vetkit.shell.credentials.password-argument
A password is passed to mysql/mysqldump/mysqladmin/mariadb or sshpass as a command-line argument. Command lines are visible to other local users (ps, /proc) and end up in logs.
Last updated:
Suite: Security
regex
A password is passed to mysql/mysqldump/mysqladmin/mariadb or sshpass as a command-line argument. Command lines are visible to other local users (ps, /proc) and end up in logs.
Category: SECURITY · Engine rule severity: INFO
How to fix it
Use an option file with 0600 permissions (--defaults-extra-file), the MYSQL_PWD-free login path (mysql_config_editor), or sshpass -f/-e and key-based SSH authentication.
References
Source: packages/engine/rules/sast/shell.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.