I know usage is mainly local, but for prevent lateral attacks or container escape, could you add at least an USER instruction in Docker files please ?
For example:
USER root
RUN apt-get update && apt-get install -y your-package
# ...
RUN groupadd -g 1234 customgroup && useradd -m -u 1234 -g customgroup customuser
USER customuser
WORKDIR /home/customuser
# ...
Hopefully this will help you.
Greetings, JL.
FYI security scans with semgrep (image capture and csv attached for code and supply chain findings)
Originally created by @JL-Tests on GitHub (Dec 11, 2025).
Original GitHub issue: https://github.com/reconurge/flowsint/issues/96
Hi,
I know usage is mainly local, but for prevent lateral attacks or container escape, could you add at least an USER instruction in Docker files please ?
For example:
```
USER root
RUN apt-get update && apt-get install -y your-package
# ...
RUN groupadd -g 1234 customgroup && useradd -m -u 1234 -g customgroup customuser
USER customuser
WORKDIR /home/customuser
# ...
```
Hopefully this will help you.
Greetings, JL.
----
FYI security scans with [semgrep](https://github.com/semgrep/semgrep) (image capture and csv attached for code and supply chain findings)
<img width="910" height="84" alt="Image" src="https://github.com/user-attachments/assets/06c92bd5-ba7b-40ce-9c69-5740270ef180" />
**Code findings**
<img width="956" height="775" alt="Image" src="https://github.com/user-attachments/assets/56a87d46-4f94-4a32-9708-7bd6d8584f3f" />
**Supply chain findings (generally CVE)**
<img width="903" height="806" alt="Image" src="https://github.com/user-attachments/assets/85145b76-a62e-484f-956e-f5d885b76595" />
**Full CSV exports**
[Flowsint_Code_Findings_2025_12_11.csv](https://github.com/user-attachments/files/24108423/Flowsint_Code_Findings_2025_12_11.csv)
[Flowsint_Supply_Chain_Findings_2025_12_11.csv](https://github.com/user-attachments/files/24108427/Flowsint_Supply_Chain_Findings_2025_12_11.csv)
Hey @JL-Tests, thanks for this content, and thank you for identifying those vulnerabilities.
Regarding the use of the root user in the Celery container: you're right, this isn’t ideal.
For now, the container needs elevated permissions to access the Docker socket in order to create new containers on the fly.
We plan to improve this by switching to a dedicated non-root user with the appropriate group permissions mapped to the Docker socket.
About the vulnerability report: I can spot some issues that should be fixed in recent commits; for example, the query injection in /api/routes/sketches.py. This part now relies on our dedicated GraphRepository. I'll take a look at the other warnings.
@sealldeveloper also did an amazing job finding those vulns and provided great reports and PoC.
Thanks again !
<!-- gh-comment-id:3645759049 -->
@dextmorgn commented on GitHub (Dec 12, 2025):
Hey @JL-Tests, thanks for this content, and thank you for identifying those vulnerabilities.
Regarding the use of the root user in the Celery container: you're right, this isn’t ideal.
For now, the container needs elevated permissions to access the Docker socket in order to create new containers on the fly.
We plan to improve this by switching to a dedicated non-root user with the appropriate group permissions mapped to the Docker socket.
About the vulnerability report: I can spot some issues that should be fixed in recent commits; for example, the query injection in `/api/routes/sketches.py`. This part now relies on our dedicated `GraphRepository`. I'll take a look at the other warnings.
@sealldeveloper also did an amazing job finding those vulns and provided great reports and PoC.
Thanks again !
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @JL-Tests on GitHub (Dec 11, 2025).
Original GitHub issue: https://github.com/reconurge/flowsint/issues/96
Hi,
I know usage is mainly local, but for prevent lateral attacks or container escape, could you add at least an USER instruction in Docker files please ?
For example:
Hopefully this will help you.
Greetings, JL.
FYI security scans with semgrep (image capture and csv attached for code and supply chain findings)
Code findings
Supply chain findings (generally CVE)
Full CSV exports
Flowsint_Code_Findings_2025_12_11.csv
Flowsint_Supply_Chain_Findings_2025_12_11.csv
@dextmorgn commented on GitHub (Dec 12, 2025):
Hey @JL-Tests, thanks for this content, and thank you for identifying those vulnerabilities.
Regarding the use of the root user in the Celery container: you're right, this isn’t ideal.
For now, the container needs elevated permissions to access the Docker socket in order to create new containers on the fly.
We plan to improve this by switching to a dedicated non-root user with the appropriate group permissions mapped to the Docker socket.
About the vulnerability report: I can spot some issues that should be fixed in recent commits; for example, the query injection in
/api/routes/sketches.py. This part now relies on our dedicatedGraphRepository. I'll take a look at the other warnings.@sealldeveloper also did an amazing job finding those vulns and provided great reports and PoC.
Thanks again !