lheagy/voila

scanned 2026-08-13 · git 2bed7b3

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies66Known OSS vulnerabilities1Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 66 found · 4 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2019-10744 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties

js/package-lock.json

A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
Serious CVE-2021-44906 minimist: prototype pollution

js/package-lock.json

A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
Serious CVE-2021-23358 nodejs-underscore: Arbitrary code execution via the template function

js/package-lock.json

A package you depend on has a known security hole (CVE-2021-23358). Fix: Update that package to its patched version.
Serious CVE-2022-0686 npm-url-parse: Authorization bypass through user-controlled key

js/package-lock.json

A package you depend on has a known security hole (CVE-2022-0686). Fix: Update that package to its patched version.
Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups

js/package-lock.json

A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
Worth fixing CVE-2020-15366 nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

js/package-lock.json

A package you depend on has a known security hole (CVE-2020-15366). Fix: Update that package to its patched version.
Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference

js/package-lock.json

A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
Worth fixing CVE-2020-15366 nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

js/package-lock.json

A package you depend on has a known security hole (CVE-2020-15366). Fix: Update that package to its patched version.
Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference

js/package-lock.json

A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
Worth fixing CVE-2020-15366 nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

js/package-lock.json

A package you depend on has a known security hole (CVE-2020-15366). Fix: Update that package to its patched version.
Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference

js/package-lock.json

A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
Worth fixing CVE-2021-3377 nodejs-ansi_up: XSS due to insufficient URL sanitization

js/package-lock.json

A package you depend on has a known security hole (CVE-2021-3377). Fix: Update that package to its patched version.
Worth fixing CVE-2020-7760 codemirror: ReDoS in tokenBase function in javascript.js

js/package-lock.json

A package you depend on has a known security hole (CVE-2020-7760). Fix: Update that package to its patched version.
Worth fixing CVE-2020-7760 codemirror: ReDoS in tokenBase function in javascript.js

js/package-lock.json

A package you depend on has a known security hole (CVE-2020-7760). Fix: Update that package to its patched version.
Worth fixing CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method

js/package-lock.json

A package you depend on has a known security hole (CVE-2020-11022). Fix: Update that package to its patched version.
Worth fixing CVE-2020-11023 jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

js/package-lock.json

A package you depend on has a known security hole (CVE-2020-11023). Fix: Update that package to its patched version.
Worth fixing CVE-2021-41182 jquery-ui: XSS in the altField option of the datepicker widget

js/package-lock.json

A package you depend on has a known security hole (CVE-2021-41182). Fix: Update that package to its patched version.
Worth fixing CVE-2021-41183 jquery-ui: XSS in *Text options of the datepicker widget

js/package-lock.json

A package you depend on has a known security hole (CVE-2021-41183). Fix: Update that package to its patched version.
Worth fixing CVE-2021-41184 jquery-ui: XSS in the 'of' option of the .position() util

js/package-lock.json

A package you depend on has a known security hole (CVE-2021-41184). Fix: Update that package to its patched version.
Worth fixing CVE-2022-31160 jqueryui: XSS when refreshing a checkboxradio with an HTML-like initial text label

js/package-lock.json

A package you depend on has a known security hole (CVE-2022-31160). Fix: Update that package to its patched version.
Worth fixing CVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep function

js/package-lock.json

A package you depend on has a known security hole (CVE-2020-8203). Fix: Update that package to its patched version.
Worth fixing CVE-2021-23337 nodejs-lodash: command injection via template

js/package-lock.json

A package you depend on has a known security hole (CVE-2021-23337). Fix: Update that package to its patched version.
Worth fixing CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports

js/package-lock.json

A package you depend on has a known security hole (CVE-2026-4800). Fix: Update that package to its patched version.
Worth fixing CVE-2020-28500 nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions

js/package-lock.json

A package you depend on has a known security hole (CVE-2020-28500). Fix: Update that package to its patched version.
Worth fixing CVE-2025-13465 lodash: prototype pollution in _.unset and _.omit functions

js/package-lock.json

A package you depend on has a known security hole (CVE-2025-13465). Fix: Update that package to its patched version.

… 41 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 1 found

Your dependencies cross-checked against the OSV vulnerability database.

Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior

/workdirs/scan-667f1c8c-1ac4-4d41-98e6-5aefe5ca3e7a/docs/doc-requirements.txt

A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.