Release: Merge release into master from: release/2.53.0

[github-actions]

Release triggered by rossops

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request modifies several sensitive codepaths (models, migrations, importers, templates, and Jira helper) and flags them for review, leaves a GitHub Actions Node.js version without an update strategy, and includes two command injection risks: one in test-helm-chart.yml due to incomplete PR-title sanitization and another in docker/entrypoint-uwsgi.sh from unsafely expanding DD_UWSGI_EXTRA_ARGS. Please review the sensitive file changes and fix the workflow/script sanitization and dependency update strategy.

🔴 Configured Codepaths Edit in dojo/db_migrations/0247_remove_finding_insert_insert_and_more.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templates/dojo/view_finding.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/jira_link/helper.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Outdated Dependency with No Clear Update Strategy in .github/workflows/validate_docs_build.yml

Vulnerability

Outdated Dependency with No Clear Update Strategy

Description

The Node.js version '24.11.1' specified in the GitHub Actions workflow is not configured for automated updates by Renovate. While no immediate vulnerabilities were found for this specific version, the absence of an update strategy means the dependency is at risk of becoming outdated and potentially vulnerable in the future if not manually maintained. The TODO comment in the code confirms the lack of a tested automated update mechanism.

django-DefectDojo/.github/workflows/validate_docs_build.yml

Lines 12 to 24 in d3d64db

	- name: Setup Hugo
	uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0
	with:
	hugo-version: '0.152.2' # renovate: datasource=github-releases depName=gohugoio/hugo
	extended: true
	- name: Setup Node
	uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
	with:
	node-version: '24.11.1' # TODO: Renovate helper might not be needed here - needs to be fully tested
	- name: Cache dependencies
	uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0

Command Injection via Pull Request Title in .github/workflows/test-helm-chart.yml

Vulnerability

Command Injection via Pull Request Title

Description

The GitHub Actions workflow test-helm-chart.yml attempts to sanitize the pull request title before embedding it into a yq command. However, the sanitization denylist is incomplete and does not cover critical shell metacharacters such as $ (for variable expansion or command substitution), ( and ) (for command substitution), backticks (` for command substitution), or semicolons (; for command separation). An attacker can craft a pull request title containing these unescaped characters to execute arbitrary commands on the GitHub Actions runner.

django-DefectDojo/.github/workflows/test-helm-chart.yml

Lines 122 to 125 in d3d64db

	yq -i '.annotations."artifacthub.io/changes" += "- kind: changed\n description: $title\n"' helm/defectdojo/Chart.yaml
	git add helm/defectdojo/Chart.yaml
	git commit -m "ci: update Chart annotations from PR #${{ github.event.pull_request.number }}" || echo "No changes to commit"

Command Injection via Environment Variable in docker/entrypoint-uwsgi.sh

Vulnerability

Command Injection via Environment Variable

Description

The entrypoint-uwsgi.sh script directly expands the $DD_UWSGI_EXTRA_ARGS environment variable into the uwsgi command line without proper quoting or sanitization. This allows an attacker who can control this environment variable to inject arbitrary command-line arguments into the uwsgi process. Such injection can lead to arbitrary code execution, denial of service, or other security issues, depending on the injected options and the privileges of the uwsgi process.

django-DefectDojo/docker/entrypoint-uwsgi.sh

Lines 42 to 46 in d3d64db

	--buffer-size="${DD_UWSGI_BUFFER_SIZE:-8192}" \
	--http 0.0.0.0:8081 --http-to "${DD_UWSGI_ENDPOINT}" \
	--logformat "${DD_UWSGI_LOGFORMAT:-$DD_UWSGI_LOGFORMAT_DEFAULT}" \
	$DD_UWSGI_EXTRA_ARGS
	# HTTP endpoint is enabled for Kubernetes liveness checks. It should not be exposed as a service.

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.