gitsafehub
github.com/freecodecamp/curriculumexpansion ↗

freecodecamp/curriculumexpansion

scanned 2026-08-15 · git b4b8d90
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies128Known OSS vulnerabilities302Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 128 found · 12 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2020-7610 bson: Deserialization of Untrusted Data could result in Code injection or Excessive CPU load
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2020-7610). Fix: Update that package to its patched version.
  • Serious CVE-2019-17426 Improper Input Validation in Automattic Mongoose
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2019-17426). Fix: Update that package to its patched version.
  • Serious CVE-2023-3696 Mongoose Prototype Pollution vulnerability
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2023-3696). Fix: Update that package to its patched version.
  • Serious CVE-2025-23061 Mongoose search injection vulnerability
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2025-23061). Fix: Update that package to its patched version.
  • Serious CVE-2022-29078 ejs: server-side template injection in outputFunctionName
    information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2022-29078). Fix: Update that package to its patched version.
  • Serious CVE-2022-2421 Insufficient validation when decoding a Socket.IO packet
    information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2022-2421). Fix: Update that package to its patched version.
  • Serious CVE-2020-28502 nodejs-xmlhttprequest: Code injection through user input to xhr.send
    information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2020-28502). Fix: Update that package to its patched version.
  • Serious CVE-2021-31597 xmlhttprequest-ssl: SSL certificate validation disabled by default
    information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2021-31597). Fix: Update that package to its patched version.
  • Serious CVE-2022-29078 ejs: server-side template injection in outputFunctionName
    information-security/learn-websockets-by-building-a-chat-room/package-lock.json
    A package you depend on has a known security hole (CVE-2022-29078). Fix: Update that package to its patched version.
  • Serious CVE-2022-2421 Insufficient validation when decoding a Socket.IO packet
    information-security/learn-websockets-by-building-a-chat-room/package-lock.json
    A package you depend on has a known security hole (CVE-2022-2421). Fix: Update that package to its patched version.
  • Serious CVE-2020-28502 nodejs-xmlhttprequest: Code injection through user input to xhr.send
    information-security/learn-websockets-by-building-a-chat-room/package-lock.json
    A package you depend on has a known security hole (CVE-2020-28502). Fix: Update that package to its patched version.
  • Serious CVE-2021-31597 xmlhttprequest-ssl: SSL certificate validation disabled by default
    information-security/learn-websockets-by-building-a-chat-room/package-lock.json
    A package you depend on has a known security hole (CVE-2021-31597). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-4867 path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters
    back-end-development-and-apis/learn-error-handling-in-express-by-building-a-piggy-bank/package-lock.json
    A package you depend on has a known security hole (CVE-2026-4867). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-8723 ### Summary `qs.stringify` throws `TypeError` when called with `arr ...
    back-end-development-and-apis/learn-error-handling-in-express-by-building-a-piggy-bank/package-lock.json
    A package you depend on has a known security hole (CVE-2026-8723). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-4926 path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions
    back-end-development-and-apis/learn-error-handling-in-express-by-building-a-tiny-bank-api/package-lock.json
    A package you depend on has a known security hole (CVE-2026-4926). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-4923 path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards
    back-end-development-and-apis/learn-error-handling-in-express-by-building-a-tiny-bank-api/package-lock.json
    A package you depend on has a known security hole (CVE-2026-4923). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-8723 ### Summary `qs.stringify` throws `TypeError` when called with `arr ...
    back-end-development-and-apis/learn-error-handling-in-express-by-building-a-tiny-bank-api/package-lock.json
    A package you depend on has a known security hole (CVE-2026-8723). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-43138 async: Prototype Pollution in async
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2021-43138). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-45590 body-parser: Denial of Service Vulnerability in body-parser
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2024-45590). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-2391 Incorrect parsing of certain JSON input may result in js-bson not corr ...
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2019-2391). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-29041 express: cause malformed URLs to be evaluated
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2024-29041). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep function
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2020-8203). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-23337 nodejs-lodash: command injection via template
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2021-23337). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2026-4800). Fix: Update that package to its patched version.
