gitsafehub
github.com/hpneo/webpacker-preact ↗

hpneo/webpacker-preact

scanned 2026-08-12 · git dd1aabd
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies257Known OSS vulnerabilities307Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 257 found · 20 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2022-32224 activerecord: Possible RCE escalation bug with Serialized Columns in Active Record
    Gemfile.lock
    A package you depend on has a known security hole (CVE-2022-32224). Fix: Update that package to its patched version.
  • Serious CVE-2022-21831 rubygem-activestorage: Code injection vulnerability in ActiveStorage
    Gemfile.lock
    A package you depend on has a known security hole (CVE-2022-21831). Fix: Update that package to its patched version.
  • Serious CVE-2026-33195 Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
    Gemfile.lock
    A package you depend on has a known security hole (CVE-2026-33195). Fix: Update that package to its patched version.
  • Serious CVE-2026-33202 rails: Active Storage: Unintended file deletion via crafted blob keys
    Gemfile.lock
    A package you depend on has a known security hole (CVE-2026-33202). Fix: Update that package to its patched version.
  • Serious CVE-2026-54906 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Synchronization flaw in ReadWriteLock allows unauthorized lock release and denial of service
    Gemfile.lock
    A package you depend on has a known security hole (CVE-2026-54906). Fix: Update that package to its patched version.
  • Serious GHSA-353f-x4gh-cqq8 Nokogiri patches vendored libxml2 to resolve multiple CVEs
    Gemfile.lock
    A package you depend on has a known security hole (GHSA-353f-x4gh-cqq8). Fix: Update that package to its patched version.
  • Serious CVE-2022-30123 rubygem-rack: crafted requests can cause shell escape sequences
    Gemfile.lock
    A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
  • Serious CVE-2023-45133 babel: arbitrary code execution
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious CVE-2025-9287 cipher-base: Cipher-base hash manipulation
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2025-9287). Fix: Update that package to its patched version.
  • Serious GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
    test/dummy/yarn.lock
    A package you depend on has a known security hole (GHSA-vjh7-7g9h-fjfh). Fix: Update that package to its patched version.
  • Serious CVE-2025-7783 form-data: Unsafe random function in form-data
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
  • Serious CVE-2021-3918 nodejs-json-schema: Prototype pollution vulnerability
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2021-3918). Fix: Update that package to its patched version.
  • Serious CVE-2022-37601 loader-utils: prototype pollution in function parseQuery in parseQuery.js
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2022-37601). Fix: Update that package to its patched version.
  • Serious CVE-2022-37601 loader-utils: prototype pollution in function parseQuery in parseQuery.js
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2022-37601). Fix: Update that package to its patched version.
  • Serious CVE-2021-44906 minimist: prototype pollution
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
  • Serious CVE-2025-6545 pbkdf2: pbkdf2 silently returns predictable key material
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2025-6545). Fix: Update that package to its patched version.
  • Serious CVE-2025-6547 pbkdf2: pbkdf2 silently returns static keys
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2025-6547). Fix: Update that package to its patched version.
  • Serious CVE-2025-9288 sha.js: Missing type checks leading to hash rewind and passing on crafted data
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2025-9288). Fix: Update that package to its patched version.
  • Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
    test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-22885 rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack
    Gemfile.lock
    A package you depend on has a known security hole (CVE-2021-22885). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-22902 rails: Possible Denial of Service vulnerability in Action Dispatch
    Gemfile.lock
    A package you depend on has a known security hole (CVE-2021-22902). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-22904 rails: Possible DoS Vulnerability in Action Controller Token Authentication
    Gemfile.lock
    A package you depend on has a known security hole (CVE-2021-22904). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-22942 rubygem-actionpack: possible open redirect in the Host Authorization middleware
    Gemfile.lock
    A package you depend on has a known security hole (CVE-2021-22942). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-23633 rubygem-actionpack: information leak between requests
    Gemfile.lock
    A package you depend on has a known security hole (CVE-2022-23633). Fix: Update that package to its patched version.
… 232 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 307 found · 22 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-3hhc-qp5v-9p2j Active Record RCE bug with Serialized Columns
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/Gemfile.lock
    A package you depend on has a known security hole (CVE-2022-32224). Fix: Update that package to its patched version.
  • Serious GHSA-r4mg-4433-c7g3 Active Storage allowed transformation methods that were potentially unsafe
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/Gemfile.lock
    A package you depend on has a known security hole (CVE-2025-24293). Fix: Update that package to its patched version.
  • Serious GHSA-w749-p3v6-hccq Possible code injection vulnerability in Rails / Active Storage
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/Gemfile.lock
    A package you depend on has a known security hole (CVE-2022-21831). Fix: Update that package to its patched version.
  • Serious GHSA-xr9x-r78c-5hrm Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/Gemfile.lock
    A package you depend on has a known security hole (CVE-2026-66066). Fix: Update that package to its patched version.
  • Serious GHSA-353f-x4gh-cqq8 Nokogiri patches vendored libxml2 to resolve multiple CVEs
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/Gemfile.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Serious GHSA-wq4h-7r42-5hrr Possible shell escape sequence injection vulnerability in Rack
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/Gemfile.lock
    A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
  • Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious GHSA-cpq7-6gpm-g9rc cipher-base is missing type checks, leading to hash rewind and passing on crafted data
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2025-9287). Fix: Update that package to its patched version.
  • Serious GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Serious GHSA-6h5x-7c5m-7cr7 Exposure of Sensitive Information in eventsource
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2022-1650). Fix: Update that package to its patched version.
  • Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
  • Serious GHSA-896r-f27r-55mw json-schema is vulnerable to Prototype Pollution
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2021-3918). Fix: Update that package to its patched version.
  • Serious GHSA-76p3-8jx3-jpfq Prototype pollution in webpack loader-utils
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2022-37601). Fix: Update that package to its patched version.
  • Serious GHSA-76p3-8jx3-jpfq Prototype pollution in webpack loader-utils
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2022-37601). Fix: Update that package to its patched version.
  • Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
  • Serious GHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2025-6545). Fix: Update that package to its patched version.
  • Serious GHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keys
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2025-6547). Fix: Update that package to its patched version.
  • Serious GHSA-95m3-7q98-8xr5 sha.js is missing type checks leading to hash rewind and passing on crafted data
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2025-9288). Fix: Update that package to its patched version.
  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious GHSA-hgjh-723h-mx2j Authorization Bypass Through User-Controlled Key in url-parse
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2022-0686). Fix: Update that package to its patched version.
  • Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/test/dummy/yarn.lock
    A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
  • Worth fixing GHSA-h47h-mwp9-c6q6 Possible ReDoS vulnerability in block_format in Action Mailer
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/Gemfile.lock
    A package you depend on has a known security hole (CVE-2024-47889). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2rqw-v265-jf8c Open Redirect in ActionPack
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/Gemfile.lock
    A package you depend on has a known security hole (CVE-2021-22942). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4g8v-vg43-wpgf Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
    /workdirs/scan-4b868142-899b-47f7-b6b9-49c560fa90fc/Gemfile.lock
    A package you depend on has a known security hole (CVE-2023-28362). Fix: Update that package to its patched version.
… 282 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.