coeur/jazzy

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/jazzy/sourcekitten.rb:14
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/jazzy/sourcekitten.rb:14
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8165). Fix: Update that package to its patched version.
• Serious CVE-2026-54906 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Synchronization flaw in ReadWriteLock allows unauthorized lock release and denial of service
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54906). Fix: Update that package to its patched version.
• Serious CVE-2022-33127 rubygem-diffy: remote code execution from user controlled diff file paths
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-33127). Fix: Update that package to its patched version.
• Serious CVE-2022-25648 ruby-git: package vulnerable to Command Injection via git argument injection
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-25648). Fix: Update that package to its patched version.
• Serious CVE-2020-14001 rubygem-kramdown: processing template options inside documents allows unintended read access or embedded Ruby code execution
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-14001). Fix: Update that package to its patched version.
• Serious CVE-2021-28834 rubygem-kramdown: allows arbitrary classes to be instantiated
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-28834). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-22796 rubygem-activesupport: Regular Expression Denial of Service
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-22796). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33176 Rails: Active Support: Active Support: Denial of Service via large scientific notation strings
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-28120 rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28120). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33169 rails: rails-activesupport: Active Support: Denial of Service via crafted long digit strings
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33170 Rails: Active Support: Active Support: Cross-Site Scripting (XSS) due to improper HTML safety flag propagation in SafeBuffer#%
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-32740 rubygem-addressable: ReDoS in templates
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-32740). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-35611 addressable: Addressable: Denial of Service via crafted URI templates
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-35611). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-21223 Command injection in cocoapods-downloader
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-21223). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-24440 Command injection in cocoapods-downloader
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-24440). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54904 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Denial of Service due to infinite loop in AtomicReference#update
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54904). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54905 concurrent-ruby: Concurrent-ruby: Incorrect write lock granting leading to broken mutual exclusion
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54905). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54297 faraday: Faraday: Denial of Service via crafted nested query strings
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54297). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-25765 Faraday: Faraday: Server-Side Request Forgery via protocol-relative URLs
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-25765). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-47318 ruby-git: code injection vulnerability
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-47318). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-46648 ruby-git: code injection vulnerability
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-46648). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-8130 rake: OS Command Injection via egrep in Rake::FileList
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8130). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-26298 rubygem-redcarpet: does not escape HTML when processing quotes which could result in XSS vulnerability
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-26298). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-31163 rubygem-tzinfo: arbitrary code execution
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-31163). Fix: Update that package to its patched version.
• Minor CVE-2026-54619 sqlite3 provides Ruby bindings for the SQLite3 embedded database. In v ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54619). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-5ww9-9qp2-x524 Improper handling of double quotes in file name in Diffy in Windows environment
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-33127). Fix: Update that package to its patched version.
• Serious GHSA-69p6-wvmq-27gg Command injection in ruby-git
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-25648). Fix: Update that package to its patched version.
• Serious GHSA-52p9-v744-mwjj Remote code execution in Kramdown
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-28834). Fix: Update that package to its patched version.
• Serious GHSA-mqm2-cgpr-p4m6 Unintended read access in kramdown gem
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-14001). Fix: Update that package to its patched version.
• Worth fixing GHSA-2j26-frm8-cmj9 Rails Active Support has a possible DoS vulnerability in its number helpers
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
• Worth fixing GHSA-89vf-4333-qx8v Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
• Worth fixing GHSA-cg4j-q9v8-6v38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
• Worth fixing GHSA-pj73-v5mw-pm9j Possible XSS Security Vulnerability in SafeBuffer#bytesplice
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28120). Fix: Update that package to its patched version.
• Worth fixing GHSA-h27x-rffw-24p4 Addressable has a Regular Expression Denial of Service in Addressable templates
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-35611). Fix: Update that package to its patched version.
• Worth fixing GHSA-jxhc-q857-3j6g Regular Expression Denial of Service in Addressable templates
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-32740). Fix: Update that package to its patched version.
• Worth fixing GHSA-7627-mp87-jf6q Command injection in cocoapods-downloader
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-24440). Fix: Update that package to its patched version.
• Worth fixing GHSA-g397-v4w5-4m79 Command injection in cocoapods-downloader
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-21223). Fix: Update that package to its patched version.
• Worth fixing GHSA-h8w8-99g7-qmvj Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54904). Fix: Update that package to its patched version.
• Worth fixing GHSA-wv3x-4vxv-whpp Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54905). Fix: Update that package to its patched version.
• Worth fixing GHSA-pfpr-3463-c6jh ruby-git has potential remote code execution vulnerability
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-46648). Fix: Update that package to its patched version.
• Worth fixing GHSA-pphf-gfrm-v32r Code injection in ruby git
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-47318). Fix: Update that package to its patched version.
• Worth fixing GHSA-jppv-gw3r-w3q8 OS Command Injection in Rake
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8130). Fix: Update that package to its patched version.
• Worth fixing GHSA-q3wr-qw3g-3p4h Injection/XSS in Redcarpet
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-26298). Fix: Update that package to its patched version.
• Worth fixing GHSA-5cm2-9h8c-rvfx TZInfo relative path traversal vulnerability allows loading of arbitrary files
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-31163). Fix: Update that package to its patched version.
• Minor GHSA-j6gc-792m-qgm2 ReDoS based DoS vulnerability in Active Support's underscore
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-22796). Fix: Update that package to its patched version.
• Minor GHSA-6wx8-w4f5-wwcr Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54906). Fix: Update that package to its patched version.
• Minor GHSA-28hh-pr2h-2w89 sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
  /workdirs/scan-64c52d52-5b42-481d-aa26-1881f14ba742/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54619). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0