kimai-time-tracking
Warn
Audited by Snyk on Feb 13, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The CLI (scripts/kimai_cli.py) reads data from an arbitrary Kimai instance specified by KIMAI_BASE_URL (see get_client() and KimaiClient._request) and prints/interprets user-generated fields such as timesheet descriptions, tags, customer/project comments via OutputFormatter, so untrusted third-party content could be ingested and influence behavior.
Audit Metadata