Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.Packages you depend on that have known security holes (CVEs).
CVE-2026-41066 lxml: python: lxml: Information disclosure via untrusted XML input leading to local file readCVE-2020-27783 python-lxml: mXSS due to the use of improper parserCVE-2021-28957 python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSSCVE-2021-43818 python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass throughCVE-2022-2309 lxml: NULL Pointer Dereference in lxmlCVE-2025-69534 python-markdown: denial of service via malformed HTML-like sequencesYour dependencies cross-checked against the OSV vulnerability database.
PYSEC-2020-62 A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A rePYSEC-2021-19 An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribPYSEC-2021-852 lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content PYSEC-2022-230 NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earliePYSEC-2026-87 lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML inpPYSEC-2026-89 Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-MaCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.