Cross-site Scripting (XSS)

scancodeio is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of sanitization in the key parameter of licenses.py, which allows an attacker to inject and execute malicious JavaScript through the /license/ endpoint...

Command Injection

scancodeio is vulnerable to Command Injection. The vulnerability exists due to the lack of validation in the dockerreference parameter of the fetchdockerimage function of fetch.py, which allows an attacker to append malicious commands through the docker fetch process...