gitsafehub
github.com/onuralpszr/ort ↗

onuralpszr/ort

scanned 2026-08-15 · git 9c840a3
2 of 6 checks flagged a security issue
🟡 Worth a look
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies63Known OSS vulnerabilities70Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 63 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2026-41672 xmldom: @xmldom/xmldom: xmldom: Arbitrary XML Node Injection
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41672). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41673 @xmldom/xmldom: xmldom: xmldom: Denial of Service via deeply nested XML documents
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41673). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41674 xmldom: xmldom: Arbitrary XML markup injection
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41674). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41675 xmldom: xmldom: Arbitrary XML node injection via crafted processing instructions
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41675). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45149 brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-45149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41238 DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41238). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41239 DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41239). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41240 DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41240). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49458 dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49459 dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49459). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49978). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65898 DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when ...
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-65898). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65902 DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct refe ...
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-65902). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65903 dompurify: DOMPurify: Security bypass allows injection of malicious content
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-65903). Fix: Update that package to its patched version.
  • Worth fixing GHSA-55q2-fjhq-7xh7 DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (GHSA-55q2-fjhq-7xh7). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-4800). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-2950 lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-2950). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41148 mermaid: Mermaid: CSS injection vulnerability allows page defacement and information disclosure
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41148). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41149 mermaid: Mermaid: HTML injection via classDef directive in state diagrams
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41150 mermaid: Mermaid: Denial of Service via specially crafted gantt charts
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41150). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41159 mermaid: Mermaid: Information disclosure and page defacement via CSS injection
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41159). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-50159 mermaid: Mermaid: CSS injection allows altering page elements via diagram input
    docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-50159). Fix: Update that package to its patched version.
… 38 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 70 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing GHSA-2v35-w6hq-6mfw xmldom: Uncontrolled recursion in XML serialization leads to DoS
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41673). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f6ww-3ggp-fr8h xmldom has XML injection through unvalidated DocumentType serialization
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41674). Fix: Update that package to its patched version.
  • Worth fixing GHSA-j759-j44w-7fr8 xmldom has XML node injection through unvalidated comment serialization
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41672). Fix: Update that package to its patched version.
  • Worth fixing GHSA-x6wf-f3px-wcqx xmldom has XML node injection through unvalidated processing instruction serialization
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41675). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-jxxr-4gwj-5jf2 brace-expansion: Large numeric range defeats documented `max` DoS protection
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-45149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing GHSA-39q2-94rc-95cp DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-65903). Fix: Update that package to its patched version.
  • Worth fixing GHSA-55q2-fjhq-7xh7 DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-76mc-f452-cxcm DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-65902). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-65898). Fix: Update that package to its patched version.
  • Worth fixing GHSA-crv5-9vww-q3g8 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41239). Fix: Update that package to its patched version.
  • Worth fixing GHSA-h7mw-gpvr-xq4m DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41240). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hpcv-96wg-7vj8 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49458). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r47g-fvhr-h676 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49459). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rp9w-3fw7-7cwq DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-49978). Fix: Update that package to its patched version.
  • Worth fixing GHSA-v9jr-rg53-9pgp DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41238). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-13465). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2021-23337). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2v8p-3f2j-5mp7 Mermaid XY Charts are vulnerable to an infinite loop DoS
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-71436). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3rrr-jr9j-h3q3 Mermaid Architecture diagrams are vulnerable to prototype pollution
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-71437). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6m6c-36f7-fhxh Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41150). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6x64-9x62-f2gx Mermaid allows CSS injection applying to sibling elements of the diagram
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-50159). Fix: Update that package to its patched version.
  • Worth fixing GHSA-87f9-hvmw-gh4p Mermaid: Improper sanitization of configuration leads to CSS injection
    /workdirs/scan-97f861f7-1c4e-4755-9701-33601572e213/docs/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-41159). Fix: Update that package to its patched version.
… 45 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.