IndieBlocks Security & Risk Analysis

The indieblocks plugin v0.13.3 presents a mixed security posture. On the positive side, the plugin demonstrates good practices by largely utilizing prepared statements for SQL queries and properly escaping a high percentage of its output. The absence of dangerous functions, file operations, and critical taint flows is also encouraging. However, several concerns warrant attention. The presence of an unprotected REST API route represents a significant attack vector. While the total attack surface isn't exceptionally large, the unprotected entry point is a critical flaw that could be exploited. The plugin's history of two CVEs, including a high and a medium severity vulnerability, with one being a Cross-site Scripting (XSS) and the other Server-Side Request Forgery (SSRF), is a red flag. Although there are currently no unpatched vulnerabilities, this history suggests a recurring pattern of security weaknesses that require careful monitoring and prompt patching of future issues. The last vulnerability being in the near future (2025-06-12) may be a data anomaly but doesn't negate the past issues. Overall, while the code quality shows some positive aspects, the unprotected entry point and the past vulnerability history necessitate vigilance.