All issues

Search results

[security] Low-severity findings (8 items from audit)

security

Status: Open.

#63 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026

[security] M-18: eval() of table expressions with user_dict access

security

Status: Open.

#62 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026

[security] M-16: SQL injection in demo read_snapshot.py

security

Status: Open.

#61 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026

[security] M-14: Unvalidated sys.argv[1] as file path in process_email.py

security

Status: Open.

#60 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026

[security] M-13: User-controlled filename in file serving API

security

Status: Open.

#59 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026

[security] M-12: TTS endpoint without authentication

security

Status: Open.

#58 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026

[security] M-11: Broad privileged file access for advocate/trainer roles

security

Status: Open.

#57 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026

[security] M-10: Phone verification code exposed in URL

security

Status: Open.

#56 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026

[security] M-9: /headers endpoint info disclosure without auth

security

Status: Open.

#55 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026

[security] M-8: SESSION_COOKIE_SECURE defaults to False

security

Status: Open.

#54 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026

[security] M-7: DEBUG=True hardcoded

security

Status: Open.

#53 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026

[security] M-5 and M-6: Wildcard CORS on admin endpoint and default origins

security

Status: Open.

#52 In jacobyoby/docassemble;

· jacobyoby opened on Sep 9, 2026