T03 · Remote Payload Retrieval and Execution
- Location
scripts/report_html.py:51- Finding
Generated reports execute unpinned remote JavaScript
- Content
View full analysis
Vulnerability Details
File Location:
scripts/report_html.py:51
Vulnerability Type: Remote JavaScript retrieval and execution
Risk Level: MediumVulnerable Code
html <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>Technical Analysis
The generated HTML report loads Chart.js directly from jsDelivr without specifying an exact package version or providing a Subresource Integrity hash. Consequently, the JavaScript executed when a report is opened is not fully represented by the audited project files and may change after the skill has been reviewed.
Because the browser treats the downloaded resource as executable script, a compromised CDN, compromised upstream package release, unsafe package update, or sufficiently capable network trust compromise could substitute attacker-controlled JavaScript. HTTPS protects transport under normal conditions but does not protect against compromise of the CDN or upstream package.
The remote script executes in the security context of the generated report and can access its DOM, including the supply-chain metrics and business data displayed in the report. It can also alter the displayed analysis and initiate outbound network requests, subject to applicable browser security controls.
Attack Path
- A user generates an HTML report through
generate_html_report. - The resulting report retains the external script reference to the unversioned
chart.jspackage. - The user opens the report in a browser with network access.
- The browser requests the current Chart.js payload from jsDelivr.
- An attacker who has compromised the CDN, the upstream package distribution path, or another relevant trust boundary serves modified JavaScript.
- The browser executes that JavaScript automatically.
- The malicious script reads or modifies report contents and may transmit report data to an attacker-controlled endpoint.
Impact Assessment
Successf ...[truncated 712 chars]
- A user generates an HTML report through
- Remediation
View remediation
Remediation Suggestions
-
Bundle a reviewed Chart.js release within the project and reference it using a local relative path. This is the preferred remediation because reports then remain reproducible and do not execute code retrieved at viewing time.
-
If a CDN is unavoidable, pin the dependency to an exact reviewed version rather than using the floating
npm/chart.jsURL. -
Add a verified Subresource Integrity hash and
crossorigin="anonymous"to the script element, for example:html <script src="https://cdn.jsdelivr.net/npm/chart.js@EXACT_VERSION/dist/chart.umd.min.js" integrity="sha384-VERIFIED_HASH" crossorigin="anonymous"></script> -
Add a restrictive Content Security Policy that permits scripts only from explicitly approved sources. Avoid
unsafe-inline; move the inline chart initialization into a separately reviewed local script. -
Generate reports that function offline and document all bundled third-party component versions and hashes.
-
Establish a dependency-review process to monitor the pinned Chart.js release for disclosed vulnerabilities before upgrading it.
-