality lacks resource limits and validation. It loads ent
Description:
The file import functionality lacks resource limits and validation. It loads entire files into memory without size checks and parses JSON without depth limits, making it vulnerable to resource exhaustion from maliciously crafted import files (e.g., deeply nested JSON or files with millions of entries).
Attack Vector:
If CORS is configured with specific origins and credentials remain enabled, an attacker hosts a malicious page that auto-submits forms to /api/detect:
<form action='http://target/api/detect' method='POST' enctype='multipart/form-data'><input type='file' name='image'></form>. Currently mitigated by browser CORS policy but represents a latent vulnerability.Business Impact:
Medium severity vulnerability requiring attention
Remediation:
CWE IDs: CWE-352
[MEDIUM] postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style clos
Description:
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags
Attack Vector:
No attack vector described
Business Impact:
Medium severity vulnerability requiring attention
Remediation:
[MEDIUM] uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confide
Description:
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality
Attack Vector:
No attack vector described
Business Impact:
Medium severity vulnerability requiring attention
Remediation:
[MEDIUM] webpack-dev-server: webpack-dev-server: Denial of Service via malformed headers
Description:
webpack-dev-server: webpack-dev-server: Denial of Service via malformed headers
Attack Vector:
No attack vector described
Business Impact:
Medium severity vulnerability requiring attention
Remediation:
[MEDIUM] PostCSS: Improper input validation in PostCSS
Description:
PostCSS: Improper input validation in PostCSS
Attack Vector:
No attack vector described
Business Impact:
Medium severity vulnerability requiring attention
Remediation:
[MEDIUM] serialize-javascript: serialize-javascript: Denial of Service via specially craf
Description:
serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization
Attack Vector:
No attack vector described
Business Impact:
Medium severity vulnerability requiring attention
Remediation:
[MEDIUM] webpack-dev-server: webpack-dev-server information exposure
Description:
webpack-dev-server: webpack-dev-server information exposure
Attack Vector:
No attack vector described
Business Impact:
Medium severity vulnerability requiring attention
Remediation:
[MEDIUM] webpack-dev-server: webpack-dev-server: Arbitrary file opening and denial of ser
Description:
webpack-dev-server: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints
Attack Vector:
No attack vector described
Business Impact:
Medium severity vulnerability requiring attention
Remediation:
[MEDIUM] webpack-dev-server: webpack-dev-server: Information disclosure due to cross-orig
Description:
webpack-dev-server: webpack-dev-server: Information disclosure due to cross-origin source code exposure
Attack Vector:
No attack vector described
Business Impact:
Medium severity vulnerability requiring attention
Remediation:
[MEDIUM] webpack-dev-server: webpack-dev-server information exposure
Description:
webpack-dev-server: webpack-dev-server information exposure
Attack Vector:
No attack vector described
Business Impact:
Medium severity vulnerability requiring attention
Remediation:
[MEDIUM] webpack-dev-server vulnerable to HMR WebSocket interception via permissive user
Description:
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Attack Vector:
No attack vector described
Business Impact:
Medium severity vulnerability requiring attention
Remediation:
[LOW] @tootallnate/once: @tootallnate/once: Denial of Service due to incorrect control
Description:
@tootallnate/once: @tootallnate/once: Denial of Service due to incorrect control flow scoping with AbortSignal
Attack Vector:
No attack vector described
Business Impact:
Low severity vulnerability requiring attention
Remediation:
@tootallnate/onceTooTallNate/once#8', 'https://github.com/TooTallNate/once/releases/tag/v2.0.1', 'https://nvd.nist.gov/vuln/detail/CVE-2026-3449', 'https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612', 'https://www.cve.org/CVERecord?id=CVE-2026-3449'][LOW] CORS policy allows any origin (using wildcard '*'). This is insecure and should
Description:
CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided.
Attack Vector:
No attack vector described
Business Impact:
Low severity vulnerability requiring attention
Remediation:
[LOW] CORS policy allows any origin (using wildcard '*'). This is insecure and should
Description:
CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided.
Attack Vector:
No attack vector described
Business Impact:
Low severity vulnerability requiring attention
Remediation:
[LOW] CORS policy allows any origin (using wildcard '*'). This is insecure and should
Description:
CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided.
Attack Vector:
No attack vector described
Business Impact:
Low severity vulnerability requiring attention
Remediation:
Recommendations
Immediate Actions
Fix 2 critical vulnerabilities
Short-Term Actions
Address 7 high-severity vulnerabilities
Long-Term Improvements
Required Security Controls
OWASP Top 10 Mapping
CWE Top 25 Mapping
Generated by Security Backend | Confidential Security Assessment