Cua AI Agent

by trycua• 31k•• Scanned•Claim this listing•Request removal
Data Science & MLagentai agentapplecomputer usecomputer use agent

Scale computer-use 2.0 with open-source drivers, cross-OS sandboxes, and benchmarks for training, evaluation, and data generation.

Cua is an open-source ai agent by trycua, written mainly in Rust, with 31,464 GitHub stars and the MIT license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit 044f528. Seen able to run shell commands, run dynamic code, read environment and secrets, connect to the internet. Scan policy

aboutREADMEsecurityreviews
Scanned
Full scan at 044f528 · Nov 5, 2026
Scanned Builds
Static code scanwarn
Secrets scanfail
Dependency audit1552 known vulnerabilitiesfail
Manifestnonewarn
Buildpass
Boot & handshaken/a
Network egressn/a
Reproducible (×3)n/a

Findings (200)

  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    code-execution issue
    Details are available to the maintainer after claiming this listing.
  • high
    code-execution issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    code-execution issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/cua-spaces-mobile/src/data/live/gen/cua/env/v1/computer_pb.ts:17
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/cua-spaces-mobile/src/data/live/gen/cua/env/v1/diagnose_pb.ts:15
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/cua-spaces-mobile/src/data/live/gen/cua/env/v1/filesystem_pb.ts:17
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/cua-spaces-mobile/src/data/live/gen/cua/env/v1/host_pb.ts:23
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/cua-spaces-mobile/src/data/live/gen/cua/env/v1/presence_pb.ts:19
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/cua-spaces-mobile/src/data/live/gen/cua/env/v1/process_pb.ts:17
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/cua-spaces-mobile/src/data/live/gen/cua/env/v1/stream_pb.ts:19
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/cua-spaces-mobile/src/data/live/gen/cua/env/v1/system_pb.ts:21
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/cua-spaces-mobile/src/data/live/gen/cua/env/v1/teleport_pb.ts:15
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/cua-spaces-mobile/src/data/live/gen/cua/env/v1/tunnel_pb.ts:15
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/cua-spaces-mobile/src/data/live/gen/cua/env/v1/windows_pb.ts:17
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/ci:908
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/ci:921
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/ci:1003
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/computer.py:176
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:280
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:675
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cua-bench/tasks/winarena_adapter/infra/vm/setup/server/main.py:1792
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    libs/cua-driver-bench/taskpack/tasks/shared/web-01/reset/setup.py:9
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    libs/cua-driver-bench/taskpack/tasks/shared/web-02/reset/setup.py:9
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    libs/cua-driver-bench/taskpack/tasks/shared/web-common/common.py:48
  • medium
    Contacts a hard-coded IP address instead of a domain name.
    libs/cua/crates/cua-cli/jobs-runtime/cua/_store.py:239
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/assets/viewer.js:3
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/assets/viewer.js:3
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/assets/viewer.js:3
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/assets/viewer.js:3
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/assets/viewer.js:3
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/assets/viewer.js:3
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/assets/viewer.js:3
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/web/src/gen/cua/env/v1/computer_pb.ts:17
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/web/src/gen/cua/env/v1/diagnose_pb.ts:15
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/web/src/gen/cua/env/v1/filesystem_pb.ts:17
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/web/src/gen/cua/env/v1/host_pb.ts:23
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/web/src/gen/cua/env/v1/presence_pb.ts:19
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/web/src/gen/cua/env/v1/process_pb.ts:17
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/web/src/gen/cua/env/v1/stream_pb.ts:19
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/web/src/gen/cua/env/v1/system_pb.ts:21
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/web/src/gen/cua/env/v1/teleport_pb.ts:15
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/web/src/gen/cua/env/v1/tunnel_pb.ts:15
  • medium
    Very long encoded string literal. Often used to hide a payload.
    libs/cua/crates/cua-spacesd-html5/web/src/gen/cua/env/v1/windows_pb.ts:17
  • medium
    Contacts a hard-coded IP address instead of a domain name.
