666ghj/MiroFish

scanned 2026-05-27 · git 96096ea

2 of 6 checks flagged a security issue

🔴 Needs attention

6 checks ran. Start with known oss vulnerabilities below.

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies82Known OSS vulnerabilities103Risky code patterns✓Malicious dependencies✓Project health10

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 82 found · 2 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2025-14009 nltk: Zip Slip Vulnerability in nltk Leading to Code Execution

backend/uv.lock

A package you depend on has a known security hole (CVE-2025-14009). Fix: Update that package to its patched version.
Serious CVE-2025-64712 Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write

backend/uv.lock

A package you depend on has a known security hole (CVE-2025-64712). Fix: Update that package to its patched version.
Worth fixing CVE-2026-26007 cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-26007). Fix: Update that package to its patched version.
Worth fixing CVE-2026-39892 cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-39892). Fix: Update that package to its patched version.
Worth fixing CVE-2026-22701 filelock: filelock Time-of-Check-Time-of-Use (TOCTOU) in SoftFileLock

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-22701). Fix: Update that package to its patched version.
Worth fixing CVE-2026-45409 Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
Worth fixing CVE-2026-41066 lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-41066). Fix: Update that package to its patched version.
Worth fixing CVE-2025-68480 Marshmallow is a lightweight library for converting complex objects to ...

backend/uv.lock

A package you depend on has a known security hole (CVE-2025-68480). Fix: Update that package to its patched version.
Worth fixing CVE-2026-33079 mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-33079). Fix: Update that package to its patched version.
Worth fixing CVE-2026-44708 Mistune Math Plugin has an XSS Escape Bypass

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-44708). Fix: Update that package to its patched version.
Worth fixing CVE-2026-44896 Mistune has XSS via unescaped figclass/figwidth in Figure directive

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-44896). Fix: Update that package to its patched version.
Worth fixing CVE-2026-44897 Mistune Heading ID Attribute has Injection XSS

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-44897). Fix: Update that package to its patched version.
Worth fixing CVE-2025-53000 nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

backend/uv.lock

A package you depend on has a known security hole (CVE-2025-53000). Fix: Update that package to its patched version.
Worth fixing CVE-2026-39377 nbconvert: nbconvert: Arbitrary file write via crafted Jupyter notebook cell attachment filenames

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-39377). Fix: Update that package to its patched version.
Worth fixing CVE-2026-39378 nbconvert: nbconvert: Sensitive file exfiltration via path traversal in image references

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-39378). Fix: Update that package to its patched version.
Worth fixing CVE-2026-0846 nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-0846). Fix: Update that package to its patched version.
Worth fixing CVE-2026-0847 nltk: NLTK: Arbitrary file read via path traversal vulnerability

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-0847). Fix: Update that package to its patched version.
Worth fixing CVE-2026-33231 nltk: NLTK: Denial of Service via unauthenticated remote shutdown

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-33231). Fix: Update that package to its patched version.
Worth fixing CVE-2026-33236 nltk: NLTK: Arbitrary file overwrite and creation via path traversal in XML index files

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-33236). Fix: Update that package to its patched version.
Worth fixing CVE-2026-33230 nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-33230). Fix: Update that package to its patched version.
Worth fixing GHSA-rf74-v2fm-23pw Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

backend/uv.lock

A package you depend on has a known security hole (GHSA-rf74-v2fm-23pw). Fix: Update that package to its patched version.
Worth fixing CVE-2026-25990 pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-25990). Fix: Update that package to its patched version.
Worth fixing CVE-2026-40192 Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-40192). Fix: Update that package to its patched version.
Worth fixing CVE-2026-42311 Pillow is a Python imaging library. From version 10.3.0 to before vers ...

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-42311). Fix: Update that package to its patched version.
Worth fixing CVE-2026-42308 Pillow: python: Pillow: Denial of Service via integer overflow in font processing

backend/uv.lock

A package you depend on has a known security hole (CVE-2026-42308). Fix: Update that package to its patched version.

… 57 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 103 found · 2 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-7p94-766c-hgjp NLTK has a Zip Slip Vulnerability

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Serious GHSA-gm8q-m8mv-jj5m Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-r6ph-v2qm-q3c2 cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-vfmq-68hx-4jfw lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-8mp2-v27r-99xp Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-xm59-rqc7-hhvf nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-469j-vmhf-r6v7 NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-68j8-pq59-fqgm NLTK has a Path Traversal issue

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-h8wq-7xc4-p3qx NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-jm6w-m3j8-898g Unauthenticated remote shutdown in nltk.app.wordnet_app

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-cfh3-3jmp-rvhc Pillow affected by out-of-bounds write when loading PSD images

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-pwv6-vv43-88gr Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-whj4-6x5x-4v2j FITS GZIP decompression bomb in Pillow

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-752w-5fwx-jx9f PyJWT accepts unknown `crit` header extensions

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-pp6c-gr5w-3c5g python-multipart has Denial of Service via unbounded multipart part headers

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-wp53-j4wj-2cfg Python-Multipart has Arbitrary File Write via Non-Default Configuration

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-fqwm-6jpj-5wxc Tornado has cookie attribute injection via .RequestHandler.set_cookie

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-qjxf-f2mg-c6mc Tornado is vulnerable to DoS due to too many multipart parts

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-38jv-5279-wg99 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-mf9v-mfxr-j63j urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-qccp-gfcp-xxvc urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/backend/uv.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-6chq-wfr3-2hj9 Axios: Header Injection via Prototype Pollution

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/frontend/package-lock.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-pf86-5x62-jrwf Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/frontend/package-lock.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-pmwg-cvhr-8vh7 Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/frontend/package-lock.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-q8qp-cvcw-x6jj Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

/workdirs/scan-c5ff105e-5acb-46b5-94ea-ee24c956dd87/frontend/package-lock.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.

… 78 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ 10 notes

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

Worth fixing scorecard-overall OpenSSF Scorecard overall: 3.9/10

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-Branch-Protection Branch-Protection scored 0: branch protection not enabled on development/release branches

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-CI-Tests CI-Tests scored 0: 0 out of 4 merged PRs checked by a CI test -- score normalized to 0

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-CII-Best-Practices CII-Best-Practices scored 0: no effort to earn an OpenSSF best practices badge detected

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-Dependency-Update-Tool Dependency-Update-Tool scored 0: no update tool detected

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-Fuzzing Fuzzing scored 0: project is not fuzzed

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-SAST SAST scored 0: SAST tool is not run on all commits -- score normalized to 0

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-Security-Policy Security-Policy scored 0: security policy file not detected

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-Token-Permissions Token-Permissions scored 0: detected GitHub workflow tokens with excessive permissions

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.
Minor scorecard-Vulnerabilities Vulnerabilities scored 0: 91 existing vulnerabilities detected

A project-health signal (maintenance / supply-chain hygiene), not a vulnerability in your code.

via OpenSSF Scorecard v5.0.0 · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.