gitsafehub
github.com/abzcoding/flask-sample ↗

abzcoding/flask-sample

scanned 2026-08-08 · git 427e145
2 of 6 checks flagged a security issue
🟡 Worth a look
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies18Known OSS vulnerabilities25Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 18 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
    requirements.txt
    A package you depend on has a known security hole (CVE-2023-30861). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-34531 Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication fo ...
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-34531). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-14322 Pallets Werkzeug vulnerable to Path Traversal
    requirements.txt
    A package you depend on has a known security hole (CVE-2019-14322). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-25577 python-werkzeug: high resource usage when parsing multipart form data with many fields
    requirements.txt
    A package you depend on has a known security hole (CVE-2023-25577). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-34069 python-werkzeug: user may execute code on a developer's machine
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-34069). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-49766 werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-49766). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-66221 Werkzeug: Werkzeug: Denial of service via Windows device names in path segments
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-66221). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-21860 Werkzeug safe_join() allows Windows special device names with compound extensions
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-21860). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-27199 Werkzeug safe_join() allows Windows special device names
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-27199). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-48052 Missing SSL certificate validation in HTTPie v3.2.2 allows attackers t ...
    requirements.txt
    A package you depend on has a known security hole (CVE-2023-48052). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-0430 Exposure of Sensitive Information to an Unauthorized Actor in GitHub r ...
    requirements.txt
    A package you depend on has a known security hole (CVE-2022-0430). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-24737 HTTPie is a command-line HTTP client. HTTPie has the practical concept ...
    requirements.txt
    A package you depend on has a known security hole (CVE-2022-24737). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
    requirements.txt
    A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-35195 requests: subsequent requests to the same host ignore cert verification
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25645 requests: Requests: Security bypass due to predictable temporary file creation
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
  • Minor CVE-2026-27205 flask: Flask: Information disclosure via improper caching of session data
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-27205). Fix: Update that package to its patched version.
  • Minor CVE-2023-23934 python-werkzeug: cookie prefixed with = can shadow unprefixed cookie
    requirements.txt
    A package you depend on has a known security hole (CVE-2023-23934). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 25 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing PYSEC-2023-62 Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2023-30861). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2151 Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Us
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2026-27205). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2152 Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without pass
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2026-34531). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-66 This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1473 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1474 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1475 Jinja has a sandbox breakout through indirect reference to format method
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-221 Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are ap
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2023-46136). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-58 Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a sm
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2023-25577). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1065 Pallets Werkzeug vulnerable to Path Traversal
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2019-14322). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2043 Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2024-34069). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2044 Werkzeug safe_join() allows Windows special device names with compound extensions
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2026-21860). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2045 Werkzeug safe_join not safe on Windows
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2024-49766). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2046 Werkzeug safe_join() allows Windows special device names
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2025-66221). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2320 Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previou
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2026-27199). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-167 Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2022-0430). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-34 HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to the outgoing requests and incoming response
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2022-24737). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-242 Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2023-48052). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-74 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `re
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLs
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1873 Requests `Session` object does not verify requests after making first request with verify=False
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2275 Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system te
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
  • Minor PYSEC-2023-57 Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2023-23934). Fix: Update that package to its patched version.
  • FYI PYSEC-2022-203 ** DISPUTED ** Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included in
    /workdirs/scan-bdfdb08f-2a30-404d-99bf-66b86d78fa19/requirements.txt
    A package you depend on has a known security hole (CVE-2022-29361). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.