Documentation is extensive, and the release includes concrete notes and repository tests. The organization backs the project, but recent commits come from one contributor and most workflow actions are unpinned, so maintenance resilience and build reproducibility are weaker.
84%
Total Score
75
100
100
100
One contributor made 100% of the 38 recent commits. Although the organization-owned project can provide handoff capacity, no second active contributor is shown, leaving a meaningful continuity risk.
There were 38 commits in the last three months, showing strong activity, but all were made by one active maintainer. The volume is healthy while the concentration limits resilience.
All 10 workflows were analyzed, use read-only permissions, and had no reported audit findings or unsafe checkout and script-injection sinks. However, 21 of 22 action references are unpinned, which weakens build reproducibility despite the otherwise good workflow controls.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10102 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. netresearch/rte-ckeditor-image is vulnerable to Cross-site Scripting (XSS) in versions 0.0.1 - 13.3.2. | 0.0.1 - 13.3.2 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
typo3/cms-core Version ^13.4.21 || ^14.3 | — | — |
typo3/cms-backend Version ^13.4.21 || ^14.3 | — | — |
typo3/cms-extbase Version ^13.4.21 || ^14.3 | — | — |
typo3/cms-frontend Version ^13.4.21 || ^14.3 | — | — |
typo3/cms-rte-ckeditor Version ^13.4.21 || ^14.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.