    libs/cua/scripts/conformance/run.py:270
  • medium
    Contacts a hard-coded IP address instead of a domain name.
    libs/cua/scripts/conformance/run.py:300
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cuabot/src/cuabot.tsx:31
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cuabot/src/cuabot.tsx:267
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cuabot/src/cuabot.tsx:270
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cuabot/src/cuabot.tsx:478
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cuabot/src/cuabotd.ts:173
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cuabot/src/onboarding.tsx:41
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cuabot/src/onboarding.tsx:410
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cuabot/src/onboarding.tsx:420
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cuabot/src/utils.ts:262
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/python/agent/cua_agent/cli.py:492
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/python/agent/cua_agent/cli.py:494
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/python/cua-sandbox/cua_sandbox/runtime/_bw_init.js:22
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    real-matrix.py:35
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    scripts/docs-generators/generate-changelog.ts:168
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    scripts/docs-generators/generate-changelog.ts:187
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    scripts/docs-generators/runner.ts:471
  • medium
    @modelcontextprotocol/client@2.0.0: 2 known vulnerabilities
    GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h
    .github/scripts/cua-driver-mcp-compat/modern-client/package-lock.json
  • medium
    zod@4.5.4: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    .github/scripts/cua-driver-mcp-compat/modern-client/package-lock.json
  • medium
    @modelcontextprotocol/sdk@1.30.0: 12 known vulnerabilities
    GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +7 more
    .github/scripts/cua-driver-mcp-compat/package-lock.json
  • medium
    body-parser@2.3.0: 4 known vulnerabilities
    GHSA-27r3-jxmh-p828, GHSA-27r3-jxmh-p828, GHSA-27r3-jxmh-p828, GHSA-27r3-jxmh-p828
    .github/scripts/cua-driver-mcp-compat/package-lock.json
  • medium
    zod@4.4.3: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    .github/scripts/cua-driver-mcp-compat/package-lock.json
  • medium
    undici@6.29.0: 5 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c
    apps/cua-spaces-desktop/pnpm-lock.yaml
  • medium
    undici@7.30.0: 16 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +11 more
    apps/cua-spaces-desktop/pnpm-lock.yaml
  • medium
    vite@8.3.2: 12 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +7 more
    apps/cua-spaces-desktop/pnpm-lock.yaml
  • medium
    zod@3.25.76: 2 known vulnerabilities
    GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5
    apps/cua-spaces-mobile/pnpm-lock.yaml
  • medium
    undici@8.11.2: 8 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more
    apps/cua-spaces-web/pnpm-lock.yaml
  • medium
    zod@4.6.5: 3 known vulnerabilities
    GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5
    apps/cua-spaces-web/pnpm-lock.yaml
  • medium
    source-map-js@1.2.1: 5 known vulnerabilities
    GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q