  • Worth fixing NSWG-ECO-516 Allocation of Resources Without Limits or Throttling
    back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (NSWG-ECO-516). Fix: Update that package to its patched version.
… 103 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 302 found · 23 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-v8w9-2789-6hhr Deserialization of Untrusted Data in bson
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2020-7610). Fix: Update that package to its patched version.
  • Serious GHSA-8687-vv9j-hgph Improper Input Validation in Automattic Mongoose
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2019-17426). Fix: Update that package to its patched version.
  • Serious GHSA-9m93-w8w6-76hh Mongoose Prototype Pollution vulnerability
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2023-3696). Fix: Update that package to its patched version.
  • Serious GHSA-h8hf-x3f4-xwgp Mongoose Vulnerable to Prototype Pollution in Schema Object
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2022-24304). Fix: Update that package to its patched version.
  • Serious GHSA-m7xq-9374-9rvx Mongoose search injection vulnerability
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2024-53900). Fix: Update that package to its patched version.
  • Serious GHSA-vg7j-7cwx-8wgw Mongoose search injection vulnerability
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/back-end-development-and-apis/learn-mongodb-by-building-a-movie-review-database/package-lock.json
    A package you depend on has a known security hole (CVE-2025-23061). Fix: Update that package to its patched version.
  • Serious GHSA-jf85-cpcp-j695 Prototype Pollution in lodash
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/front-end-libraries/learn-typescript-by-building-a-poker-game/package-lock.json
    A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
  • Serious GHSA-jf85-cpcp-j695 Prototype Pollution in lodash
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/front-end-libraries/learn-typescript-by-building-a-poker-game/package-lock.json
    A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
  • Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/front-end-libraries/learn-typescript-by-building-a-poker-game/package-lock.json
    A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
  • Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/front-end-libraries/learn-typescript-by-building-a-poker-game/package-lock.json
    A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
  • Serious GHSA-phwq-j96m-2c2q ejs template injection vulnerability
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2022-29078). Fix: Update that package to its patched version.
  • Serious MAL-2023-462 Malicious code in fsevents (npm)
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Serious GHSA-8r6j-v8pm-fqw3 Code injection in fsevents
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2023-45311). Fix: Update that package to its patched version.
  • Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
  • Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
  • Serious GHSA-qm95-pgcg-qqfq Insufficient validation when decoding a Socket.IO packet
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2022-2421). Fix: Update that package to its patched version.
  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious GHSA-72mh-269x-7mh5 Improper Certificate Validation in xmlhttprequest-ssl
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2021-31597). Fix: Update that package to its patched version.
  • Serious GHSA-h4j5-c7cj-74xg xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room-2/package-lock.json
    A package you depend on has a known security hole (CVE-2020-28502). Fix: Update that package to its patched version.
  • Serious GHSA-phwq-j96m-2c2q ejs template injection vulnerability
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room/package-lock.json
    A package you depend on has a known security hole (CVE-2022-29078). Fix: Update that package to its patched version.
  • Serious GHSA-qm95-pgcg-qqfq Insufficient validation when decoding a Socket.IO packet
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room/package-lock.json
    A package you depend on has a known security hole (CVE-2022-2421). Fix: Update that package to its patched version.
  • Serious GHSA-72mh-269x-7mh5 Improper Certificate Validation in xmlhttprequest-ssl
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room/package-lock.json
    A package you depend on has a known security hole (CVE-2021-31597). Fix: Update that package to its patched version.
  • Serious GHSA-h4j5-c7cj-74xg xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/information-security/learn-websockets-by-building-a-chat-room/package-lock.json
    A package you depend on has a known security hole (CVE-2020-28502). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/back-end-development-and-apis/learn-authentication-and-authorization-by-bulding-a-family-movie-watchlist-api/final/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-d0d154e1-7fc4-4759-b2a8-127b5986d1d7/back-end-development-and-apis/learn-authentication-and-authorization-by-bulding-a-family-movie-watchlist-api/final/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
… 277 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.