accessibility
Warn
Audited by Socket on Aug 5, 2026
1 alert found:
AnomalyAnomalyscripts/runtime_a11y/runner/index.mjs
LOWAnomalyLOW
scripts/runtime_a11y/runner/index.mjs
This file is a dynamic local probe/module loader. It is not overtly malicious on its own, but it can execute arbitrary code from a dynamically imported .mjs module determined by an untrusted CLI argument. Because probeId is not allowlisted or constrained to remain within the intended directory, the primary risk is unintended module loading/execution (including potential path traversal) if an attacker can influence probeId and/or available modules/files.
Confidence: 66%Severity: 60%
Audit Metadata