    apps/cua-spaces/pnpm-lock.yaml
  • medium
    vite@6.4.3: 20 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +15 more
    apps/cua-spaces/pnpm-lock.yaml
  • medium
    pulldown-cmark@0.13.4: 22 known vulnerabilities
    RUSTSEC-2026-0414, RUSTSEC-2026-0433, RUSTSEC-2026-0414, RUSTSEC-2026-0433, RUSTSEC-2026-0414 +17 more
    apps/cua-spaces/src-tauri/Cargo.lock
  • medium
    quinn-proto@0.11.17: 6 known vulnerabilities
    RUSTSEC-2026-0338, RUSTSEC-2026-0340, RUSTSEC-2026-0343, RUSTSEC-2026-0338, RUSTSEC-2026-0340 +1 more
    apps/cua-spaces/src-tauri/Cargo.lock
  • medium
    markdown-it@14.3.2: 2 known vulnerabilities
    GHSA-gfr2-rv44-r23c, GHSA-vfgh-jcmw-g37q
    docs/pnpm-lock.yaml
  • medium
    zod@4.1.12: 3 known vulnerabilities
    GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5
    docs/pnpm-lock.yaml
  • medium
    black@26.5.1: 2 known vulnerabilities
    GHSA-cg8m-r9f2-5wm2, GHSA-cg8m-r9f2-5wm2
    docs/scripts/docs-mcp-server/uv.lock
  • medium
    dnspython@2.8.0: 2 known vulnerabilities
    GHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m
    docs/scripts/docs-mcp-server/uv.lock
  • medium
    filelock@3.32.2: 12 known vulnerabilities
    GHSA-567q-5qvw-pf92, GHSA-6627-m3xw-93mp, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9c4x-gm8v-wgc4 +7 more
    docs/scripts/docs-mcp-server/uv.lock
  • medium
    joserfc@1.7.4: 2 known vulnerabilities
    GHSA-9pg5-8c7x-5hfx, GHSA-jpxq-7h8p-2q76
    docs/scripts/docs-mcp-server/uv.lock
  • medium
    mcp@1.29.0: 4 known vulnerabilities
    GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv, GHSA-rwrf-2pqf-9j8j, GHSA-w4fh-qvv9-3v23
    docs/scripts/docs-mcp-server/uv.lock
  • medium
    pyjwt@2.14.0: 10 known vulnerabilities
    PYSEC-2026-4141, PYSEC-2026-4183, PYSEC-2026-4141, PYSEC-2026-4183, PYSEC-2026-4141 +5 more
    docs/scripts/docs-mcp-server/uv.lock
  • medium
    happy-dom@20.14.5: 6 known vulnerabilities
    GHSA-5fpq-26gf-qwcr, GHSA-834v-8h66-3h79, GHSA-c8p4-j97h-3vg8, GHSA-5fpq-26gf-qwcr, GHSA-834v-8h66-3h79 +1 more
    examples/openkoalabot-example-tauri/pnpm-lock.yaml
  • medium
    aiohttp@3.14.3: 40 known vulnerabilities
    GHSA-2g87-pp6c-29x5, GHSA-494j-54xm-rwp3, GHSA-5wr8-gcqf-gqf3, GHSA-6cjc-53gc-5rqm, GHSA-9xw5-w5jj-pvcg +35 more
    libs/cua-bench-rl/uv.lock
  • medium
    filelock@4.0.3: 28 known vulnerabilities
    GHSA-567q-5qvw-pf92, GHSA-6627-m3xw-93mp, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9c4x-gm8v-wgc4 +23 more
    libs/cua-bench-rl/uv.lock
  • medium
    litellm@1.86.2: 10 known vulnerabilities
    PYSEC-2026-4066, GHSA-g5ff-637f-6q2m, PYSEC-2026-4066, GHSA-g5ff-637f-6q2m, PYSEC-2026-4066 +5 more
    libs/cua-bench-rl/uv.lock
  • medium
    transformers@5.5.4: 2 known vulnerabilities
    PYSEC-2026-3929, PYSEC-2026-4174
    libs/cua-bench-rl/uv.lock
  • medium
    twisted@26.4.0: 48 known vulnerabilities
    GHSA-2qrf-pqgx-qh9v, GHSA-3476-c5c2-fr73, GHSA-53xc-49m8-p798, GHSA-8pqf-f4m5-798g, GHSA-cwm5-jh59-mwxr +43 more
    libs/cua-bench-rl/uv.lock
  • medium
    filelock@3.29.4: 18 known vulnerabilities
    GHSA-567q-5qvw-pf92, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9vhv-jxww-xfm5, GHSA-cwqr-hh33-gh44 +13 more
    libs/cua-bench/uv.lock
  • medium
    fsspec@2025.9.0: 2 known vulnerabilities
    PYSEC-2026-4217, PYSEC-2026-4217
    libs/cua-bench/uv.lock
  • medium
    pypdf@6.19.0: 18 known vulnerabilities
