maximlt/intake-parquet

scanned 2026-08-12 · git 0d12985

1 of 6 checks flagged a security issue

🔴 Needs attention

Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies✓Known OSS vulnerabilities4Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 4 found · 1 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious PYSEC-2023-238 Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parque

/workdirs/scan-8b064b91-476a-41be-80dd-ad54a85ac922/requirements.txt

A package you depend on has a known security hole (CVE-2023-47248). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior

/workdirs/scan-8b064b91-476a-41be-80dd-ad54a85ac922/docs/requirements.txt

A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
Worth fixing GHSA-37g4-qqqv-7m99 Intake has a Command Injection via shell() Expansion in Parameter Defaults

/workdirs/scan-8b064b91-476a-41be-80dd-ad54a85ac922/requirements.txt

A package you depend on has a known security hole (CVE-2026-33310). Fix: Update that package to its patched version.
FYI PYSEC-2024-161 Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arro

/workdirs/scan-8b064b91-476a-41be-80dd-ad54a85ac922/requirements.txt

A package you depend on has a known security hole (CVE-2024-52338). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.