gitsafehub
github.com/luty2018/metersphere ↗

luty2018/metersphere

scanned 2026-08-07 · git 723178b
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets8Vulnerable dependencies155Known OSS vulnerabilities—Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 8 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    backend/src/main/java/io/metersphere/commons/user/SessionUser.java:19
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    frontend/src/business/components/api/automation/scenario/component/LoopController.vue:4
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    frontend/src/business/components/api/definition/components/extract/ApiExtract.vue:31
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    frontend/src/business/components/api/definition/components/extract/ApiExtract.vue:41
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    frontend/src/business/components/api/definition/components/extract/ApiExtractEdit.vue:8
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    frontend/src/business/components/api/definition/components/extract/ApiExtractEdit.vue:18
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    frontend/src/business/components/api/definition/components/extract/ApiExtractEdit.vue:28
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    frontend/src/business/components/api/definition/components/extract/ApiExtractCommon.vue:10
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 155 found · 18 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2022-28111 MyBatis PageHelper vulnerable to time-blind SQL injection via orderBy parameter
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2022-28111). Fix: Update that package to its patched version.
  • Serious CVE-2022-4492 undertow: Server identity in https connection is not checked by the undertow client
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2022-4492). Fix: Update that package to its patched version.
  • Serious CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2025-12543). Fix: Update that package to its patched version.
  • Serious CVE-2022-42889 apache-commons-text: variable interpolation RCE
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2022-42889). Fix: Update that package to its patched version.
  • Serious CVE-2023-20873 spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2023-20873). Fix: Update that package to its patched version.
  • Serious CVE-2022-22965 spring-framework: RCE via Data Binding on JDK 9+
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
  • Serious CVE-2016-1000027 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
  • Serious CVE-2022-22965 spring-framework: RCE via Data Binding on JDK 9+
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
  • Serious CVE-2023-20860 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2023-20860). Fix: Update that package to its patched version.
  • Serious CVE-2022-28111 MyBatis PageHelper vulnerable to time-blind SQL injection via orderBy parameter
    pom.xml
    A package you depend on has a known security hole (CVE-2022-28111). Fix: Update that package to its patched version.
  • Serious CVE-2022-4492 undertow: Server identity in https connection is not checked by the undertow client
    pom.xml
    A package you depend on has a known security hole (CVE-2022-4492). Fix: Update that package to its patched version.
  • Serious CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
    pom.xml
    A package you depend on has a known security hole (CVE-2025-12543). Fix: Update that package to its patched version.
  • Serious CVE-2022-42889 apache-commons-text: variable interpolation RCE
    pom.xml
    A package you depend on has a known security hole (CVE-2022-42889). Fix: Update that package to its patched version.
  • Serious CVE-2023-20873 spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry
    pom.xml
    A package you depend on has a known security hole (CVE-2023-20873). Fix: Update that package to its patched version.
  • Serious CVE-2022-22965 spring-framework: RCE via Data Binding on JDK 9+
    pom.xml
    A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
  • Serious CVE-2016-1000027 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
    pom.xml
    A package you depend on has a known security hole (CVE-2016-1000027). Fix: Update that package to its patched version.
  • Serious CVE-2022-22965 spring-framework: RCE via Data Binding on JDK 9+
    pom.xml
    A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
  • Serious CVE-2023-20860 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern
    pom.xml
    A package you depend on has a known security hole (CVE-2023-20860). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-25845 fastjson: autoType shutdown restriction bypass leads to deserialization
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2022-25845). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-2976 guava: insecure temporary directory creation
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2023-2976). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-7962 com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2025-7962). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-40151 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2022-40151). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-41966 xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2022-41966). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47072 com.thoughtworks.xstream: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2024-47072). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-20218 fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise
    backend/pom.xml
    A package you depend on has a known security hole (CVE-2021-20218). Fix: Update that package to its patched version.
… 130 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ timed out

Your dependencies cross-checked against the OSV vulnerability database.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OSV-Scanner v1.9.2 · Apache-2.0

error: timeout after 120s

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.