mockersf/poetry

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Worth fixing CVE-2023-37920 python-certifi: Removal of e-Tugra root certificate
  poetry.lock
  A package you depend on has a known security hole (CVE-2023-37920). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-23491 python-certifi: untrusted root certificates
  poetry.lock
  A package you depend on has a known security hole (CVE-2022-23491). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-3651 python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()
  poetry.lock
  A package you depend on has a known security hole (CVE-2024-3651). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputs
  poetry.lock
  A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
• Worth fixing GHSA-6v7p-g79w-8964 MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
  poetry.lock
  A package you depend on has a known security hole (GHSA-6v7p-g79w-8964). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
  poetry.lock
  A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-35195 requests: subsequent requests to the same host ignore cert verification
  poetry.lock
  A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
  poetry.lock
  A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-25645 requests: Requests: Security bypass due to predictable temporary file creation
  poetry.lock
  A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-11324 python-urllib3: Certification mishandle when error should be thrown
  poetry.lock
  A package you depend on has a known security hole (CVE-2019-11324). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-43804 python-urllib3: Cookie request header isn't stripped during cross-origin redirects
  poetry.lock
  A package you depend on has a known security hole (CVE-2023-43804). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-66418 urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion
  poetry.lock
  A package you depend on has a known security hole (CVE-2025-66418). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-66471 urllib3: urllib3 Streaming API improperly handles highly compressed data
  poetry.lock
  A package you depend on has a known security hole (CVE-2025-66471). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-21441 urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
  poetry.lock
  A package you depend on has a known security hole (CVE-2026-21441). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44431 urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
  poetry.lock
  A package you depend on has a known security hole (CVE-2026-44431). Fix: Update that package to its patched version.
• Worth fixing CVE-2018-25091 urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect
  poetry.lock
  A package you depend on has a known security hole (CVE-2018-25091). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-11236 python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service
  poetry.lock
  A package you depend on has a known security hole (CVE-2019-11236). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-26137 python-urllib3: CRLF injection via HTTP request method
  poetry.lock
  A package you depend on has a known security hole (CVE-2020-26137). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-45803 urllib3: Request body not stripped after redirect from 303 status changes request method to GET
  poetry.lock
  A package you depend on has a known security hole (CVE-2023-45803). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-37891 urllib3: proxy-authorization request header is not stripped during cross-origin redirects
  poetry.lock
  A package you depend on has a known security hole (CVE-2024-37891). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-50181 urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
  poetry.lock
  A package you depend on has a known security hole (CVE-2025-50181). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-53899 virtualenv: potential command injection via virtual environment activation scripts
  poetry.lock
  A package you depend on has a known security hole (CVE-2024-53899). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-22702 virtualenv: virtualenv: Local attacker can redirect file operations via TOCTOU race condition
  poetry.lock
  A package you depend on has a known security hole (CVE-2026-22702). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious PYSEC-2026-2120 Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2026-31900). Fix: Update that package to its patched version.
• Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
• Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
• Serious PYSEC-2024-187 virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2024-53899). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-48 Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could e
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2024-21503). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2121 Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics opti
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2026-32274). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2022-42986 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2022-23491). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-135 Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store. e-Tugra's root certificates are being removed pur
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2023-37920). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-230 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2024-39689). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2022-43178 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2022-42966). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2026-7246). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1374 filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2026-22701). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1375 filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2025-68146). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2024-60 A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings,
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2024-3651). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2019-217 In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2019-10906). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2021-66 This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1473 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1474 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1475 Jinja has a sandbox breakout through indirect reference to format method
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-89 Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Ma
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2025-69534). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-3625 MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack.
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2026-57585). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2020-92 A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying m
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2020-29651). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2021-140 An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only
  /workdirs/scan-eb5863f3-88f7-4c69-be82-294698b1dbbe/poetry.lock
  A package you depend on has a known security hole (CVE-2021-20270). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

• Serious guarddog-pypi-code-execution code-execution match in setuptools 84.0.0
  setuptools
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.

via Guarddog v2.10.0 · Apache-2.0