gitsafehub
github.com/mgax/lfs ↗

mgax/lfs

scanned 2026-08-09 · git 1275b9d
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies23Known OSS vulnerabilities27Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 23 found · 2 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2020-14343 PyYAML: incomplete fix for CVE-2020-1747
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Serious CVE-2020-1747 PyYAML: arbitrary command execution through python/object/new when FullLoader is used
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-1747). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-30861). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-28493 python-jinja2: ReDoS vulnerability in the urlize filter
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-34064 jinja2: accepts keys containing non-attribute characters
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27516 jinja2: Jinja sandbox breakout through attr filter selecting format method
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-29651 python-py: ReDoS in the py.path.svnwc component via mailicious input to blame functionality
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-29651). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-71176 pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-24761 waitress: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-24761). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-49769 waitress: Waitress has a denial of service leading to high CPU usage/resource exhaustion
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-49769). Fix: Update that package to its patched version.
  • Worth fixing GHSA-m5ff-3wj3-8ph4 HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress
    Pipfile.lock
    A package you depend on has a known security hole (GHSA-m5ff-3wj3-8ph4). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-16789 waitress: HTTP Request Smuggling through Invalid whitespace characters in headers
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2019-16789). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-25577 python-werkzeug: high resource usage when parsing multipart form data with many fields
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-25577). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-34069 python-werkzeug: user may execute code on a developer's machine
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-34069). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-49766 werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-49766). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-66221 Werkzeug: Werkzeug: Denial of service via Windows device names in path segments
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-66221). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-21860 Werkzeug safe_join() allows Windows special device names with compound extensions
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-21860). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-27199 Werkzeug safe_join() allows Windows special device names
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-27199). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-5569 github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-5569). Fix: Update that package to its patched version.
  • Minor CVE-2026-27205 flask: Flask: Information disclosure via improper caching of session data
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-27205). Fix: Update that package to its patched version.
  • Minor CVE-2023-23934 python-werkzeug: cookie prefixed with = can shadow unprefixed cookie
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-23934). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 27 found · 2 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2020-96 A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method o
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-1747). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-7246). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-62 Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-30861). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2151 Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Us
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-27205). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-66 This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1473 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1474 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1475 Jinja has a sandbox breakout through indirect reference to format method
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-92 A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying m
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-29651). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1845 pytest has vulnerable tmpdir handling
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2019-138 In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leadi
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2019-16789). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-169 Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-24761). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2024-211 Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-49769). Fix: Update that package to its patched version.
  • Worth fixing GHSA-m5ff-3wj3-8ph4 HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-221 Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are ap
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-46136). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-58 Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a sm
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-25577). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2043 Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-34069). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2044 Werkzeug safe_join() allows Windows special device names with compound extensions
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-21860). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2045 Werkzeug safe_join not safe on Windows
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-49766). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2046 Werkzeug safe_join() allows Windows special device names
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-66221). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2320 Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previou
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-27199). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2074 zipp Denial of Service vulnerability
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-5569). Fix: Update that package to its patched version.
  • Minor PYSEC-2023-57 Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application
    /workdirs/scan-47492f75-36d6-4d32-9912-39befdad3159/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-23934). Fix: Update that package to its patched version.
… 2 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.