Skip to content

fix: security vulnerabilities (Trust scan 1eca2c38)#7078

Closed
Jaden-JJH wants to merge 4 commits intoexpressjs:masterfrom
Jaden-JJH:trust-security/fix-1eca2c38
Closed

fix: security vulnerabilities (Trust scan 1eca2c38)#7078
Jaden-JJH wants to merge 4 commits intoexpressjs:masterfrom
Jaden-JJH:trust-security/fix-1eca2c38

Conversation

@Jaden-JJH
Copy link

Security Fixes by Trust Security

Scan ID: 1eca2c38-8fe0-408c-bb63-6e3d296e91b4
Score: 83/100 (Grade B+)

Fixed Vulnerabilities (10)

  • [LOW] Unsafe Formatstring (CWE-134) (examples/search/index.js)
  • [MEDIUM] Express Cookie Session No Httponly (CWE-522) (examples/auth/index.js)
  • [MEDIUM] Express Cookie Session No Secure (CWE-522) (examples/auth/index.js)
  • [MEDIUM] Template Explicit Unescape (CWE-79) (examples/auth/views/login.ejs)
  • [MEDIUM] Express Cookie Session Default Name (CWE-522) (examples/auth/index.js)
  • [MEDIUM] Express Cookie Session No Domain (CWE-522) (examples/auth/index.js)
  • [MEDIUM] Express Session Hardcoded Secret (CWE-798) (examples/auth/index.js)
  • [MEDIUM] Direct Response Write (CWE-79) (examples/params/index.js)
  • [MEDIUM] Express Cookie Session No Expires (CWE-522) (examples/auth/index.js)
  • [MEDIUM] Express Cookie Session No Path (CWE-522) (examples/auth/index.js)

Generated by Trust Security

…sion No Secure (CWE-522), Express Cookie Session Default Name (CWE-522), Express Cookie Session No Domain (CWE-522), Express Session Hardcoded Secret (CWE-798), Express Cookie Session No Expires (CWE-522), Express Cookie Session No Path (CWE-522)
Copy link
Member

@bjohansebas bjohansebas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Look, I don’t want to review these kinds of PRs anymore. We’ve already said that we don’t want those types of PRs. If you’re going to contribute something, understand what you’re doing. Every day, in every repo I maintain, there’s at least one PR made entirely with AI.

Do you want to contribute to open source? Do it by actually understanding things. Your changes aren’t even done correctly, you don’t even review what you’re submitting.

@bjohansebas bjohansebas closed this Mar 3, 2026
@expressjs expressjs locked as spam and limited conversation to collaborators Mar 3, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants