boss-cli

Security check static checks

30 out of 100

Reads what is published about the server: package advisories, licence, secrets in the documented setup and tool permissions. Nothing is installed or run, so this is not a security assessment. Checked 24 Oct 2026 by edna-skill-static-v1 main@9d38ed1a3a5f. What it checks

• Critical AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing (affects anyio 4.12.1, pinned in uv.lock).
• Critical certifi bundles emSign root CAs with compromised intermediate CA keys (affects certifi 2026.2.25, pinned in uv.lock).
• High lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files (affects lxml 6.0.2, pinned in uv.lock).
• High urllib3: HTTPS proxy TLS configuration may be ignored or overridden (affects urllib3 2.6.3, pinned in uv.lock).
• High urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API (affects urllib3 2.6.3, pinned in uv.lock).
• High urllib3: Sensitive headers forwarded across origins in proxied low-level redirects (affects urllib3 2.6.3, pinned in uv.lock).
• High urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory (affects urllib3 2.6.3, pinned in uv.lock).
• Medium AnyIO process-pool workers can block indefinitely on undrained stderr (affects anyio 4.12.1, pinned in uv.lock).
• Medium Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix (affects idna 3.11, pinned in uv.lock).
• Medium pytest has vulnerable tmpdir handling (affects pytest 9.0.2, pinned in uv.lock).
• Medium Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function (affects requests 2.32.5, pinned in uv.lock).
• Medium urllib3: Chunked Deflate streaming can enter an infinite loop (affects urllib3 2.6.3, pinned in uv.lock).
• Medium Reads or points the agent at stored credentials (the macOS keychain): boss_cli/auth.py, line 184.
• Low Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching (affects pygments 2.19.2, pinned in uv.lock).
• Note 2 of 55 packages are not pinned to one version, so only the malicious packages list was checked for them, not version advisories.