formio-form

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The documentation exposes multiple features that allow execution of arbitrary JavaScript inside form defs and sending authenticated/forwarded requests (including captured portal JWTs) to external URLs, which can be combined to exfiltrate sensitive tokens or perform remote-control actions from attacker-controlled form definitions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches and executes remote JavaScript at runtime via the CDN script https://cdn.form.io/js/formio.full.min.js and also loads form JSON from https://examples.form.io/example (a runtime form URL whose JSON can contain executable JS triggers/actions), so external content can execute code in the renderer.