    GHSA-39mj-jf6j-2qj3, GHSA-42gh-23hr-vphw, GHSA-4vqv-7265-gm2w, GHSA-5849-834g-hvw5, GHSA-5hx5-vpf9-5wcv +13 more
    libs/cua-bench/uv.lock
  • medium
    undici@7.29.0: 72 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +67 more
    libs/cua-driver-bench/taskpack/tasks/shared/cdb-s02/apps/lighthouse-desk/package-lock.json
  • medium
    @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities
    GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
    libs/cua-driver/examples/agent-sdks/package-lock.json
  • medium
    python-multipart@0.0.9: 8 known vulnerabilities
    PYSEC-2026-1851, PYSEC-2026-1852, PYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3038 +3 more
    libs/cua-driver/examples/agent-sdks/requirements.txt
  • medium
    undici@8.10.2: 8 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more
    libs/cua-driver/examples/eve/package-lock.json
  • medium
    quick-xml@0.39.4: 2 known vulnerabilities
    RUSTSEC-2026-0194, RUSTSEC-2026-0195
    libs/cua-driver/rust/Cargo.lock
  • medium
    @xmldom/xmldom@0.9.10: 13 known vulnerabilities
    GHSA-27p8-2357-5qqv, GHSA-3px3-54cx-rmw9, GHSA-4w3w-2rp5-g8jm, GHSA-6gmq-8vp8-gcm6, GHSA-6h8r-xr42-gp59 +8 more
    libs/cua-driver/tests/fixtures/apps/cross-platform/electron/package-lock.json
  • medium
    app-builder-lib@25.0.5: 1 known vulnerability
    GHSA-7g7r-gx96-252g
    libs/cua-driver/tests/fixtures/apps/cross-platform/electron/package-lock.json
  • medium
    brace-expansion@1.1.16: 5 known vulnerabilities
    GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895
    libs/cua-driver/tests/fixtures/apps/cross-platform/electron/package-lock.json
  • medium
    brace-expansion@2.1.3: 4 known vulnerabilities
    GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895
    libs/cua-driver/tests/fixtures/apps/cross-platform/electron/package-lock.json
  • medium
    brace-expansion@5.0.8: 4 known vulnerabilities
    GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895
    libs/cua-driver/tests/fixtures/apps/cross-platform/electron/package-lock.json
  • medium
    builder-util-runtime@9.2.5: 1 known vulnerability
    GHSA-p2f4-r6v6-j797
    libs/cua-driver/tests/fixtures/apps/cross-platform/electron/package-lock.json
  • medium
    electron@39.8.5: 28 known vulnerabilities
    GHSA-2p8c-gr87-2676, GHSA-3qxv-5xgr-q7w9, GHSA-4f78-qhmw-8j8m, GHSA-5c9j-mhmv-5xgx, GHSA-98mx-cjp9-gchm +23 more
    libs/cua-driver/tests/fixtures/apps/cross-platform/electron/package-lock.json
  • medium
    extract-zip@2.0.1: 2 known vulnerabilities
    GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv
    libs/cua-driver/tests/fixtures/apps/cross-platform/electron/package-lock.json
  • medium
    js-yaml@4.3.0: 2 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-5p4m-2wfm-xmqj
    libs/cua-driver/tests/fixtures/apps/cross-platform/electron/package-lock.json
  • medium
    filelock@4.0.0: 14 known vulnerabilities
    GHSA-567q-5qvw-pf92, GHSA-6627-m3xw-93mp, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9c4x-gm8v-wgc4 +9 more
    libs/cua-s1/python/uv.lock
  • medium
    pyasn1@0.6.4: 4 known vulnerabilities
    GHSA-2qm8-x737-gmw5, GHSA-9m75-vc3g-4x39, GHSA-fm9c-5rcf-2q5p, GHSA-mm57-4v3p-rchx
    libs/cua/python/uv.lock
  • medium
    @modelcontextprotocol/client@2.1.0: 2 known vulnerabilities
    GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h
