SecOps #1351: [Sécurité] Vulnérabilité de code : qwarksconnectweb/src/app/components/form/FormAddBeneficiaryNew/hooks/useProfileManagement.tsx:890 (javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring) - Qwarks Connect - Redmine

Actions

SecOps #1351

open

[Sécurité] Vulnérabilité de code : qwarksconnectweb/src/app/components/form/FormAddBeneficiaryNew/hooks/useProfileManagement.tsx:890 (javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring)

SecOps #1351: [Sécurité] Vulnérabilité de code : qwarksconnectweb/src/app/components/form/FormAddBeneficiaryNew/hooks/useProfileManagement.tsx:890 (javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring)

Added by Client Dashboard 27 days ago. Updated 11 days ago.

Status:

Submitted

Priority:

Normal

Assignee:

Start date:

07/08/2026

Due date:

% Done:

Estimated time:

spec_ref:

build_status:

build_number:

ci_run_url:

scan_status:

scan_report_url:

deploy_status:

preprod_url:

deployed_at:

branch:

pr_url:

security_key:

qwarksconnectweb/src/app/components/form/FormAddBeneficiaryNew/hooks/useProfileManagement.tsx:890_javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

severity:

low

paused:

Description

**Sévérité** : LOW
**Source** : Semgrep
`vuln-low`
**Emplacement** : qwarksconnectweb/src/app/components/form/FormAddBeneficiaryNew/hooks/useProfileManagement.tsx:890
**Règle** : javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.

### Extrait de code
```
requires login
```

### Lien CVE
https://cwe.mitre.org/data/definitions/134.html

CD Updated by Client Dashboard 27 days ago Actions
Copy link
#1

Vulnérabilité `qwarksconnectweb/src/app/components/form/FormAddBeneficiaryNew/hooks/useProfileManagement.tsx:890_javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).