Netgen Tags Bundle is an Ibexa DXP bundle for taxonomy management and easier classification of content, providing more functionality for tagging content than ibexa_keyword field type included in Ibexa core.
62%
Total Score
caution
Usable with caveats: no repository commits in three months and no recent issue or pull-request activity.
There were no commits and no active maintainers in the last three months, indicating a meaningful recent maintenance slowdown; the January release and push provide only partial compensation.
No issues or pull requests were opened, closed, or merged in the last month, which supports the view that current project activity is limited.
Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance-hygiene gap.
The repository has no security policy, so vulnerability reporting expectations are less transparent for consumers.
All six analyzed action references are unpinned, and the audit found a high-confidence, high-severity unpinned container image; workflows otherwise avoid untrusted checkout and script-injection patterns.
| Title | Versions | Severity |
|---|---|---|
CVE-2021-45895 netgen/tagsbundle is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 3.4.0 - 3.4.11 and 4.0.0 - 4.0.15. | 3.4.0 - 3.4.114.0.0 - 4.0.15 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
ibexa/core Version ^5.0 | — | — |
ibexa/rest Version ^5.0 | — | — |
ibexa/solr Version ^5.0 | — | — |
ibexa/admin-ui Version ^5.0 | — | — |
ibexa/http-cache Version ^5.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.