[Security Triage] CodeQL Alert Summary — 2026-03-26

[colin-d-fried]

CodeQL Alert Summary — 2026-03-26

Overview

Repository: colin-d-fried/demo-python
Total Open Alerts: 50
Scan Date: 2026-03-26

---

Fast-Track (Critical + High Severity) — 37 alerts

Critical Severity — 12 alerts

Command Injection (CWE-078/088)

• [CodeQL #1] SQL query built from user-controlled sources #3 — py/command-line-injection — vulnerable_command_injection.py line 12 (critical)
• [CodeQL #2] SQL query built from user-controlled sources #4 — py/command-line-injection — vulnerable_command_injection.py line 20 (critical)
• [CodeQL #3] Uncontrolled command line #5 — py/command-line-injection — vulnerable_command_injection.py line 28 (critical)

SSRF (CWE-918)

• [CodeQL #20] Use of a broken or weak cryptographic algorithm #22 — py/full-ssrf — vulnerable_ssrf.py line 11 (critical)
• [CodeQL #21] Use of a broken or weak cryptographic algorithm #23 — py/full-ssrf — vulnerable_ssrf.py line 19 (critical)
• [CodeQL #22] Full server-side request forgery #24 — py/full-ssrf — vulnerable_ssrf.py line 27 (critical)
• [CodeQL #23] Full server-side request forgery #25 — py/full-ssrf — vulnerable_ssrf.py line 35 (critical)
• [CodeQL #24] Full server-side request forgery #26 — py/full-ssrf — vulnerable_ssrf.py line 47 (critical)

XXE (CWE-611/827)

• [CodeQL #25] Full server-side request forgery #27 — py/xxe — vulnerable_xxe.py line 21 (critical)

Unsafe Deserialization (CWE-502)

• [CodeQL #32] XML internal entity expansion #34 — py/unsafe-deserialization — vulnerable_deserialization.py line 12 (critical)
• [CodeQL #33] XML internal entity expansion #35 — py/unsafe-deserialization — vulnerable_deserialization.py line 20 (critical)
• [CodeQL #34] Deserialization of user-controlled data #36 — py/unsafe-deserialization — vulnerable_deserialization.py line 40 (critical)

Server-Side Template Injection (CWE-074)

• [CodeQL #35] Deserialization of user-controlled data #37 — py/template-injection — vulnerable_xss.py line 31 (critical)

High Severity — 25 alerts

SQL Injection (CWE-089)

• Add security workflows, fix hardcoded secret, and add requirements.txt #1 — py/sql-injection — server/routes.py line 16 (high)
• [Security Triage] CodeQL Alert Summary — 2026-03-25 #2 — py/sql-injection — server/routes.py line 22 (high)
• [CodeQL #12] Flask app is run in debug mode #14 — py/sql-injection — vulnerable_sql_injection.py line 15 (high)
• [CodeQL #13] Flask app is run in debug mode #15 — py/sql-injection — vulnerable_sql_injection.py line 33 (high)

Flask Debug Mode (CWE-215/489)

• [CodeQL #4] Uncontrolled command line #6 — py/flask-debug — vulnerable_command_injection.py line 40 (high)
• [CodeQL #5] Uncontrolled command line #7 — py/flask-debug — vulnerable_deserialization.py line 56 (high)
• [CodeQL #6] Flask app is run in debug mode #8 — py/flask-debug — vulnerable_path_traversal.py line 54 (high)
• [CodeQL #7] Flask app is run in debug mode #9 — py/flask-debug — vulnerable_sql_injection.py line 52 (high)
• [CodeQL #8] Flask app is run in debug mode #10 — py/flask-debug — vulnerable_missing_auth.py line 58 (high)
• [CodeQL #9] Flask app is run in debug mode #11 — py/flask-debug — vulnerable_ssrf.py line 58 (high)
• [CodeQL #10] Flask app is run in debug mode #12 — py/flask-debug — vulnerable_xss.py line 67 (high)
• [CodeQL #11] Flask app is run in debug mode #13 — py/flask-debug — vulnerable_xxe.py line 55 (high)

Weak Cryptographic Hashing (CWE-327/328/916)

• [CodeQL #14] SQL query built from user-controlled sources #16 — py/weak-sensitive-data-hashing — vulnerable_weak_crypto.py line 7 (high)
• [CodeQL #15] SQL query built from user-controlled sources #17 — py/weak-sensitive-data-hashing — vulnerable_weak_crypto.py line 37 (high)
• [CodeQL #16] Use of a broken or weak cryptographic hashing algorithm on sensitive data #18 — py/weak-sensitive-data-hashing — vulnerable_weak_crypto.py line 40 (high)

Weak Cryptographic Algorithm (CWE-327)

• [CodeQL #17] Use of a broken or weak cryptographic hashing algorithm on sensitive data #19 — py/weak-cryptographic-algorithm — vulnerable_weak_crypto.py line 14 (high)
• [CodeQL #18] Use of a broken or weak cryptographic hashing algorithm on sensitive data #20 — py/weak-cryptographic-algorithm — vulnerable_weak_crypto.py line 19 (high)
• [CodeQL #19] Use of a broken or weak cryptographic algorithm #21 — py/weak-cryptographic-algorithm — vulnerable_weak_crypto.py line 46 (high)

Path Traversal (CWE-022/023/036/073/099)

• [CodeQL #26] Full server-side request forgery #28 — py/path-injection — vulnerable_path_traversal.py line 11 (high)
• [CodeQL #27] XML external entity expansion #29 — py/path-injection — vulnerable_path_traversal.py line 17 (high)
• [CodeQL #28] Uncontrolled data used in path expression #30 — py/path-injection — vulnerable_path_traversal.py line 27 (high)
• [CodeQL #29] Uncontrolled data used in path expression #31 — py/path-injection — vulnerable_path_traversal.py line 51 (high)

