Issues · semgrep/semgrep-rules · GitHub

Labels Milestones New issue

Proposal: Improve Semgrep Go SQL Injection Detection for query.Get(...) to GORM Raw(...) Flows

#3826

· FORIMOC opened

on Apr 27, 2026

Proposal: Improve Semgrep Go Path Traversal Detection for Archive- and Request-Bound Paths

#3825

· FORIMOC opened

on Apr 27, 2026

Proposal: Improve Semgrep JavaScript Command Injection Detection for Parameter-Derived exec(...) Commands

#3824

· FORIMOC opened

on Apr 27, 2026

Proposal: Improve Semgrep Python Path Traversal Detection for Upload-, Request-, and Parameter-Derived Paths

#3823

· FORIMOC opened

on Apr 27, 2026

Proposal: Improve Semgrep Java Open Redirect Detection for Helper-Returned Redirect Targets

#3822

· FORIMOC opened

on Apr 27, 2026

Proposal: Improve Semgrep Java Path Traversal Detection for Archive- and Parameter-Derived Paths

#3821

· FORIMOC opened

on Apr 27, 2026

False negatives: common pattern missed in tainted-url-host

#3819

· 9iang22 opened

on Apr 25, 2026

java/overly-permissive-file-permission False Negatives

#3818

· 9iang22 opened

on Apr 25, 2026

java/hibernate-sqli false negatives

#3817

· 9iang22 opened

on Apr 25, 2026

django-no-csrf-token: false positive when form body contains nested {% if %} with a multi-line element

#3816

· mulka opened

on Apr 23, 2026

[Java ] `command-injection-process-builder` missing common injection patterns such as chained call

#3814

· 9iang22 opened

on Apr 19, 2026

[Java] false negative: jdo-sqli misses `"...".formatted(input)` pattern.

#3812

· 9iang22 opened

on Apr 17, 2026