gitsafehub
github.com/Faradworks/Pinscope ↗

Faradworks/Pinscope

scanned 2026-07-25 · git b26ad35
2 of 6 checks flagged a security issue
🟡 Worth a look
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies63Known OSS vulnerabilities107Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 63 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing GHSA-frvp-7c67-39w9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
    frontend/package-lock.json
    A package you depend on has a known security hole (GHSA-frvp-7c67-39w9). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-14257 brace-expansion through 5.0.7 is vulnerable to denial of service via m ...
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45149 brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-45149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13676 fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-16221 Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-6321 fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-6321). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-6322 fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-6322). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54290 hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54290). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44455 hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44455). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44456 Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44456). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44457 Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44457). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44458 Hono has CSS Declaration Injection via Style Object Values in JSX SSR
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-47673 Hono: JWT middleware accepts any Authorization scheme, not only Bearer
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-47673). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-47674 Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-47674). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-47675 Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-47675). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-47676 Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-47676). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54286 hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54286). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54287 hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54287). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54288 hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54288). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54289 hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54289). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-56761 hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-56761). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59895 Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59895). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59896 hono/jsx does not isolate context per request, leading to cross-request data disclosure
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59896). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59897 Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59897). Fix: Update that package to its patched version.
… 38 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 107 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing PYSEC-2025-183 pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2025-45768). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-120 PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array li
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-32597). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-175 PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector register
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48522). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-178 PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decod
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48525). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-179 PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48526). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3004 pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48156). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3006 pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-40260). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3007 pypdf: Possible long runtimes for wrong size values in incremental mode
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-41313). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3009 pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-54530). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3010 pypdf: Inefficient decoding of FlateDecode PNG predictor streams
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-49460). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3011 pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-41312). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3016 pypdf: Possible large memory usage for large offsets for layout mode text
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48155). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3018 pypdf: Possible infinite loop when processing threads/articles in writer
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-54651). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3020 pypdf: Possible large memory usage for form XObjects during text extraction
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-49461). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3021 pypdf has long runtimes for wrong size values in cross-reference and object streams
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-41168). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3022 pypdf: Possible infinite loop when processing outlines/bookmarks in writer
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-54531). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3025 pypdf: Manipulated XMP metadata streams can exhaust RAM
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48735). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3026 pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-41314). Fix: Update that package to its patched version.
  • Worth fixing GHSA-55h5-xmcq-c37v pypdf: Possible long runtimes for repeated malformed cross-reference entries
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-59937). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5qjq-93h5-hrgp pypdf: Possible large memory usage for wrong image dimensions
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-59938). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5xf7-4p34-54qr pypdf: Possible infinite loop for not terminated inline images
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-59936). Fix: Update that package to its patched version.
  • Worth fixing GHSA-g867-7843-wf8q pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-59935). Fix: Update that package to its patched version.
  • Worth fixing GHSA-jm82-fx9c-mx94 pypdf: Missing stream length values ignore defined limits
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-57204). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1851 Denial of service (DoS) via deformation `multipart/form-data` boundary
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2024-53981). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1852 Python-Multipart has Arbitrary File Write via Non-Default Configuration
    /workdirs/scan-3f933a9c-70fb-46bf-aac4-64acfb40b353/backend/requirements.txt
    A package you depend on has a known security hole (CVE-2026-24486). Fix: Update that package to its patched version.
… 82 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.