Issues · github/codeql · GitHub

Labels Milestones New issue

Python: model PyMongo read results as sources for `py/sql-injection` in second-order SQL construction flows

#21775

· invoke1442 opened

on Apr 29, 2026

Java: `java/xxe` doesn't cover public XML helper methods that parse caller-provided input

#21774

· invoke1442 opened

on Apr 29, 2026

Javascript: js/path-injection misses Sails Action2 request-derived inputs

#21773

· invoke1442 opened

on Apr 29, 2026

False negative in java/unvalidated-url-redirection for Spring MVC redirect view names

#21771

· invoke1442 opened

on Apr 29, 2026

False negative in go/email-injection for password reset links built from Forwarded / X-Forwarded-Host

#21770

· invoke1442 opened

on Apr 29, 2026

False negative: py/sql-injection missing a sqlite3/PEP249 pattern

#21769

· invoke1442 opened

on Apr 29, 2026

False negative: py/ldap-injection misses taint flow for ldap3 `extend.standard.paged_search`

#21738

· 9iang22 opened

on Apr 20, 2026

False negative: missing os.exec* APIs with `sh -c` as sink in py/code-injection.

#21735

· 9iang22 opened

on Apr 19, 2026

GHAS-managed workflows reference mutable action versions, incompatible with required SHA-pinning policies

#21732

· kyleburnsdev opened

on Apr 17, 2026

[feat] comments that enable/disable LSP formatting

#21730

· k4lizen opened

on Apr 17, 2026

False negative: unzip using subprocess or `shutil.unpack_archive` is not covered in py/tarslip

#21712

· 9iang22 opened

on Apr 15, 2026

[question?] counterintuitive class method behaviour

#21670

· k4lizen opened

on Apr 8, 2026