rfloriano/compass

scanned 2026-08-08 · git 42ba906

1 of 6 checks flagged a security issue

🔴 Needs attention

Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies117Known OSS vulnerabilities✓Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 117 found · 8 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2013-0333 rubygem-activesupport: json to yaml parsing

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2013-0333). Fix: Update that package to its patched version.
Serious CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2020-8165). Fix: Update that package to its patched version.
Serious CVE-2013-0269 rubygem-json: Denial of Service and SQL Injection

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2013-0269). Fix: Update that package to its patched version.
Serious CVE-2016-4658 libxml2: Use after free via namespace node in XPointer ranges

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2016-4658). Fix: Update that package to its patched version.
Serious CVE-2019-11068 libxslt: xsltCheckRead and xsltCheckWrite routines security bypass by crafted URL

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2019-11068). Fix: Update that package to its patched version.
Serious CVE-2019-5477 A command injection vulnerability in Nokogiri v1.10.3 and earlier allo ...

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2019-5477). Fix: Update that package to its patched version.
Serious GHSA-353f-x4gh-cqq8 Nokogiri patches vendored libxml2 to resolve multiple CVEs

doc-src/Gemfile.lock

A package you depend on has a known security hole (GHSA-353f-x4gh-cqq8). Fix: Update that package to its patched version.
Serious CVE-2022-30123 rubygem-rack: crafted requests can cause shell escape sequences

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
Worth fixing CVE-2013-1856 XML Parsing Vulnerability affecting JRuby users

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2013-1856). Fix: Update that package to its patched version.
Worth fixing CVE-2023-22796 rubygem-activesupport: Regular Expression Denial of Service

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2023-22796). Fix: Update that package to its patched version.
Worth fixing CVE-2026-33176 Rails: Active Support: Active Support: Denial of Service via large scientific notation strings

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
Worth fixing CVE-2012-1098 rubygem-activesupport: XSS in SafeBuffer#[] (unescaped safe buffers can be marked as safe)

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2012-1098). Fix: Update that package to its patched version.
Worth fixing CVE-2012-3464 rubygem-actionpack: potential XSS vulnerability

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2012-3464). Fix: Update that package to its patched version.
Worth fixing CVE-2015-3227 rubygem-activesupport: Possible Denial of Service attack in Active Support in merge_element()

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2015-3227). Fix: Update that package to its patched version.
Worth fixing CVE-2023-28120 rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2023-28120). Fix: Update that package to its patched version.
Worth fixing CVE-2026-33169 rails: rails-activesupport: Active Support: Denial of Service via crafted long digit strings

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
Worth fixing CVE-2026-33170 Rails: Active Support: Active Support: Cross-Site Scripting (XSS) due to improper HTML safety flag propagation in SafeBuffer#%

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
Worth fixing CVE-2026-44312 css_parser: css_parser: Man-in-the-Middle attack due to improper HTTPS certificate validation

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2026-44312). Fix: Update that package to its patched version.
Worth fixing CVE-2017-1002201 In haml versions prior to version 5.0.0.beta.2, when using user input ...

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2017-1002201). Fix: Update that package to its patched version.
Worth fixing CVE-2014-10077 rubygem-i18n: denial of service in Hash#slice in lib/i18n/core_ext/hash.rb

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2014-10077). Fix: Update that package to its patched version.
Worth fixing CVE-2013-4492 rubygem-i18n: cross-site scripting flaw in exception handling

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2013-4492). Fix: Update that package to its patched version.
Worth fixing CVE-2020-10663 rubygem-json: Unsafe object creation vulnerability in JSON

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2020-10663). Fix: Update that package to its patched version.
Worth fixing CVE-2012-6685 rubygem-nokogiri: XML eXternal Entity (XXE) flaw

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2012-6685). Fix: Update that package to its patched version.
Worth fixing CVE-2017-15412 libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2017-15412). Fix: Update that package to its patched version.
Worth fixing CVE-2017-16932 libxml2: Infinite recursion in parameter entities

doc-src/Gemfile.lock

A package you depend on has a known security hole (CVE-2017-16932). Fix: Update that package to its patched version.

… 92 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ none found ✓

Your dependencies cross-checked against the OSV vulnerability database.

Nothing found by this check. ✓

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.