XML Bomb (CWE-400/776)

• [CodeQL #30] Uncontrolled data used in path expression #32 — py/xml-bomb — vulnerable_xxe.py line 12 (high)
• [CodeQL #31] Uncontrolled data used in path expression #33 — py/xml-bomb — vulnerable_xxe.py line 50 (high)

---

Batched (Medium Severity) — 13 alerts

Reflected XSS (CWE-079/116)

• [CodeQL #36] Deserialization of user-controlled data #38 — py/reflective-xss — vulnerable_deserialization.py line 14 (medium)
• [CodeQL #37] Server Side Template Injection #39 — py/reflective-xss — vulnerable_deserialization.py line 22 (medium)
• [CodeQL #38] Reflected server-side cross-site scripting #40 — py/reflective-xss — vulnerable_deserialization.py line 42 (medium)
• [CodeQL #39] Reflected server-side cross-site scripting #41 — py/reflective-xss — vulnerable_ssrf.py line 13 (medium)
• [CodeQL #40] Reflected server-side cross-site scripting #42 — py/reflective-xss — vulnerable_ssrf.py line 37 (medium)
• [CodeQL #41] Reflected server-side cross-site scripting #43 — py/reflective-xss — vulnerable_ssrf.py line 49 (medium)
• [CodeQL #42] Reflected server-side cross-site scripting #44 — py/reflective-xss — vulnerable_xss.py line 9 (medium)
• [CodeQL #43] Reflected server-side cross-site scripting #45 — py/reflective-xss — vulnerable_xss.py line 24 (medium)
• [CodeQL #44] Reflected server-side cross-site scripting #46 — py/reflective-xss — vulnerable_xss.py line 31 (medium)
• [CodeQL #45] Reflected server-side cross-site scripting #47 — py/reflective-xss — vulnerable_xss.py line 48 (medium)
• [CodeQL #46] Reflected server-side cross-site scripting #48 — py/reflective-xss — vulnerable_xss.py line 54 (medium)
• [CodeQL #47] Reflected server-side cross-site scripting #49 — py/reflective-xss — vulnerable_xss.py line 60 (medium)
• [CodeQL #48] Reflected server-side cross-site scripting #50 — py/reflective-xss — vulnerable_xxe.py line 23 (medium)

---

Classification: All 50 alerts classified as fix
Note: GitHub Projects board updates require read:project token scope — will be documented in triage report.

[colin-d-fried]

Triage Complete

All 50 CodeQL alerts have been reviewed, classified as fix, and have corresponding PRs.

Final triage report: #108

Alert → PR Mapping

Alert	Classification	Priority	PR	Status
#1	fix (high)	fast-track	PR #80	In Review
#2	fix (high)	fast-track	PR #81	In Review
#3	fix (critical)	fast-track	PR #65	In Review
#4	fix (critical)	fast-track	PR #66	In Review
#5	fix (critical)	fast-track	PR #67	In Review
#6	fix (high)	fast-track	PR #72	In Review
#7	fix (high)	fast-track	PR #73	In Review
#8	fix (high)	fast-track	PR #74	In Review
#9	fix (high)	fast-track	PR #75	In Review
#10	fix (high)	fast-track	PR #76	In Review
#11	fix (high)	fast-track	PR #77	In Review
#12	fix (high)	fast-track	PR #78	In Review
#13	fix (high)	fast-track	PR #79	In Review
#14	fix (high)	fast-track	PR #82	In Review
#15	fix (high)	fast-track	PR #89	In Review
#16	fix (high)	fast-track	PR #90	In Review
#17	fix (high)	fast-track	PR #91	In Review
#18	fix (high)	fast-track	PR #92	In Review
#19	fix (high)	fast-track	PR #93	In Review
#20	fix (high)	fast-track	PR #94	In Review
#21	fix (high)	fast-track	PR #95	In Review
#22	fix (critical)	fast-track	PR #83	In Review
#23	fix (critical)	fast-track	PR #83	In Review
#24	fix (critical)	fast-track	PR #83	In Review
#25	fix (critical)	fast-track	PR #83	In Review
#26	fix (critical)	fast-track	PR #83	In Review
#27	fix (critical)	fast-track	PR #85	In Review
#28	fix (high)	fast-track	PR #96	In Review
#29	fix (high)	fast-track	PR #97	In Review
#30	fix (high)	fast-track	PR #98	In Review
#31	fix (high)	fast-track	PR #99	In Review
#32	fix (high)	fast-track	PR #100	In Review
#33	fix (high)	fast-track	PR #101	In Review
#34	fix (critical)	fast-track	PR #86	In Review
#35	fix (critical)	fast-track	PR #87	In Review
#36	fix (critical)	fast-track	PR #88	In Review
#37	fix (critical)	fast-track	PR #63	In Review
#38	fix (medium)	batched	PR #58	In Review
#39	fix (medium)	batched	PR #68	In Review
#40	fix (medium)	batched	PR #69	In Review
#41	fix (medium)	batched	PR #70	In Review
#42	fix (medium)	batched	PR #71	In Review
#43	fix (medium)	batched	PR #102	In Review
#44	fix (medium)	batched	PR #60	In Review
#45	fix (medium)	batched	PR #103	In Review
#46	fix (medium)	batched	PR #104	In Review
#47	fix (medium)	batched	PR #105	In Review
#48	fix (medium)	batched	PR #106	In Review
#49	fix (medium)	batched	PR #107	In Review
#50	fix (medium)	batched	PR #61	In Review

Projects Board Note

Token lacks read:project scope — tracking issues created but not added to Projects board #4. Please add manually and set status to In Review.