gitsafehub
github.com/OpenHFT/Chronicle-Queue ↗

OpenHFT/Chronicle-Queue

scanned 2026-07-24 · git c95560d
1 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies✓Known OSS vulnerabilities50Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 50 found · 7 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-44fc-8fm5-q62h Convict has Prototype Pollution via startsWith() function
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33864). Fix: Update that package to its patched version.
  • Serious GHSA-hf2r-9gf9-rwch Convict has prototype pollution via load(), loadFile(), and schema initialization
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33863). Fix: Update that package to its patched version.
  • Serious GHSA-jjf5-wx3j-3fv7 Prototype Pollution in convict
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2022-21190). Fix: Update that package to its patched version.
  • Serious GHSA-44fc-8fm5-q62h Convict has Prototype Pollution via startsWith() function
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33864). Fix: Update that package to its patched version.
  • Serious GHSA-hf2r-9gf9-rwch Convict has prototype pollution via load(), loadFile(), and schema initialization
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33863). Fix: Update that package to its patched version.
  • Serious GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type Confusion
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33937). Fix: Update that package to its patched version.
  • Serious GHSA-95m3-7q98-8xr5 sha.js is missing type checks leading to hash rewind and passing on crafted data
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2025-9288). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing GHSA-grv7-fg5c-xmjg Uncontrolled resource consumption in braces
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2024-4068). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4jrm-c32x-w4jf convict vulnerable to Prototype Pollution
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2023-0163). Fix: Update that package to its patched version.
  • Worth fixing GHSA-x2w5-725j-gf2g Prototype Pollution in convict
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2022-22143). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4jrm-c32x-w4jf convict vulnerable to Prototype Pollution
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2023-0163). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3xgq-45jj-v275 Regular Expression Denial of Service (ReDoS) in cross-spawn
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2024-21538). Fix: Update that package to its patched version.
  • Worth fixing GHSA-pfrx-2q88-qq97 Got allows a redirect to a UNIX socket
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2022-33987). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2qvq-rjwj-gvw9 Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33916). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3mfm-83xf-c92r Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33938). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-9cx6-37pm-9jff Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33939). Fix: Update that package to its patched version.
  • Worth fixing GHSA-xhpv-hc6g-r9c6 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33940). Fix: Update that package to its patched version.
  • Worth fixing GHSA-xjpj-3mr7-gcpf Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33941). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rc47-6667-2j5j http-cache-semantics vulnerable to Regular Expression Denial of Service
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2022-25881). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fgxq-p49f-qw99 Directory Traversal in isomorphic-git
    /workdirs/scan-49458d21-36b2-43ab-b363-f36032cebba7/docs/antora/package-lock.json
    A package you depend on has a known security hole (CVE-2021-30483). Fix: Update that package to its patched version.
… 25 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.