gitsafehub
github.com/naveen521kk/manim-plugintemplate ↗

naveen521kk/manim-plugintemplate

scanned 2026-08-13 · git 200765f
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies50Known OSS vulnerabilities53Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 50 found · 4 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2021-25289 python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-25289). Fix: Update that package to its patched version.
  • Serious CVE-2021-34552 python-pillow: Buffer overflow in image convert function
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
  • Serious CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions
    poetry.lock
    A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
  • Serious CVE-2023-50447 pillow: Arbitrary Code Execution via the environment parameter
    poetry.lock
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-33430 numpy: buffer overflow in the PyArray_NewFromDescr_int() in ctors.c
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-33430). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-34141 numpy: incomplete string comparison in the numpy.core component
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-34141). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-35653 python-pillow: Buffer over-read in PCX image reader
    poetry.lock
    A package you depend on has a known security hole (CVE-2020-35653). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-35654 python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow
    poetry.lock
    A package you depend on has a known security hole (CVE-2020-35654). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-23437 python-pillow: possible ReDoS via the getrgb function
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-23437). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-25287 python-pillow: Out-of-bounds read in J2K image reader
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-25288 python-pillow: Out-of-bounds read in J2K image reader
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-25290 python-pillow: Negative-offset memcpy in TIFF image reader
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-25290). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-25291 python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-25291). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-25293 python-pillow: Out-of-bounds read in SGI RLE image reader
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-25293). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-27921 python-pillow: Excessive memory allocation in BLP image reader
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-27921). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-27922 python-pillow: Excessive memory allocation in ICNS image reader
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-27922). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-27923 python-pillow: Excessive memory allocation in ICO image reader
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-27923). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-28675 python-pillow: Excessive memory allocation in PSD image reader
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-28675). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-28676 python-pillow: Infinite loop in FLI image reader
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-28676). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-28677 python-pillow: Excessive CPU use in EPS image reader
    poetry.lock
    A package you depend on has a known security hole (CVE-2021-28677). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-24303 python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related actions
    poetry.lock
    A package you depend on has a known security hole (CVE-2022-24303). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-45198 Pillow before 9.2.0 performs Improper Handling of Highly Compressed GI ...
    poetry.lock
    A package you depend on has a known security hole (CVE-2022-45198). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-44271 python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument
    poetry.lock
    A package you depend on has a known security hole (CVE-2023-44271). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-4863 libwebp: Heap buffer overflow in WebP Codec
    poetry.lock
    A package you depend on has a known security hole (CVE-2023-4863). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-28219 python-pillow: buffer overflow in _imagingcms.c
    poetry.lock
    A package you depend on has a known security hole (CVE-2024-28219). Fix: Update that package to its patched version.
… 25 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 53 found · 7 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-138 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-331 Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-35 An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOT
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-25289). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-10 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-168 Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2022-24303). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6p56-wp2h-9hxr NumPy Buffer Overflow (Disputed)
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-33430). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fpfv-jqm9-f5jm Incorrect Comparison in NumPy
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-34141). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-139 An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Imag
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-28675). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-317 The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-23437). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-36 An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-25290). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-37 An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-25291). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-38 An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-25292). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-39 An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-25293). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-40 Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-27921). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-41 Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempt
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-27922). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-42 Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempte
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-27923). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-69 In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2020-35653). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-70 In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2020-35654). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-71 In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2020-35655). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-92 An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-28676). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-93 An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally qu
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-28677). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-94 An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2021-28678). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-42979 Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
    /workdirs/scan-763b672a-48fc-4d59-a6a4-84ba25473953/poetry.lock
    A package you depend on has a known security hole (CVE-2022-45198). Fix: Update that package to its patched version.
… 28 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.