sourcegraph/srclib-ruby

scanned 2026-08-12 · git 46b6d0b

1 of 6 checks flagged a security issue

🔴 Needs attention

Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies42Known OSS vulnerabilities✓Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 42 found · 1 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2022-30123 rubygem-rack: crafted requests can cause shell escape sequences

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
Worth fixing CVE-2023-31606 RedCloth: Regular expression denial of service in sanitize_html function

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2023-31606). Fix: Update that package to its patched version.
Worth fixing CVE-2012-6684 rubygem-RedCloth: XSS vulnerability

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2012-6684). Fix: Update that package to its patched version.
Worth fixing CVE-2018-18385 rubygem-asciidoctor: Infinite loop in the #next_block method

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2018-18385). Fix: Update that package to its patched version.
Worth fixing CVE-2020-8161 rubygem-rack: directory traversal in Rack::Directory

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2020-8161). Fix: Update that package to its patched version.
Worth fixing CVE-2020-8184 rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2020-8184). Fix: Update that package to its patched version.
Worth fixing CVE-2022-30122 rubygem-rack: crafted multipart POST request may cause a DoS

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2022-30122). Fix: Update that package to its patched version.
Worth fixing CVE-2022-44570 rubygem-rack: denial of service in Content-Disposition parsing

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2022-44570). Fix: Update that package to its patched version.
Worth fixing CVE-2022-44571 rubygem-rack: denial of service in Content-Disposition parsing

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2022-44571). Fix: Update that package to its patched version.
Worth fixing CVE-2022-44572 rubygem-rack: denial of service in Content-Disposition parsing

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2022-44572). Fix: Update that package to its patched version.
Worth fixing CVE-2023-27530 rubygem-rack: Denial of service in Multipart MIME parsing

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2023-27530). Fix: Update that package to its patched version.
Worth fixing CVE-2024-26141 rubygem-rack: Possible DoS Vulnerability with Range Header in Rack

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2024-26141). Fix: Update that package to its patched version.
Worth fixing CVE-2024-26146 rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2024-26146). Fix: Update that package to its patched version.
Worth fixing CVE-2025-27111 rack: rubygem-rack: Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2025-27111). Fix: Update that package to its patched version.
Worth fixing CVE-2025-27610 rack: rubygem-rack: Local File Inclusion in Rack::Static

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2025-27610). Fix: Update that package to its patched version.
Worth fixing CVE-2025-46727 rubygem-rack: Unbounded-Parameter DoS in Rack::QueryParser

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2025-46727). Fix: Update that package to its patched version.
Worth fixing CVE-2025-59830 rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2025-59830). Fix: Update that package to its patched version.
Worth fixing CVE-2025-61770 rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2025-61770). Fix: Update that package to its patched version.
Worth fixing CVE-2025-61771 rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2025-61771). Fix: Update that package to its patched version.
Worth fixing CVE-2025-61772 rack: Rack memory exhaustion denial of service

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2025-61772). Fix: Update that package to its patched version.
Worth fixing CVE-2025-61919 rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2025-61919). Fix: Update that package to its patched version.
Worth fixing CVE-2026-22860 rubygem-rack: Rack Directory Traversal via Rack:Directory

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2026-22860). Fix: Update that package to its patched version.
Worth fixing CVE-2026-34785 github.com/rack/rack: Rack: Information disclosure via incorrect static file serving prefix check

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2026-34785). Fix: Update that package to its patched version.
Worth fixing CVE-2026-34829 rack: Rack: Denial of Service via unbounded multipart file upload

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2026-34829). Fix: Update that package to its patched version.
Worth fixing CVE-2015-3225 rubygem-rack: Potential Denial of Service Vulnerability in Rack normalize_params()

yard/Gemfile.lock

A package you depend on has a known security hole (CVE-2015-3225). Fix: Update that package to its patched version.

… 17 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ none found ✓

Your dependencies cross-checked against the OSV vulnerability database.

Nothing found by this check. ✓

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.