[Security Triage] XSS Triage Report — 2026-03-25
This report summarizes the triage of cross-site scripting (XSS) related CodeQL alerts for colin-d-fried/demo-python.
Summary
| Metric |
Count |
| Total XSS alerts reviewed |
14 |
| fix |
0 |
| demo-only |
14 |
| tutorial-code |
0 |
| false-positive |
0 |
Severity Breakdown
| Severity |
Count |
Priority Tier |
| Critical |
1 |
Fast-track |
| High |
0 |
Fast-track |
| Medium |
13 |
Batched |
| Low |
0 |
Batched |
Fast-track findings: 1 (all demo-only — no PRs needed)
Batched findings: 13 (all demo-only — no PRs needed)
CWE Breakdown
| CWE |
Description |
Alert Count |
| CWE-074 |
Improper Neutralization of Special Elements (Injection) |
1 |
| CWE-079 |
Cross-site Scripting (XSS) |
13 |
| CWE-116 |
Improper Encoding or Escaping of Output |
13 |
Alert Details
Fast-track (Critical/High)
| Alert |
Severity |
Rule |
File |
Lines |
CWE |
Classification |
Issue |
| #37 |
CRITICAL |
py/template-injection |
vulnerable_xss.py |
31 |
CWE-074 |
demo-only |
#39 |
Batched (Medium/Low)
| Alert |
Severity |
Rule |
File |
Lines |
CWE |
Classification |
Issue |
| #38 |
MEDIUM |
py/reflective-xss |
vulnerable_deserialization.py |
14 |
CWE-079, CWE-116 |
demo-only |
#40 |
| #39 |
MEDIUM |
py/reflective-xss |
vulnerable_deserialization.py |
22 |
CWE-079, CWE-116 |
demo-only |
#41 |
| #40 |
MEDIUM |
py/reflective-xss |
vulnerable_deserialization.py |
42 |
CWE-079, CWE-116 |
demo-only |
#42 |
| #41 |
MEDIUM |
py/reflective-xss |
vulnerable_ssrf.py |
13 |
CWE-079, CWE-116 |
demo-only |
#43 |
| #42 |
MEDIUM |
py/reflective-xss |
vulnerable_ssrf.py |
37 |
CWE-079, CWE-116 |
demo-only |
#44 |
| #43 |
MEDIUM |
py/reflective-xss |
vulnerable_ssrf.py |
49 |
CWE-079, CWE-116 |
demo-only |
#45 |
| #44 |
MEDIUM |
py/reflective-xss |
vulnerable_xss.py |
9 |
CWE-079, CWE-116 |
demo-only |
#46 |
| #45 |
MEDIUM |
py/reflective-xss |
vulnerable_xss.py |
24 |
CWE-079, CWE-116 |
demo-only |
#47 |
| #46 |
MEDIUM |
py/reflective-xss |
vulnerable_xss.py |
31 |
CWE-079, CWE-116 |
demo-only |
#48 |
| #47 |
MEDIUM |
py/reflective-xss |
vulnerable_xss.py |
48 |
CWE-079, CWE-116 |
demo-only |
#49 |
| #48 |
MEDIUM |
py/reflective-xss |
vulnerable_xss.py |
54 |
CWE-079, CWE-116 |
demo-only |
#50 |
| #49 |
MEDIUM |
py/reflective-xss |
vulnerable_xss.py |
60 |
CWE-079, CWE-116 |
demo-only |
#51 |
| #50 |
MEDIUM |
py/reflective-xss |
vulnerable_xxe.py |
23 |
CWE-079, CWE-116 |
demo-only |
#52 |
PRs Created
None — all XSS alerts are in intentionally vulnerable demo files (vulnerable_*) and classified as demo-only.
Projects Board
All 14 tracking issues have been added to the Security Issue Tracker with status Done.
Generated by automated security triage on 2026-03-25.
[Security Triage] XSS Triage Report — 2026-03-25
This report summarizes the triage of cross-site scripting (XSS) related CodeQL alerts for
colin-d-fried/demo-python.Summary
Severity Breakdown
Fast-track findings: 1 (all demo-only — no PRs needed)
Batched findings: 13 (all demo-only — no PRs needed)
CWE Breakdown
Alert Details
Fast-track (Critical/High)
py/template-injectionvulnerable_xss.pyBatched (Medium/Low)
py/reflective-xssvulnerable_deserialization.pypy/reflective-xssvulnerable_deserialization.pypy/reflective-xssvulnerable_deserialization.pypy/reflective-xssvulnerable_ssrf.pypy/reflective-xssvulnerable_ssrf.pypy/reflective-xssvulnerable_ssrf.pypy/reflective-xssvulnerable_xss.pypy/reflective-xssvulnerable_xss.pypy/reflective-xssvulnerable_xss.pypy/reflective-xssvulnerable_xss.pypy/reflective-xssvulnerable_xss.pypy/reflective-xssvulnerable_xss.pypy/reflective-xssvulnerable_xxe.pyPRs Created
None — all XSS alerts are in intentionally vulnerable demo files (
vulnerable_*) and classified asdemo-only.Projects Board
All 14 tracking issues have been added to the Security Issue Tracker with status Done.
Generated by automated security triage on 2026-03-25.