    libs/cua/typescript/package-lock.json
  • medium
    @modelcontextprotocol/sdk@1.26.0: 6 known vulnerabilities
    GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
    libs/cuabot/pnpm-lock.yaml
  • medium
    github.com/apple/swift-nio@2.93.0: 3 known vulnerabilities
    GHSA-cq87-8r7h-962v, GHSA-r3rc-9hpw-54v9, GHSA-rj37-6j9x-74q6
    libs/lume/Package.resolved
  • medium
    mcp@1.28.1: 8 known vulnerabilities
    GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv, GHSA-rwrf-2pqf-9j8j, GHSA-w4fh-qvv9-3v23, GHSA-5h93-6whr-6q8j +3 more
    libs/python/cua-sandbox-apps/uv.lock
  • medium
    filelock@3.25.2: 9 known vulnerabilities
    GHSA-567q-5qvw-pf92, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9vhv-jxww-xfm5, GHSA-cwqr-hh33-gh44 +4 more
    libs/python/cua-sandbox/uv.lock
  • medium
    fsspec@2026.2.0: 1 known vulnerability
    PYSEC-2026-4217
    libs/python/cua-sandbox/uv.lock
  • medium
    happy-dom@20.8.9: 3 known vulnerabilities
    GHSA-5fpq-26gf-qwcr, GHSA-834v-8h66-3h79, GHSA-c8p4-j97h-3vg8
    libs/typescript/pnpm-lock.yaml
  • medium
    vite@7.3.5: 5 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22
    libs/typescript/pnpm-lock.yaml
  • medium
    follow-redirects@1.16.1: 1 known vulnerability
    GHSA-mrwp-f3q8-3g9p
    tests/compat/daytona/ts/package-lock.json
  • medium
    accelerate@1.12.0: 1 known vulnerability
    PYSEC-2026-3804
    uv.lock
  • medium
    gitpython@3.1.60: 8 known vulnerabilities
    GHSA-23mf-xhv8-69c2, GHSA-59cr-6r3x-644w, GHSA-83vg-56qc-22m7, GHSA-f9j4-qggq-h239, GHSA-fx3j-rwgx-fr94 +3 more
    uv.lock
  • medium
    jaraco-context@6.0.2: 1 known vulnerability
    PYSEC-2026-1469
    uv.lock
  • medium
    joserfc@1.7.1: 2 known vulnerabilities
    GHSA-9pg5-8c7x-5hfx, GHSA-jpxq-7h8p-2q76
    uv.lock
  • medium
    langgraph-sdk@0.4.2: 2 known vulnerabilities
    PYSEC-2026-4240, GHSA-3fx2-cqw9-xr3c
    uv.lock
  • medium
    virtualenv@21.7.13: 15 known vulnerabilities
    GHSA-394h-qwmc-48pf, GHSA-43mp-35q3-x3fq, GHSA-494p-63j8-28p3, GHSA-558c-9hv2-4prj, GHSA-5vjq-rrrf-7h2q +10 more
    uv.lock
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    apps/cua-spaces-web/src/components/__tests__/add-computer-sheet.test.tsx:157
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    apps/cua-spaces/src/components/TeleportPicker.test.tsx:192
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    apps/cua-spaces/src/components/TeleportPicker.test.tsx:192
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    apps/cua-spaces/src/components/TeleportPicker.test.tsx:206
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    examples/openkoalabot-example-tauri/ui/src/logic.test.ts:14
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    examples/openkoalabot-example-tauri/ui/src/logic.test.ts:37
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    examples/openkoalabot-example-tauri/ui/src/logic.test.ts:42
  • low
    In tests/examples/docs: Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    libs/cua-driver-bench/automated-eval/macos_bench/tools/fixture.py:149
  • low
    Possible example credential in docs/tests: generic-api-key
    libs/cua/crates/cua-agents/runner/test/durable.test.mjs:397
  • low
    Possible example credential in docs/tests: generic-api-key
    libs/cua/crates/cua-agents/runner/test/run-end.test.mjs:53
  • low
