2026 01 09 bug fixes

[cx-ryan-wakeham]

No description provided.

[cx-ryan-wakeham]

Checkmarx One – Scan Summary & Details – bfb24ee0-0d8f-4b14-8227-318a25d33c39

New Issues (161)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2021-25289	Python-pillow-5.2.0	details Recommended version: 10.3.0 Description: An issue was discovered in Pillow versions prior to 8.1.1. 'TiffDecode' has a Heap-based Buffer Overflow when decoding crafted YCbCr files because ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
2		RDS DB Instance Publicly Accessible	/main.tf: 74	details RDS must not be defined with public interface, which means the field 'publicly_accessible' should not be set to 'true' (default is 'false').
3		S3 Bucket Access to Any Principal	/s3.tf: 22	details S3 Buckets must not allow Actions From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data ...
4		S3 Bucket Allows Delete Action From All Principals	/s3.tf: 22	details S3 Buckets must not allow Delete Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized...
5		S3 Bucket Allows Put Action From All Principals	/s3.tf: 22	details S3 Buckets must not allow Put Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized da...
6		CVE-2025-15284	Npm-qs-6.5.3	details Recommended version: 6.14.1 Description: Improper Input Validation vulnerability in qs (parse modules) versions prior to 6.14.1 allows HTTP Denial-of-Service (DoS). The "arrayLimit" option... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
7		CVE-2025-66418	Python-urllib3-1.24.3	details Recommended version: 2.6.3 Description: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression ch... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
8		CVE-2025-66471	Python-urllib3-1.24.3	details Recommended version: 2.6.3 Description: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
9		CVE-2026-21441	Python-urllib3-1.24.3	details Recommended version: 2.6.3 Description: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
10		CVE-2026-21884	Npm-react-router-5.2.1	details Recommended version: 7.12.0 Description: A XSS vulnerability exists in in React Router's "" API in Framework Mode when using the "getKey/storageKey" props during Server-... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
11		DB Instance Storage Not Encrypted	/main.tf: 76	details AWS DB Instance should have its storage encrypted by setting the parameter to 'true'. The storage_encrypted default value is 'false'.
12		Hardcoded AWS Access Key	/main.tf: 25	details AWS Access Key should not be hardcoded
13		IAM Policy Grants Full Permissions	/iam.tf: 22	details IAM policy should not grant full permissions to resources from the get-go, instead of granting permissions gradually as necessary.
14		IAM Policy Grants Full Permissions	/iam.tf: 55	details IAM policy should not grant full permissions to resources from the get-go, instead of granting permissions gradually as necessary.
15		Missing User Instruction	/Dockerfile: 1	details Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
16		Missing User Instruction	/Dockerfile: 1	details Always set a user in the runtime stage of your Dockerfile. Without it, the container defaults to root, even if earlier build stages define a user.
17		Passwords And Secrets - AWS Access Key	/variables.tf: 8	details Query to find passwords and secrets in infrastructure code.
18		Passwords And Secrets - AWS Access Key	/Dockerfile: 6	details Query to find passwords and secrets in infrastructure code.
19		Passwords And Secrets - AWS Access Key	/ci.yml: 12	details Query to find passwords and secrets in infrastructure code.
20		Passwords And Secrets - AWS Access Key	/docker-compose.yml: 23	details Query to find passwords and secrets in infrastructure code.
21		Passwords And Secrets - AWS Secret Key	/docker-compose.yml: 24	details Query to find passwords and secrets in infrastructure code.
22		Passwords And Secrets - AWS Secret Key	/Dockerfile: 7	details Query to find passwords and secrets in infrastructure code.
23		Passwords And Secrets - AWS Secret Key	/ci.yml: 13	details Query to find passwords and secrets in infrastructure code.
24		Passwords And Secrets - Generic Password	/ci.yml: 17	details Query to find passwords and secrets in infrastructure code.
25		Passwords And Secrets - Generic Password	/docker-compose.yml: 6	details Query to find passwords and secrets in infrastructure code.
26		Passwords And Secrets - Generic Secret	/Dockerfile: 5	details Query to find passwords and secrets in infrastructure code.
27		Passwords And Secrets - Generic Secret	/docker-compose.yml: 22	details Query to find passwords and secrets in infrastructure code.
28		Passwords And Secrets - Generic Secret	/ci.yml: 15	details Query to find passwords and secrets in infrastructure code.
29		Passwords And Secrets - Password in URL	/docker-compose.yml: 20	details Query to find passwords and secrets in infrastructure code.
30		Passwords And Secrets - Password in URL	/Dockerfile: 4	details Query to find passwords and secrets in infrastructure code.
31		Passwords And Secrets - Password in URL	/ci.yml: 14	details Query to find passwords and secrets in infrastructure code.
32		Remote Desktop Port Open To Internet	/main.tf: 43	details The Remote Desktop port is open to the internet in a Security Group
33		S3 Bucket Allows Get Action From All Principals	/s3.tf: 29	details S3 Buckets must not allow Get Action From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized da...
34		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
35		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
36		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
37		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
38		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
39		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
40		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
41		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
42		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
43		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
44		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
45		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
46		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
47		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
48		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
49		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
50		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
51		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
52		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
53		Sensitive Port Is Exposed To Entire Network	/main.tf: 43	details A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol

More results are available on the CxOne platform

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2025-13466	Npm-body-parser-1.20.4

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR