Issues

• php.lang.security.exec-use: regex not end-anchored, flags any function starting with "exec"

  bug
  semgrep/semgrep-rules#4118 · Filter by author comptonjack opened on Oct 23, 2026

• Semgrep reports warning when using self repository syntax for github actions

  semgrep/semgrep-rules#4117 · Filter by author mynameistechno opened on Oct 22, 2026

• mcp-ssrf-python misses httpx and other request sinks (SSRF false negative)

  semgrep/semgrep-rules#4108 · Filter by author Varshith-Kali opened on Oct 20, 2026
  1

• mcp-unsanitized-return-python treats str.strip() as a sanitizer

  semgrep/semgrep-rules#4101 · Filter by author Varshith-Kali opened on Oct 19, 2026
  1

• hooks-path-traversal-python treats os.path.realpath()/abspath() as complete path sanitizers

  semgrep/semgrep-rules#4098 · Filter by author Varshith-Kali opened on Oct 17, 2026
  1

• mcp-ssrf-python treats urllib.parse.urlparse() as an SSRF sanitizer

  semgrep/semgrep-rules#4093 · Filter by author Varshith-Kali opened on Oct 16, 2026
  1

• hooks-path-traversal-bash treats bare realpath/readlink -f as complete path sanitizers

  semgrep/semgrep-rules#4090 · Filter by author Varshith-Kali opened on Oct 16, 2026
  1

• dangerous-subprocess-use: list-form shell and interpreter commands are missed unless they are exactly [sh, "-c", cmd]

  bug
  semgrep/semgrep-rules#4084 · Filter by author wildoranges opened on Oct 15, 2026
  1

• sqlalchemy-execute-raw-query and formatted-sql-query flag SQL built only from constants

  semgrep/semgrep-rules#4078 · Filter by author HardMax71 opened on Oct 6, 2026

• useless-inner-function: false positive when the inner function is only referenced in the context expression of an as-bound with statement

  semgrep/semgrep-rules#4059 · Filter by author roosteer opened on Sep 13, 2026

• hooks-sensitive-file-access-python treats realpath() as a sanitizer

  semgrep/semgrep-rules#4046 · Filter by author wildoranges opened on Aug 21, 2026

• hooks-path-traversal-python treats realpath() and abspath() as complete sanitizers

  semgrep/semgrep-rules#4045 · Filter by author wildoranges opened on Aug 21, 2026

• Path traversal rules treat any replace() call as a sanitizer

  semgrep/semgrep-rules#4044 · Filter by author wildoranges opened on Aug 21, 2026
  1

• Remove insecure-innerhtml.yaml due to duplication with insecure-document-method.yaml

  semgrep/semgrep-rules#4038 · Filter by author lxndrsmrnv0-bit opened on Aug 13, 2026

• p/docker-compose rules fail when obsolete version attribute is omitted

  semgrep/semgrep-rules#4035 · Filter by author webpwnized opened on Jul 30, 2026
  1

• p/docker-compose does not detect service explicitly configured with user: root

  semgrep/semgrep-rules#4036 · Filter by author webpwnized opened on Jul 30, 2026
  2

• Windows Defender flags an intentional reverse-shell test fixture when consuming semgrep-rules on Windows

  semgrep/semgrep-rules#4030 · Filter by author rapointofit opened on Jul 28, 2026

• False positive for java.lang.correctness.eqeq.eqeq

  bug
  semgrep/semgrep-rules#4019 · Filter by author Sjord opened on Jul 27, 2026

• Incorrect suggestion for renovate-missing-minimum-release-age rule

  bug
  semgrep/semgrep-rules#4018 · Filter by author eliashaeussler opened on Jul 27, 2026

• GitHub Actions curl rules parse explicit PowerShell steps as Bash

  semgrep/semgrep-rules#4001 · Filter by author meza opened on Jul 12, 2026
  1

• renovate-missing-minimum-release-age flags packageRules that inherit minimumReleaseAge

  bug
  semgrep/semgrep-rules#3995 · Filter by author janderssonse opened on Jul 9, 2026

• uv-missing-dependency-cooldown fails on config that should pass

  bug
  semgrep/semgrep-rules#3993 · Filter by author jceresini opened on Jul 8, 2026

• [Rule] Unsafe ML model deserialization (torch.load/joblib/dill/numpy allow_pickle) — CWE-502

  semgrep/semgrep-rules#3990 · Filter by author DipesThapa opened on Jul 6, 2026
  1

• no-replaceall is outdated

  bug
  semgrep/semgrep-rules#3984 · Filter by author Sjord opened on Jun 29, 2026

• FP and FNs for documentbuilderfactory-disallow-doctype-decl-missing:

  bug
  semgrep/semgrep-rules#3831 · Filter by author sarr424 opened on Apr 28, 2026