jira-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider-authored free text from Jira webhook HTTP request bodies (and headers) is read at runtime via req.body/request.text() and then parsed/used in handler logic, so any attacker-controlled JSON fields could be included in the LLM context if the agent later forwards them.