gitsafehub
github.com/tbabej/roots ↗

tbabej/roots

scanned 2026-08-10 · git 9c6bf6e
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies92Known OSS vulnerabilities184Risky code patterns✓Malicious dependencies3Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 92 found · 12 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2019-19844 Django: crafted email address allows account takeover
    requirements.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious CVE-2020-7471 django: potential SQL injection via StringAgg(delimiter)
    requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious CVE-2016-4009 python-pillow: integer overflow in the ImagingResampleHorizontal function
    requirements.txt
    A package you depend on has a known security hole (CVE-2016-4009). Fix: Update that package to its patched version.
  • Serious CVE-2020-11538 python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2
    requirements.txt
    A package you depend on has a known security hole (CVE-2020-11538). Fix: Update that package to its patched version.
  • Serious CVE-2020-5310 python-pillow: Integer overflow leading to buffer overflow in ImagingLibTiffDecode
    requirements.txt
    A package you depend on has a known security hole (CVE-2020-5310). Fix: Update that package to its patched version.
  • Serious CVE-2020-5311 python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c
    requirements.txt
    A package you depend on has a known security hole (CVE-2020-5311). Fix: Update that package to its patched version.
  • Serious CVE-2020-5312 python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c
    requirements.txt
    A package you depend on has a known security hole (CVE-2020-5312). Fix: Update that package to its patched version.
  • Serious CVE-2021-25289 python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-25289). Fix: Update that package to its patched version.
  • Serious CVE-2021-34552 python-pillow: Buffer overflow in image convert function
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
  • Serious CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions
    requirements.txt
    A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
  • Serious CVE-2023-50447 pillow: Arbitrary Code Execution via the environment parameter
    requirements.txt
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-5143 Django: possible DoS by filling session store
    requirements.txt
    A package you depend on has a known security hole (CVE-2015-5143). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-5144 Django: possible header injection due to validators accepting newlines in input
    requirements.txt
    A package you depend on has a known security hole (CVE-2015-5144). Fix: Update that package to its patched version.
  • Worth fixing CVE-2016-7401 python-django: CSRF protection bypass on a site with Google Analytics
    requirements.txt
    A package you depend on has a known security hole (CVE-2016-7401). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-36359 An issue was discovered in the HTTP FileResponse class in Django 3.2 b ...
    requirements.txt
    A package you depend on has a known security hole (CVE-2022-36359). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-57833 django: Django SQL injection in FilteredRelation column aliases
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-64458 Django: Denial-of-service vulnerability in Django on Windows
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-64458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-5963 python-django: Denial-of-service possibility in logout() view by filling session store
    requirements.txt
    A package you depend on has a known security hole (CVE-2015-5963). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-5964 python-django: Denial-of-service possibility in logout() view by filling session store
    requirements.txt
    A package you depend on has a known security hole (CVE-2015-5964). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-8213 python-django: Information leak through date template filter
    requirements.txt
    A package you depend on has a known security hole (CVE-2015-8213). Fix: Update that package to its patched version.
  • Worth fixing CVE-2016-2512 python-django: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth
    requirements.txt
    A package you depend on has a known security hole (CVE-2016-2512). Fix: Update that package to its patched version.
  • Worth fixing CVE-2016-6186 django: XSS in admin's add/change related popup
    requirements.txt
    A package you depend on has a known security hole (CVE-2016-6186). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-33203 django: Potential directory traversal via ``admindocs``
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-33203). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-45231 python-django: Potential user email enumeration via response status on password reset
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
… 67 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 184 found · 31 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious GHSA-hmr4-m2h5-33qx SQL injection in Django
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious PYSEC-2016-7 Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2016-4009). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-80 In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2020-11538). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-81 libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2020-5310). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-82 libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2020-5311). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-83 libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2020-5312). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-138 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-331 Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-35 An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOT
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25289). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-10 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-168 Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2022-24303). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-10 A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input f
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2021-30459). Fix: Update that package to its patched version.
  • Serious PYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious GHSA-hmr4-m2h5-33qx SQL injection in Django
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious PYSEC-2016-7 Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2016-4009). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-80 In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2020-11538). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-81 libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2020-5310). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-82 libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2020-5311). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-83 libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2020-5312). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
    /workdirs/scan-b8bc28f3-780a-48c7-add1-a0470df89533/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
… 159 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ 3 found · 1 serious

Packages that look intentionally malicious: typosquats, sneaky install scripts.

  • Serious guarddog-pypi-code-execution code-execution match in python-openid 2.2.5
    python-openid
    A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
  • Worth fixing guarddog-pypi-obfuscation obfuscation match in line-profiler 1.0
    line-profiler
    A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
  • Worth fixing guarddog-pypi-obfuscation obfuscation match in requests 2.7.0
    requests
    A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.