gitsafehub
github.com/samber/go-mod-graph ↗

samber/go-mod-graph

scanned 2026-08-11 · git c85827c
3 of 6 checks flagged a security issue
🟡 Worth a look
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets1Vulnerable dependencies23Known OSS vulnerabilities107Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 1 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    app/index.html:36
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 23 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2026-54285 @opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54285 @opentelemetry/core: opentelemetry-js: @opentelemetry/core: Denial of Service via oversized baggage HTTP headers
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44288 protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44288). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49458 dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49459 dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49459). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49978). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65898 DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when ...
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65898). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-65902 DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct refe ...
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65902). Fix: Update that package to its patched version.
  • Worth fixing GHSA-55q2-fjhq-7xh7 DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
    app/package-lock.json
    A package you depend on has a known security hole (GHSA-55q2-fjhq-7xh7). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44289 protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44289). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44290 protobufjs: protobufjs: Denial of Service via crafted schema
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44290). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44291 protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44291). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44293 protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44293). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-48712 protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-48712). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44288 protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44288). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44292 protobufjs: protobufjs: Data integrity impact due to prototype pollution
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44292). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44294 protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44294). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45740 protobufjs: protobufjs: Denial of Service via crafted JSON descriptors
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-45740). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-54269 protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54269). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59877 protobufjs: protobufjs: Denial of Service via crafted .proto schema
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59877). Fix: Update that package to its patched version.
  • Minor CVE-2026-65899 DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types ...
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65899). Fix: Update that package to its patched version.
  • Minor CVE-2026-65900 DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE ...
    app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65900). Fix: Update that package to its patched version.
  • Minor GHSA-c2j3-45gr-mqc4 DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
    app/package-lock.json
    A package you depend on has a known security hole (GHSA-c2j3-45gr-mqc4). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 107 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing GHSA-8988-4f7v-96qf OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8988-4f7v-96qf OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-54285). Fix: Update that package to its patched version.
  • Worth fixing GHSA-q6x5-8v7m-xcrf protobufjs has overlong UTF-8 decoding
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-44288). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing GHSA-55q2-fjhq-7xh7 DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-76mc-f452-cxcm DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65902). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-65898). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hpcv-96wg-7vj8 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49458). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r47g-fvhr-h676 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49459). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rp9w-3fw7-7cwq DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-49978). Fix: Update that package to its patched version.
  • Worth fixing GHSA-25h7-pfq9-p65f flatted vulnerable to unbounded recursion DoS in parse() revive phase
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-32141). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rf6f-7fwh-wjgh Prototype Pollution via parse() in NodeJS flatted
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33228). Fix: Update that package to its patched version.
  • Worth fixing GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59869). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-53550). Fix: Update that package to its patched version.
  • Worth fixing GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
    /workdirs/scan-d9289bd4-aea1-4ff0-b1e5-4057494fc2be/app/package-lock.json
    A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
… 82 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.