gitsafehub
github.com/bblanchon/django-htmx-messages-framework ↗

bblanchon/django-htmx-messages-framework

scanned 2026-08-15 · git a2da417
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secretsVulnerable dependencies22Known OSS vulnerabilities26Risky code patternsMalicious dependenciesProject health

Security checks

Leaked secrets — Gitleaks none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivy 22 found · 2 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2023-31047 python-django: Potential bypass of validation when uploading multiple files using one form field
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-31047). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-41323 python-django: Potential denial-of-service vulnerability in internationalized URLs
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-41323). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-23969 python-django: Potential denial-of-service via Accept-Language headers
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-23969). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-24580 python-django: Potential denial-of-service vulnerability in file uploads
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-24580). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-36053 python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-36053). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-43665 python-django: Denial-of-service possibility in django.utils.text.Truncator
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-43665). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-46695 python-django: Potential denial of service vulnerability in UsernameField on Windows
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-46695). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-57833 django: Django SQL injection in FilteredRelation column aliases
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-64458 Django: Denial-of-service vulnerability in Django on Windows
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-64458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-41164 python-django: Potential denial of service vulnerability in ``django.utils.encoding.uri_to_iri()``
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-41164). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-45231 python-django: Potential user email enumeration via response status on password reset
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-48432 django: Django Path Injection Vulnerability
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-48432). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53877 django: Django: Information disclosure via heap buffer over-read in GDALRaster
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-53877). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53878 django: Django: HTTP header injection via DomainNameValidator accepting newlines
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-53878). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-4340 sqlparse: parsing heavily nested list leads to denial of service
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-4340). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-30608 sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-30608). Fix: Update that package to its patched version.
  • Worth fixing GHSA-27jp-wm6q-gp25 sqlparse: formatting list of tuples leads to denial of service
    Pipfile.lock
    A package you depend on has a known security hole (GHSA-27jp-wm6q-gp25). Fix: Update that package to its patched version.
  • Minor CVE-2026-48587 django: Django: Information disclosure via improper handling of Vary header whitespace
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-48587). Fix: Update that package to its patched version.
  • Minor CVE-2026-48588 django: Django: Information disclosure due to improper caching of Set-Cookie responses
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-48588). Fix: Update that package to its patched version.
  • Minor CVE-2026-6873 python-django: Django: Information disclosure via non-injective cookie salt derivation
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-6873). Fix: Update that package to its patched version.
  • Minor CVE-2026-8404 Django: Django: Information disclosure due to improper handling of Cache-Control directives
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-8404). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scanner 26 found · 3 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2026-2120 Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-31900). Fix: Update that package to its patched version.
  • Serious PYSEC-2023-61 In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been suppor
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-31047). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2024-48 Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could e
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-21503). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2121 Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics opti
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-32274). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-7246). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-304 In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-41323). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-100 In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large numb
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-36053). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-12 In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-s
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-23969). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-13 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart f
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-24580). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-222 An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is su
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-46695). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-225 In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large n
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-41164). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-226 In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of s
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-43665). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1297 Django allows enumeration of user e-mail addresses
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6w2r-r2m5-xq5w Django is subject to SQL injection through its column aliases
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7xr5-9hcq-chf9 Django Improper Output Neutralization for Logs vulnerability
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-48432). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8qcx-xf44-272x Django: DomainNameValidator permits newline characters that may enable HTTP header injection
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-53878). Fix: Update that package to its patched version.
  • Worth fixing GHSA-crhf-3pfg-w68w Django: GDALRaster may over-read heap memory when constructed from bytes
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-53877). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qw25-v68c-qjf3 Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-64458). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-87 sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This is
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-30608). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1940 sqlparse parsing heavily nested list leads to Denial of Service
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-4340). Fix: Update that package to its patched version.
  • Worth fixing GHSA-27jp-wm6q-gp25 sqlparse: formatting list of tuples leads to denial of service
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Minor GHSA-3h9f-r86x-qvjx Django: cache middleware may expose private responses when unrelated request cookies are present
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-48588). Fix: Update that package to its patched version.
  • Minor GHSA-8cjm-8mp7-r2xf Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-8404). Fix: Update that package to its patched version.
  • Minor GHSA-923m-gv2p-w5qp Django: has_vary_header may expose cached responses when Vary values contain whitespace
    /workdirs/scan-501993a4-38ad-4ada-9650-dab1e4f1ef72/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-48587). Fix: Update that package to its patched version.
… 1 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrep none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddog none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecard didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.