gitsafehub
github.com/iamdarkle/flarum-affiliator ↗

iamdarkle/flarum-affiliator

scanned 2026-08-12 · git 9a6f9a9
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies73Known OSS vulnerabilities72Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 73 found · 5 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2024-51736 CVE-2024-51736: Command execution hijack on Windows with Process class
    composer.lock
    A package you depend on has a known security hole (CVE-2024-51736). Fix: Update that package to its patched version.
  • Serious CVE-2023-45133 babel: arbitrary code execution
    js/package-lock.json
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious CVE-2023-28154 webpack: avoid cross-realm objects
    js/package-lock.json
    A package you depend on has a known security hole (CVE-2023-28154). Fix: Update that package to its patched version.
  • Serious CVE-2023-45133 babel: arbitrary code execution
    js/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious CVE-2023-28154 webpack: avoid cross-realm objects
    js/yarn.lock
    A package you depend on has a known security hole (CVE-2023-28154). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-40033 Flarum vulnerable to LFI and Blind SSRF via Avatar upload
    composer.lock
    A package you depend on has a known security hole (CVE-2023-40033). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-22488 Flarum notifications can leak restricted content
    composer.lock
    A package you depend on has a known security hole (CVE-2023-22488). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-27577 Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files
    composer.lock
    A package you depend on has a known security hole (CVE-2023-27577). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-21641 Flarum's logout Route allows open redirects
    composer.lock
    A package you depend on has a known security hole (CVE-2024-21641). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27794 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite
    composer.lock
    A package you depend on has a known security hole (CVE-2025-27794). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41887 Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
    composer.lock
    A package you depend on has a known security hole (CVE-2026-41887). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-24775 guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8 ...
    composer.lock
    A package you depend on has a known security hole (CVE-2022-24775). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-29197 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...
    composer.lock
    A package you depend on has a known security hole (CVE-2023-29197). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-48998 guzzlehttp/psr7: guzzlehttp/psr7: Information disclosure via improper Host header validation
    composer.lock
    A package you depend on has a known security hole (CVE-2026-48998). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49214 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...
    composer.lock
    A package you depend on has a known security hole (CVE-2026-49214). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55766 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...
    composer.lock
    A package you depend on has a known security hole (CVE-2026-55766). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59882 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...
    composer.lock
    A package you depend on has a known security hole (CVE-2026-59882). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-29530 HTTP Multiline Header Termination
    composer.lock
    A package you depend on has a known security hole (CVE-2023-29530). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-31109 Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack.
    composer.lock
    A package you depend on has a known security hole (CVE-2022-31109). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-71488 league/commonmark is a PHP library for parsing and rendering CommonMar ...
    composer.lock
    A package you depend on has a known security hole (CVE-2026-71488). Fix: Update that package to its patched version.
  • Worth fixing GHSA-c2pc-g5qf-rfrf league/commonmark's quadratic complexity bugs may lead to a denial of service
    composer.lock
    A package you depend on has a known security hole (GHSA-c2pc-g5qf-rfrf). Fix: Update that package to its patched version.
  • Worth fixing GHSA-g2gp-3wwq-f4ph league/commonmark: Denial of service via adjacent inline attribute blocks
    composer.lock
    A package you depend on has a known security hole (GHSA-g2gp-3wwq-f4ph). Fix: Update that package to its patched version.
  • Worth fixing GHSA-jfm3-95jq-q3rf league/commonmark: Denial of service via duplicate footnote definitions
    composer.lock
    A package you depend on has a known security hole (GHSA-jfm3-95jq-q3rf). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-46734 league/commonmark is a PHP Markdown parser. A cross-site scripting (XS ...
    composer.lock
    A package you depend on has a known security hole (CVE-2025-46734). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-71478 league/commonmark is a PHP library for parsing and rendering CommonMar ...
    composer.lock
    A package you depend on has a known security hole (CVE-2026-71478). Fix: Update that package to its patched version.
… 48 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 72 found · 4 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/js/package-lock.json
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious GHSA-hc6q-2mpp-qw7j Cross-realm object access in Webpack 5
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/js/package-lock.json
    A package you depend on has a known security hole (CVE-2023-28154). Fix: Update that package to its patched version.
  • Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/js/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious GHSA-hc6q-2mpp-qw7j Cross-realm object access in Webpack 5
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/js/yarn.lock
    A package you depend on has a known security hole (CVE-2023-28154). Fix: Update that package to its patched version.
  • Worth fixing GHSA-67c6-q4j4-hccg Flarum vulnerable to LFI and Blind SSRF via Avatar upload
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2023-40033). Fix: Update that package to its patched version.
  • Worth fixing GHSA-733r-8xcp-w9mr Flarum's logout Route allows open redirects
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2024-21641). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8gcg-vwmw-rxj4 Flarum notifications can leak restricted content
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2023-22488). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hg9j-64wp-m9px Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2025-27794). Fix: Update that package to its patched version.
  • Worth fixing GHSA-vhm8-wwrf-3gcw Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2023-27577). Fix: Update that package to its patched version.
  • Worth fixing GHSA-xjvc-pw2r-6878 Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2026-41887). Fix: Update that package to its patched version.
  • Worth fixing GHSA-34xg-wgjx-8xph guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2026-48998). Fix: Update that package to its patched version.
  • Worth fixing GHSA-c2w2-prh8-qm98 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2026-59882). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hq7v-mx3g-29hw guzzlehttp/psr7 has CRLF Injection via URI Host Component
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2026-49214). Fix: Update that package to its patched version.
  • Worth fixing GHSA-q7rv-6hp3-vh96 Improper Input Validation in guzzlehttp/psr7
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2022-24775). Fix: Update that package to its patched version.
  • Worth fixing GHSA-vm85-hxw5-5432 guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2026-55766). Fix: Update that package to its patched version.
  • Worth fixing GHSA-wxmh-65f7-jcvw Improper header name validation in guzzlehttp/psr7
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2023-29197). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8274-h5jp-97vr Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2022-31109). Fix: Update that package to its patched version.
  • Worth fixing GHSA-xv3h-4844-9h36 HTTP Multiline Header Termination
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2023-29530). Fix: Update that package to its patched version.
  • Worth fixing GHSA-29pj-957v-52mc league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2026-71478). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2q4p-g7hv-5rgv league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2026-71488). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3527-qv2q-pfvx league/commonmark contains a XSS vulnerability in Attributes extension
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2025-46734). Fix: Update that package to its patched version.
  • Worth fixing GHSA-c2pc-g5qf-rfrf league/commonmark's quadratic complexity bugs may lead to a denial of service
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-g2gp-3wwq-f4ph league/commonmark: Denial of service via adjacent inline attribute blocks
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-jfm3-95jq-q3rf league/commonmark: Denial of service via duplicate footnote definitions
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-j3f9-p6hm-5w6q Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale
    /workdirs/scan-e7dde55a-fe72-4044-aa35-69ad33070ae0/composer.lock
    A package you depend on has a known security hole (CVE-2025-22145). Fix: Update that package to its patched version.
… 47 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.