1panel-bin 1.10.9_lts-1
1Panel is a modern and open source Linux panel.
config.json file.
/v1/packages/1panel-bin/versions SHAs are authoritative.
Metadata
Relations
Make dependencies
Optional dependencies
Conflicts
Provides
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| e0fc7ef780bfhead | verified | 2026-11-05 16:02 | 17 |
Head findings
command-substitution
in
1panel.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_active_interface=$(ip route get 8.8.8.8 | awk 'NR==1 {print $5}')command-substitution
in
1panel.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_local_ip=`ip -4 addr show dev "$_1panel_active_interface" | grep -oP '(?<=inet\s)\d+(\.\d+){3}'`command-substitution
in
1panel.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_public_ip=`curl -s https://api64.ipify.org`
risky-tool
in
1panel.install'curl' is invoked - this fetches/executes external code outside alpm's control.
_1panel_public_ip=`curl -s https://api64.ipify.org`
command-substitution
in
1panel.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_port=$(sed -n 's/^ORIGINAL_PORT=\(.*\)/\1/p' /usr/bin/1pctl)
command-substitution
in
1panel.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_username=$(sed -n 's/^ORIGINAL_USERNAME=\(.*\)/\1/p' /usr/bin/1pctl)
command-substitution
in
1panel.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_password=$(sed -n 's/^ORIGINAL_PASSWORD=\(.*\)/\1/p' /usr/bin/1pctl)
command-substitution
in
1panel.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_entrance=$(sed -n 's/^ORIGINAL_ENTRANCE=\(.*\)/\1/p' /usr/bin/1pctl)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_original_port=`expr $RANDOM % 55535 + 10000`
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_original_username=$(pwgen -nABCv 10 1)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_original_password=$(pwgen -nBCv 20 1)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_original_entrance=$(pwgen -nABCv 10 1)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_port=`expr $RANDOM % 55535 + 10000`
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
_1panel_port=`expr $RANDOM % 55535 + 10000`
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
ORIGINAL_ENTRANCE=$(pwgen -nABCv 10 1)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
ORIGINAL_USERNAME=$(pwgen -nABCv 10 1)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
ORIGINAL_PASSWORD=$(pwgen -nBCv 20 1)
Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.