gitsafehub
github.com/jayvdb/cargo-deny ↗

jayvdb/cargo-deny

scanned 2026-08-13 · git 2e99eda
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies130Known OSS vulnerabilities287Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 130 found · 1 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2021-25900 An issue was discovered in the smallvec crate before 0.6.14 and 1.x be ...
    examples/09_bans/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-25900). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25541 Bytes is a utility library for working with bytes. From version 1.2.1 ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-25541). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-4574 crossbeam-channel: crossbeam-channel Vulnerable to Double Free on Drop
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-4574). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-40034 gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0 ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-40034). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fr8x-3vfx-f45h gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository
    Cargo.lock
    A package you depend on has a known security hole (GHSA-fr8x-3vfx-f45h). Fix: Update that package to its patched version.
  • Worth fixing GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure
    Cargo.lock
    A package you depend on has a known security hole (GHSA-p3hw-mv63-rf9w). Fix: Update that package to its patched version.
  • Worth fixing GHSA-pg4w-g64p-qwhj gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository
    Cargo.lock
    A package you depend on has a known security hole (GHSA-pg4w-g64p-qwhj). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-0810 gix-date: gix-date: Undefined behavior due to invalid string generation
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-0810). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44471 gitoxide is an implementation of git written in Rust. Prior to 0.21.1, ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-44471). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing GHSA-x494-mj8g-cj27 gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data
    Cargo.lock
    A package you depend on has a known security hole (GHSA-x494-mj8g-cj27). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-31130 gitoxide is an implementation of git written in Rust. Before 0.42.0, g ...
    Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
… 105 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 287 found · 7 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious RUSTSEC-2019-0036 Type confusion if __private_get_type_id__ is overridden
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/examples/06_advisories/Cargo.lock
    A package you depend on has a known security hole (CVE-2019-25010). Fix: Update that package to its patched version.
  • Serious RUSTSEC-2021-0079 Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/examples/07_deny_sources/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-32714). Fix: Update that package to its patched version.
  • Serious RUSTSEC-2021-0079 Integer overflow in `hyper`'s parsing of the `Transfer-Encoding` header leads to data loss
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/examples/09_bans/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-32714). Fix: Update that package to its patched version.
  • Serious RUSTSEC-2021-0003 Buffer overflow in SmallVec::insert_many
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/examples/09_bans/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-25900). Fix: Update that package to its patched version.
  • Serious RUSTSEC-2020-0027 traitobject assumes the layout of fat pointers
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/tests/test_data/features-galore/Cargo.lock
    A package you depend on has a known security hole (CVE-2020-35881). Fix: Update that package to its patched version.
  • Serious RUSTSEC-2021-0095 `mopa` is technically unsound
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/tests/test_data/sources/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-45695). Fix: Update that package to its patched version.
  • Serious RUSTSEC-2021-0070 VecStorage Deserialize Allows Violation of Length Invariant
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/tests/test_data/sources/Cargo.lock
    A package you depend on has a known security hole (CVE-2021-38190). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0007 Integer overflow in `BytesMut::reserve`
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-25541). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2025-0024 crossbeam-channel: double free on Drop
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-4574). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2frx-2596-x5r6 gitoxide does not detect SHA-1 collision attacks
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f26g-jm89-4g65 gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-40034). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fr8x-3vfx-f45h gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-pg4w-g64p-qwhj gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-2frx-2596-x5r6 gitoxide does not detect SHA-1 collision attacks
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2frx-2596-x5r6 gitoxide does not detect SHA-1 collision attacks
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2025-0140 Non-utf8 String can be created with `TimeBuf::as_str`
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-0810). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2frx-2596-x5r6 gitoxide does not detect SHA-1 collision attacks
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2frx-2596-x5r6 gitoxide does not detect SHA-1 collision attacks
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2025-0021 SHA-1 collision attacks are not detected
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2frx-2596-x5r6 gitoxide does not detect SHA-1 collision attacks
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f89h-2fjh-2r9q gix-fs: Symlink prefix-reuse allows worktree escape during checkout
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-44471). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2frx-2596-x5r6 gitoxide does not detect SHA-1 collision attacks
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2frx-2596-x5r6 gitoxide does not detect SHA-1 collision attacks
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2frx-2596-x5r6 gitoxide does not detect SHA-1 collision attacks
    /workdirs/scan-2fdbf093-351c-4946-a692-3cecf9a5249b/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-31130). Fix: Update that package to its patched version.
… 262 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.