    Possible example credential in docs/tests: generic-api-key
    libs/cua/crates/cua-agents/runner/test/key-check.test.mjs:175
  • low
    Possible example credential in docs/tests: generic-api-key
    libs/cua/crates/cua-mock-llm/tests/fixtures/recorded/codex-acp-1.13.1-1.json:84
  • low
    Possible example credential in docs/tests: generic-api-key
    libs/cua/crates/cua-mock-llm/tests/fixtures/recorded/codex-acp-1.13.1-0.json:49
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    libs/cua/crates/cua-vmm/tests/containerization.rs:17
  • low
    Possible example credential in docs/tests: generic-api-key
    libs/cua-spacesd/crates/cua-relay/tests/mesh_default.rs:64
  • low
    Possible example credential in docs/tests: private-key
    libs/cua-spacesd/crates/cua-relay/tests/fixtures/untrusted-key.pem:1
  • low
    Possible example credential in docs/tests: generic-api-key
    libs/cua-spacesd/crates/cua-spacesd-server/tests/await_token_file.rs:142
  • low
    Possible example credential in docs/tests: generic-api-key
    libs/cua-spacesd/crates/cua-relay/tests/auth_rejection_logs.rs:210
  • low
    Possible example credential in docs/tests: generic-api-key
    libs/spaces-sdk-swift/Tests/CuaSpacesTests/CloudTargetTests.swift:8
  • low
    Possible example credential in docs/tests: generic-api-key
    39 matches in this file
    tests/compat/e2b/fixtures/signature-vectors.json:24
  • low
    ajv@8.17.1: 1 known vulnerability
    GHSA-2g4f-4pwh-qvx6
    .github/scripts/cua-driver-mcp-compat/modern-client/package-lock.json
  • low
    fast-uri@3.1.7: 5 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-hrr3-gc8f-f4qj, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h
    .github/scripts/cua-driver-mcp-compat/modern-client/package-lock.json
  • low
    yaml@2.8.1: 1 known vulnerability
    GHSA-48c2-rrv3-qjmp
    .github/scripts/cua-driver-mcp-compat/modern-client/package-lock.json
  • low
    @hono/node-server@2.1.0: 1 known vulnerability
    GHSA-rmxm-3fg6-px4f
    .github/scripts/cua-driver-mcp-compat/package-lock.json
  • low
    fast-uri@3.1.8: 20 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, GHSA-333x-w4r6-6crp +15 more
    .github/scripts/cua-driver-mcp-compat/package-lock.json
  • low
    hono@4.13.1: 5 known vulnerabilities
    GHSA-5r4p-p66f-jhc7, GHSA-crvj-82cr-hjcx, GHSA-g6gw-c38x-mqfc, GHSA-gqvv-2mrq-wpjv, GHSA-hxh3-vqpv-xpqv
    .github/scripts/cua-driver-mcp-compat/package-lock.json
  • low
    ip-address@10.4.0: 5 known vulnerabilities
    GHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5
    .github/scripts/cua-driver-mcp-compat/package-lock.json
  • low
    qs@6.15.3: 3 known vulnerabilities
    GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx
    .github/scripts/cua-driver-mcp-compat/package-lock.json

Network activity

During install
registry.npmjs.org
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Cua alternatives

View more →

Similar ai agents in Data Science & ML, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Cua (this page)
trycua
31kMITNov 1, 2026Scanned, no flagged issues
Ragflow
infiniflow
93kApache-2.0Oct 31, 2026Scanned, no flagged issues
Cherry Studio
CherryHQ
53kAGPL-3.0Nov 1, 2026Scanned, no flagged issues
PageIndex
VectifyAI
40kMITOct 29, 2026Scanned, no flagged issues
Graphiti
getzep
32kApache-2.0Nov 1, 2026Scanned, no flagged issues
Mlflow
mlflow
29kApache-2.0Nov 1, 2026Scanned, no flagged issues