jupyterlab/jupyter-renderers

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  packages/geojson-extension/ui-tests/tests/jupyterlab_geojson.spec.ts:72
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  notebooks/geojson-extension.ipynb:95
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  notebooks/geojson-extension.ipynb:95
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  notebooks/geojson-extension.ipynb:95
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  notebooks/geojson-extension.ipynb:95
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2025-7783 form-data: Unsafe random function in form-data
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-3807 nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes
  yarn.lock
  A package you depend on has a known security hole (CVE-2021-3807). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45590 body-parser: Denial of Service Vulnerability in body-parser
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-45590). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45590 body-parser: Denial of Service Vulnerability in body-parser
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-45590). Fix: Update that package to its patched version.
• Worth fixing GHSA-36jr-mh4h-2g58 d3-color vulnerable to ReDoS
  yarn.lock
  A package you depend on has a known security hole (GHSA-36jr-mh4h-2g58). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-29041 express: cause malformed URLs to be evaluated
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-29041). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-12143 form-data: form-data: Form field override via CRLF injection
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-12143). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-65945 node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-65945). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-28243 KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX ...
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-28243). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-28245 KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX ...
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-28245). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-28246 KaTeX is a JavaScript library for TeX math rendering on the web. Code ...
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-28246). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-23207 katex: \htmlData does not validate attribute names in KaTeX
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-23207). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-4800). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-13465 lodash: prototype pollution in _.unset and _.omit functions
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-13465). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-2950 lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-2950). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-4800). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-13465 lodash: prototype pollution in _.unset and _.omit functions
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-13465). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-2950 lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-2950). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45296 path-to-regexp: Backtracking regular expressions cause ReDoS
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-45296). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-52798 path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-52798). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-4867 path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-4867). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type Confusion
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2026-33937). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/requirements.txt
  A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1691 nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/requirements.txt
  A package you depend on has a known security hole (CVE-2025-53000). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2229 The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intende
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/requirements.txt
  A package you depend on has a known security hole (CVE-2026-39377). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2230 The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markd
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/requirements.txt
  A package you depend on has a known security hole (CVE-2026-39378). Fix: Update that package to its patched version.
• Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
• Worth fixing GHSA-h5c3-5r3r-rr8q @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25288). Fix: Update that package to its patched version.
• Worth fixing GHSA-rmvr-2pp2-xj38 @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25290). Fix: Update that package to its patched version.
• Worth fixing GHSA-xx4v-prfh-6cgc @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2025-25289). Fix: Update that package to its patched version.
• Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing GHSA-93q8-gq69-wqmw Inefficient Regular Expression Complexity in chalk/ansi-regex
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2021-3807). Fix: Update that package to its patched version.
• Worth fixing GHSA-35jp-ww65-95wh axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2026-44494). Fix: Update that package to its patched version.
• Worth fixing GHSA-3g43-6gmg-66jw axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2026-44495). Fix: Update that package to its patched version.
• Worth fixing GHSA-3p68-rc4w-qgx5 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2025-62718). Fix: Update that package to its patched version.
• Worth fixing GHSA-3w6x-2g7m-8v23 Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2026-42044). Fix: Update that package to its patched version.
• Worth fixing GHSA-42h9-826w-cgv3 Axios: Excessive recursion in formDataToJSON can cause denial of service
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2026-67313). Fix: Update that package to its patched version.
• Worth fixing GHSA-43fc-jf86-j433 Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2026-25639). Fix: Update that package to its patched version.
• Worth fixing GHSA-445q-vr5w-6q77 Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2026-42037). Fix: Update that package to its patched version.
• Worth fixing GHSA-4hjh-wcwx-xvwj Axios is vulnerable to DoS attack through lack of data size check
  /workdirs/scan-02dcbed0-4cd8-4606-8713-0039f9b5956d/yarn.lock
  A package you depend on has a known security hole (CVE-2025-58754). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:ERROR: Error while scanning. Received HTTPSConnectionPool(host='registry.npmjs.org', port=443): Max retries exceeded wit; pypi:timeout