gitsafehub
github.com/jupyterlab/jupyter-collaboration ↗

jupyterlab/jupyter-collaboration

scanned 2026-08-01 · git 6611454
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 3 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies37Known OSS vulnerabilities139Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 400s

Vulnerable dependencies — Trivyⓘ 37 found · 1 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44728 Babel is a compiler for writing next generation JavaScript. From 7.12. ...
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-14257 brace-expansion through 5.0.7 is vulnerable to denial of service via m ...
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-14257 brace-expansion through 5.0.7 is vulnerable to denial of service via m ...
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49458 dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-49458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49459 dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-49459). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-49978). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65898 DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when ...
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-65898). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65902 DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct refe ...
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-65902). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13676 fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-16221 Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-6321 fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-6321). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-6322 fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-6322). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-12143 form-data: form-data: Form field override via CRLF injection
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-12143). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59869 js-yaml: js-yaml: Denial of Service via crafted YAML documents
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-59869). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53550 js-yaml: js-yaml: Denial of Service via crafted YAML merge keys
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-53550). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
    yarn.lock
    A package you depend on has a known security hole (GHSA-r28c-9q8g-f849). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-59874). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53655 node-tar: node-tar: File smuggling due to inconsistent tar archive parsing
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-53655). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59871 node-tar: node-tar: Denial of Service due to incorrect PAX path handling
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-59871). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59875 node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-59875). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r292-9mhp-454m node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
    yarn.lock
    A package you depend on has a known security hole (GHSA-r292-9mhp-454m). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-12151 undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-12151). Fix: Update that package to its patched version.
… 12 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 139 found · 4 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/yarn.lock
    A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-65898). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4c8g-83qw-93j6 fast-uri vulnerable to host confusion via failed IDN canonicalization
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
  • Worth fixing GHSA-q3j6-qgpj-74h6 fast-uri vulnerable to path traversal via percent-encoded dot segments
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-6321). Fix: Update that package to its patched version.
  • Worth fixing GHSA-v2hh-gcrm-f6hx fast-uri vulnerable to host confusion via literal backslash authority delimiter
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
  • Worth fixing GHSA-v39h-62p7-jpjc fast-uri vulnerable to host confusion via percent-encoded authority delimiters
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-6322). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hmw2-7cc7-3qxx form-data: CRLF injection in form-data via unescaped multipart field names and filenames
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-12143). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5j98-mcp5-4vw2 glob CLI: Command injection via -c/--cmd executes matches with shell:true
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2025-64756). Fix: Update that package to its patched version.
  • Worth fixing GHSA-v2v4-37r5-5v8g ip-address has XSS in Address6 HTML-emitting methods
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-42338). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2025-13465). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2021-23337). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2025-13465). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2021-23337). Fix: Update that package to its patched version.
  • Worth fixing GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mwcw-c2x4-8c55 Predictable results in nanoid generation when given non-integer values
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2024-55565). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
    /workdirs/scan-a5fe5d97-1ee8-4856-aa36-bbef1186cc18/ui-tests/yarn.lock
    A package you depend on has a known security hole (CVE-2026-45623). Fix: Update that package to its patched version.
… 114 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.