gitsafehub
github.com/jnmetacode/guidance ↗

jnmetacode/guidance

scanned 2026-08-06 · git 3de632c
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies38Known OSS vulnerabilities153Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 38 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2026-34601 xmldom: xmldom: XML structure injection via CDATA terminator
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-34601). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41672 xmldom: @xmldom/xmldom: xmldom: Arbitrary XML Node Injection
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41672). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41673 @xmldom/xmldom: xmldom: xmldom: Denial of Service via deeply nested XML documents
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41673). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41674 xmldom: xmldom: Arbitrary XML markup injection
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41674). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41675 xmldom: xmldom: Arbitrary XML node injection via crafted processing instructions
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41675). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-15599 DOMPurify: DOMPurify: Cross-site scripting
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2025-15599). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-0540 DOMPurify: DOMPurify: Cross-site scripting vulnerability
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-0540). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41238 DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41238). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41239 DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41239). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41240 DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41240). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49458 dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49459 dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49459). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49978). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65898 DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when ...
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65898). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65902 DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct refe ...
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65902). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65903 dompurify: DOMPurify: Security bypass allows injection of malicious content
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65903). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65912 DOMPurify before 3.3.2 contains a URI validation bypass vulnerability ...
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65912). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65913 DOMPurify before 3.3.2 contains a prototype pollution vulnerability in ...
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65913). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65914 DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sani ...
    client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65914). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
    packages/python/stitch/yarn.lock
    A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13676 fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
    packages/python/stitch/yarn.lock
    A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-16221 Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...
    packages/python/stitch/yarn.lock
    A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-18446 fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority
    packages/python/stitch/yarn.lock
    A package you depend on has a known security hole (CVE-2026-18446). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-6321 fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies
    packages/python/stitch/yarn.lock
    A package you depend on has a known security hole (CVE-2026-6321). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-6322 fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
    packages/python/stitch/yarn.lock
    A package you depend on has a known security hole (CVE-2026-6322). Fix: Update that package to its patched version.
… 13 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 153 found · 4 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/packages/python/stitch/yarn.lock
    A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
  • Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/packages/python/stitch/yarn.lock
    A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/packages/python/stitch/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2v35-w6hq-6mfw xmldom: Uncontrolled recursion in XML serialization leads to DoS
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41673). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f6ww-3ggp-fr8h xmldom has XML injection through unvalidated DocumentType serialization
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41674). Fix: Update that package to its patched version.
  • Worth fixing GHSA-j759-j44w-7fr8 xmldom has XML node injection through unvalidated comment serialization
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41672). Fix: Update that package to its patched version.
  • Worth fixing GHSA-wh4c-j3r5-mjhp xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-34601). Fix: Update that package to its patched version.
  • Worth fixing GHSA-x6wf-f3px-wcqx xmldom has XML node injection through unvalidated processing instruction serialization
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41675). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing GHSA-39q2-94rc-95cp DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65903). Fix: Update that package to its patched version.
  • Worth fixing GHSA-76mc-f452-cxcm DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65902). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cj63-jhhr-wcxv DOMPurify USE_PROFILES prototype pollution allows event handlers
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65913). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cjmm-f4jc-qw8r DOMPurify ADD_ATTR predicate skips URI validation
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65912). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65898). Fix: Update that package to its patched version.
  • Worth fixing GHSA-crv5-9vww-q3g8 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41239). Fix: Update that package to its patched version.
  • Worth fixing GHSA-h7mw-gpvr-xq4m DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41240). Fix: Update that package to its patched version.
  • Worth fixing GHSA-h8r8-wccr-v5f2 DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
    /workdirs/scan-b93ee272-bd25-4e3d-9791-a2a2e305ea4d/client/graphpaper-inline/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65914). Fix: Update that package to its patched version.
… 128 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.