gitsafehub
github.com/pieterv/hermes ↗

pieterv/hermes

scanned 2026-08-14 · git 4b153a8
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secretsVulnerable dependencies169Known OSS vulnerabilities243Risky code patternsMalicious dependenciesProject health

Security checks

Leaked secrets — Gitleaks timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivy 169 found · 6 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2023-45133 babel: arbitrary code execution
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious CVE-2023-45133 babel: arbitrary code execution
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious CVE-2022-37601 loader-utils: prototype pollution in function parseQuery in parseQuery.js
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2022-37601). Fix: Update that package to its patched version.
  • Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
  • Serious CVE-2023-28154 webpack: avoid cross-realm objects
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2023-28154). Fix: Update that package to its patched version.
  • Serious CVE-2026-54466 websocket-driver is a WebSocket protocol handler with pluggable I/O. P ...
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports
    tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2026-4800). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-13465 lodash: prototype pollution in _.unset and _.omit functions
    tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2025-13465). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-2950 lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass
    tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2026-2950). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-12224 idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded
    unsupported/juno/Cargo.lock
    A package you depend on has a known security hole (CVE-2024-12224). Fix: Update that package to its patched version.
  • Worth fixing GHSA-wfg4-322g-9vqv memoffset allows reading uninitialized memory
    unsupported/juno/Cargo.lock
    A package you depend on has a known security hole (GHSA-wfg4-322g-9vqv). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
    utils/promise/yarn.lock
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
    utils/promise/yarn.lock
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    utils/promise/yarn.lock
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-33750 brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern
    utils/promise/yarn.lock
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-26996 minimatch: minimatch: Denial of Service via specially crafted glob patterns
    utils/promise/yarn.lock
    A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-27903 minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
    utils/promise/yarn.lock
    A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-27904 minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
    utils/promise/yarn.lock
    A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-33671 picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns
    utils/promise/yarn.lock
    A package you depend on has a known security hole (CVE-2026-33671). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-33672 picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions
    utils/promise/yarn.lock
    A package you depend on has a known security hole (CVE-2026-33672). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44728 Babel is a compiler for writing next generation JavaScript. From 7.12. ...
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27789 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    website/yarn.lock
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
… 144 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scanner 243 found · 17 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious CVE-2021-24044 By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yi
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/external/llvh
    A package you depend on has a known security hole (CVE-2021-24044). Fix: Update that package to its patched version.
  • Serious CVE-2021-24045 A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes per
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/external/llvh
    A package you depend on has a known security hole (CVE-2021-24045). Fix: Update that package to its patched version.
  • Serious CVE-2023-23556 An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/external/llvh
    A package you depend on has a known security hole (CVE-2023-23556). Fix: Update that package to its patched version.
  • Serious CVE-2023-23557 An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/external/llvh
    A package you depend on has a known security hole (CVE-2023-23557). Fix: Update that package to its patched version.
  • Serious CVE-2023-25933 A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary code via untrusted JavaScript. Note that t
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/external/llvh
    A package you depend on has a known security hole (CVE-2023-25933). Fix: Update that package to its patched version.
  • Serious CVE-2023-28081 A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary code execution via a carefully crafted payl
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/external/llvh
    A package you depend on has a known security hole (CVE-2023-28081). Fix: Update that package to its patched version.
  • Serious CVE-2023-30470 A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65ed462b819c09 could have been used by an a
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/external/llvh
    A package you depend on has a known security hole (CVE-2023-30470). Fix: Update that package to its patched version.
  • Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/website/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/website/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
  • Serious GHSA-76p3-8jx3-jpfq Prototype pollution in webpack loader-utils
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/website/yarn.lock
    A package you depend on has a known security hole (CVE-2022-37601). Fix: Update that package to its patched version.
  • Serious GHSA-76p3-8jx3-jpfq Prototype pollution in webpack loader-utils
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/website/yarn.lock
    A package you depend on has a known security hole (CVE-2022-37601). Fix: Update that package to its patched version.
  • Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
  • Serious GHSA-hc6q-2mpp-qw7j Cross-realm object access in Webpack 5
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/website/yarn.lock
    A package you depend on has a known security hole (CVE-2023-28154). Fix: Update that package to its patched version.
  • Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/website/yarn.lock
    A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-24832 A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config o
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/external/llvh
    A package you depend on has a known security hole (CVE-2023-24832). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-24833 A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VM’s heap. Note that th
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/external/llvh
    A package you depend on has a known security hole (CVE-2023-24833). Fix: Update that package to its patched version.
  • Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
  • Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
    /workdirs/scan-613ccd1b-0c47-4ad0-88c1-3b9c520319cb/tools/hermes-parser/js/yarn.lock
    A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
… 218 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrep none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddog none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecard didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.