Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2024-22051 commonmarker: integer overflow in cmark-gfm's table row parsing may lead to heap memory corruptionCVE-2026-54906 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Synchronization flaw in ReadWriteLock allows unauthorized lock release and denial of serviceCVE-2022-32511 jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a s ...GHSA-353f-x4gh-cqq8 Nokogiri patches vendored libxml2 to resolve multiple CVEsCVE-2021-32740 rubygem-addressable: ReDoS in templatesCVE-2026-35611 addressable: Addressable: Denial of Service via crafted URI templatesCVE-2023-37463 cmark-gfm is an extended version of the C reference implementation of ...GHSA-48wp-p9qv-4j64 Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of serviceGHSA-4qw4-jpp4-8gvp Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of serviceGHSA-636f-xm5j-pj9m Several quadratic complexity bugs may lead to denial of service in CommonmarkerGHSA-7vh7-fw88-wj87 Several quadratic complexity bugs may lead to denial of service in CommonmarkerCVE-2026-54904 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Denial of Service due to infinite loop in AtomicReference#updateCVE-2026-54905 concurrent-ruby: Concurrent-ruby: Incorrect write lock granting leading to broken mutual exclusionCVE-2026-54171 Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon ...CVE-2026-54297 faraday: Faraday: Denial of Service via crafted nested query stringsCVE-2026-25765 Faraday: Faraday: Server-Side Request Forgery via protocol-relative URLsCVE-2025-68696 httparty: Httparty: Server-Side Request Forgery (SSRF) allows information disclosure and unauthorized internal access.CVE-2024-22049 httparty before 0.21.0 is vulnerable to an assumed-immutable web param ...CVE-2018-25032 zlib: A flaw found in zlib when compressing (not decompressing) certain inputsCVE-2021-30560 Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 a ...CVE-2021-3517 libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.cCVE-2021-3518 libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.cCVE-2021-41098 rubygem-nokogiri: XEE on JRubyCVE-2022-24836 nokogiri: ReDoS in HTML encoding detectionCVE-2022-24839 nokogiri: Uncontrolled Resource Consumption in org.cyberneko.html (nokogiri fork)Your dependencies cross-checked against the OSV vulnerability database.
GHSA-5c5f-7vfq-3732 JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferableGHSA-353f-x4gh-cqq8 Nokogiri patches vendored libxml2 to resolve multiple CVEsGHSA-h27x-rffw-24p4 Addressable has a Regular Expression Denial of Service in Addressable templatesGHSA-jxhc-q857-3j6g Regular Expression Denial of Service in Addressable templatesGHSA-fmx4-26r3-wxpf Integer overflow in cmark-gfm table parsing extension leads to heap memory corruptionGHSA-h8w8-99g7-qmvj Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`GHSA-wv3x-4vxv-whpp Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivityGHSA-48rx-c7pg-q66r Excon does not redact additional sensitive/risky headers when following redirectsGHSA-33mh-2634-fwr2 Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_urlGHSA-98m9-hrrm-r99r Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parametersGHSA-5pq7-52mg-hr42 httparty has multipart/form-data request tampering vulnerabilityGHSA-hm5p-x4rq-38w4 httparty Has Potential SSRF Vulnerability That Leads to API Key LeakageGHSA-286v-pcf5-25rc Nokogiri Implements libxml2 version vulnerable to null pointer dereferencingGHSA-2rr5-8q37-2w7h Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRubyGHSA-59gp-qqm7-cw4j Nokogiri has vulnerable dependencies on libxml2 and libxsltGHSA-5prr-v3j2-97mh Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`GHSA-c4rq-3m3g-8wgx Nokogiri CSS selector tokenizer has regular expression backtrackingGHSA-cgx6-hpwq-fhv5 Integer Overflow or Wraparound in libxml2 affects NokogiriGHSA-crjr-9rc5-ghw8 Nokogiri Inefficient Regular Expression ComplexityGHSA-fq42-c5rg-92c2 Vulnerable dependencies in NokogiriGHSA-gx8x-g87m-h5q6 Denial of Service (DoS) in Nokogiri on JRubyGHSA-jc36-42cf-vqwj Nokogiri affected by zlib's Out-of-bounds Write vulnerabilityGHSA-jw9f-hh49-cvp9 Nokogiri contains libxml Out-of-bounds Write vulnerabilityGHSA-mrxw-mxhj-p664 Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEsGHSA-v2fc-qm4h-8hqv Nokogiri XSLT transform has a memory leakCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.