gitsafehub
github.com/josephmisiti/generic-django-project-heroku ↗

josephmisiti/generic-django-project-heroku

scanned 2026-08-15 · git d4ffb8f
1 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies✓Known OSS vulnerabilities33Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 33 found · 3 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious GHSA-hmr4-m2h5-33qx SQL injection in Django
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-64 django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was late
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2020-15225). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-263 A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come f
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2020-25626). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1304 Cross-site Scripting in djangorestframework
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2024-21520). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2015-11 The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2015-8213). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2015-22 contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2015-5963). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2015-23 The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sess
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2015-5964). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-15 The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cro
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2016-2512). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-2 Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2016-6186). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2016-3 The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting a
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2016-7401). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-98 Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the exist
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2021-33203). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1297 Django allows enumeration of user e-mail addresses
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6w2r-r2m5-xq5w Django is subject to SQL injection through its column aliases
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7xr5-9hcq-chf9 Django Improper Output Neutralization for Logs vulnerability
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2025-48432). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8qcx-xf44-272x Django: DomainNameValidator permits newline characters that may enable HTTP header injection
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2026-53878). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8x94-hmjh-97hq Django vulnerable to Reflected File Download attack
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2022-36359). Fix: Update that package to its patched version.
  • Worth fixing GHSA-crhf-3pfg-w68w Django: GDALRaster may over-read heap memory when constructed from bytes
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2026-53877). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qw25-v68c-qjf3 Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64458). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2025-183 pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2025-45768). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-120 PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array li
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2026-32597). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-175 PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector register
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48522). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-176 PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. T
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48523). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-178 PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decod
    /workdirs/scan-6c03d240-661c-48fe-8692-5588af491a23/{{cookiecutter.repo_name}}/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48525). Fix: Update that package to its patched version.
… 8 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.