gitsafehub
github.com/pyecharts/pyecharts-javascripthon-api-service ↗

pyecharts/pyecharts-javascripthon-api-service

scanned 2026-08-12 · git af66c09
2 of 6 checks flagged a security issue
🟡 Worth a look
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies11Known OSS vulnerabilities16Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 11 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2024-1135 python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-1135). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-6827 gunicorn: HTTP Request Smuggling in benoitc/gunicorn
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-6827). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-35920 sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-35920). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7p79-6x2v-5h88 Server crash if running Python 3.10 w/ Sanic 20.12
    Pipfile.lock
    A package you depend on has a known security hole (GHSA-7p79-6x2v-5h88). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-31116 python-ujson: improper decoding of escaped surrogate characters may lead to string corruption, key confusion or value overwriting
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-31116). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44660 python-ujson: UltraJSON: Memory leak leading to Denial of Service
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-44660). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-45958 UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow ...
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2021-45958). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-31117 python-ujson: Potential double free of buffer during string decoding
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-31117). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54911 UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-54911). Fix: Update that package to its patched version.
  • Worth fixing CVE-2018-1000518 websockets is vulnerable to denial of service by memory exhaustion
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2018-1000518). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-33880 The aaugustin websockets library before 9.1 for Python has an Observab ...
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2021-33880). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 16 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing PYSEC-2026-1433 Gunicorn HTTP Request/Response Smuggling vulnerability
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-6827). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1434 Request smuggling leading to endpoint restriction bypass in Gunicorn
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-1135). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-918 sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-35920). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7p79-6x2v-5h88 Server crash if running Python 3.10 w/ Sanic 20.12
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1056 Potential double free of buffer during string decoding
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-31117). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1057 Incorrect handling of invalid surrogate pair characters
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-31116). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2293 UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exceptio
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-44660). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2294 UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-54911). Fix: Update that package to its patched version.
  • Worth fixing GHSA-fh56-85cw-5pq6 UltraJSON vulnerable to Out-of-bounds Write
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole (CVE-2021-45958). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2018-79 aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that c
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole (CVE-2018-1000518). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-95 The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An a
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole (CVE-2021-33880). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2291 UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory leak in JSON parsing large (outside of the ra
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/requirements.txt
    A package you depend on has a known security hole (CVE-2026-32874). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2292 UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handl
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/requirements.txt
    A package you depend on has a known security hole (CVE-2026-32875). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2293 UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exceptio
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/requirements.txt
    A package you depend on has a known security hole (CVE-2026-44660). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2294 UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps() (or ujson.dump() or ujson.encode()) have a reject_bytes=False option. When
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/requirements.txt
    A package you depend on has a known security hole (CVE-2026-54911). Fix: Update that package to its patched version.
  • FYI OSV-2021-955 Stack-buffer-overflow in Buffer_AppendIndentUnchecked
    /workdirs/scan-316dbcac-a6c4-4849-8c14-671601c0772b/Pipfile.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.