gitsafehub
github.com/marclaporte/ropherta ↗

marclaporte/ropherta

scanned 2026-08-16 · git c8df9ca
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies107Known OSS vulnerabilities142Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 107 found · 3 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2023-47248 PyArrow: Arbitrary code execution when loading a malicious data file
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-47248). Fix: Update that package to its patched version.
  • Serious CVE-2025-32434 PyTorch is a Python package that provides tensor computation with stro ...
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2025-32434). Fix: Update that package to its patched version.
  • Serious CVE-2023-6730 transformers has a Deserialization of Untrusted Data vulnerability
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-6730). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-34064 jinja2: accepts keys containing non-attribute characters
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-56201 jinja2: Jinja has a sandbox breakout through malicious filenames
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-56201). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27516 jinja2: Jinja sandbox breakout through attr filter selecting format method
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-23334 aiohttp: follow_symlinks directory traversal vulnerability
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-23334). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-30251 aiohttp: DoS when trying to parse malformed POST requests
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-30251). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-69223 aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2025-69223). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-69244 aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2026-69244). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-37276 python-aiohttp: HTTP request smuggling via llhttp HTTP request parser
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-37276). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-47627 python-aiohttp: numerous issues in HTTP parser with header parsing
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-47627). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-49081 aiohttp: HTTP request modification
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-49081). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-49082 aiohttp: CRLF injection if user controls the HTTP method using aiohttp client
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-49082). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-23829 python-aiohttp: http request smuggling
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-23829). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-27306 aiohttp: XSS on index pages for static file handling
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-27306). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-52304 aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-52304). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-69227 aiohttp: aiohttp: Denial of Service via specially crafted POST request
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2025-69227). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-69228 aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2025-69228). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-69229 aiohttp: AIOHTTP: Denial of Service via excessive CPU usage in chunked message handling
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2025-69229). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-22815 aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2026-22815). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-34515 aiohttp: AIOHTTP: Information disclosure via static resource handler on Windows
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2026-34515). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-34516 aiohttp: AIOHTTP: Denial of Service via excessive multipart headers
    tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2026-34516). Fix: Update that package to its patched version.
… 82 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 142 found · 9 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2026-2102 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in resp
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2026-34520). Fix: Update that package to its patched version.
  • Serious PYSEC-2024-223 Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-27319). Fix: Update that package to its patched version.
  • Serious PYSEC-2025-10 A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal att
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-7776). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-103 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improp
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2026-28500). Fix: Update that package to its patched version.
  • Serious PYSEC-2023-238 Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parque
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-47248). Fix: Update that package to its patched version.
  • Serious PYSEC-2024-259 In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-48063). Fix: Update that package to its patched version.
  • Serious PYSEC-2025-41 PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command E
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2025-32434). Fix: Update that package to its patched version.
  • Serious PYSEC-2023-300 Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-6730). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-2290 A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2026-5241). Fix: Update that package to its patched version.
  • Worth fixing GHSA-vvj3-c3rp-c85p PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/composer.lock
    A package you depend on has a known security hole (CVE-2026-24765). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1472 Jinja has a sandbox breakout through malicious filenames
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-56201). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1473 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1474 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1475 Jinja has a sandbox breakout through indirect reference to format method
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-120 aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-37276). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-246 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-47627). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-250 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-49081). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-251 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even crea
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2023-49082). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2024-24 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static fi
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-23334). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2024-26 aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must tri
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-23829). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1098 aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-30251). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1100 AIOHTTP vulnerable to denial of service through large payloads
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2025-69228). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1101 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2025-69223). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1102 aiohttp Cross-site Scripting vulnerability on index pages for static file handling
    /workdirs/scan-b912db88-6cc4-4dbe-a90a-4fefd17b2d80/tuning/requirements.txt
    A package you depend on has a known security hole (CVE-2024-27306). Fix: Update that package to its patched version.
… 117 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.