CodeAnt AI home pagelight logodark logo
  • Support
  • Dashboard
  • Dashboard
Documentation
API Reference
Start Here
  • What is CodeAnt?
  • Join Community
Setup
  • Github
  • GitHub Enterprise
  • Bitbucket
  • Gitlab
  • Azure Devops
Pull Request Review
  • Features
  • Customize Review
  • Quality Gates
  • Integrations
Scan center
  • Code Security
  • Code Quality
  • Cloud Security
  • Engineering Productivity
Integrations
  • Jira
  • Test Coverage
  • CI/CD
IDE
  • Setup
  • Review
  • Enhancements
Rule Reference
  • Compliance
  • Anti-Patterns
  • Code Governance
  • Infrastructure Security Database
  • Application Security Database
    • Apex
    • Bash
    • C
    • Clojure
    • Cpp
    • Csharp
    • Dockerfile
    • Elixir
    • Fingerprints
    • Generic
    • Go
    • Html
    • Java
    • Javascript
    • Json
    • Kotlin
    • Ocaml
    • Php
    • Problem-based-packs
    • Python
      • Airflow
      • Attr
      • Aws-lambda
      • Bokeh
      • Boto3
      • Cassandra
      • Click
      • Correctness
      • Couchbase
      • Cryptography
      • Distributed
      • Django
        • Ai
        • Best practice
        • Compatibility
        • Correctness
        • Deserialization
        • Maintainability
        • Performance
        • Security
        • Security
          • Audit
          • Audit
          • Injection
          • Injection
            • Code
            • Command
            • Email
            • Path traversal
            • Sql
            • Ssrf
          • Passwords
      • Docker
      • Elasticsearch
      • Fastapi
      • Flask
      • Jinja2
      • Jwt
      • Lang
      • Ldap3
      • Mariadb
      • Mysql
      • Mysqlclient
      • Neo4j
      • Openai
      • Peewee
      • Pg8000
      • Psycopg2
      • Pycryptodome
      • Pyjwt
      • Pymongo
      • Pymssql
      • Pymysql
      • Pyramid
      • Redis
      • Requests
      • Sh
      • Sqlalchemy
      • Tormysql
      • Urllib3
      • Webrepl
      • Wtforms
    • Ruby
    • Rust
    • Scala
    • Solidity
    • Swift
    • Terraform
    • Typescript
    • Yaml
Resources
  • Open Source
  • Blogs
Injection

Email

xss-send-mail-html-message

Found request data in ‘send_mail(…)’ that uses ‘html_message’. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.
Likelihood: MEDIUM
Confidence: MEDIUM
CWE:
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)
OWASP:
- A03:2021 - Injection

xss-html-email-body

Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.
Likelihood: MEDIUM
Confidence: MEDIUM
CWE:
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)
OWASP:
- A03:2021 - Injection
CommandPath traversal
twitterlinkedin
Powered by Mintlify
Assistant
Responses are generated using AI and may contain mistakes.