gitsafehub
github.com/travis79/firefox-tv ↗

travis79/firefox-tv

scanned 2026-08-10 · git 6451c1b
2 of 6 checks flagged a security issue
🟡 Worth a look
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies7Known OSS vulnerabilities7Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 7 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2021-42771 python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code
    tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2021-42771). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41066 lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read
    tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2026-41066). Fix: Update that package to its patched version.
  • Worth fixing CVE-2018-19787 python-lxml: XSS in lxml.html.clean module in lxml/html/clean.py
    tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2018-19787). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-27783 python-lxml: mXSS due to the use of improper parser
    tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2020-27783). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-28957 python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS
    tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2021-28957). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-43818 python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through
    tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2021-43818). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-2309 lxml: NULL Pointer Dereference in lxml
    tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2022-2309). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 7 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing PYSEC-2021-421 Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
    /workdirs/scan-ff8ba564-ee88-402d-9264-e80fb7d0618f/tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2021-42771). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2018-12 An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as
    /workdirs/scan-ff8ba564-ee88-402d-9264-e80fb7d0618f/tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2018-19787). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-62 A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A re
    /workdirs/scan-ff8ba564-ee88-402d-9264-e80fb7d0618f/tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2020-27783). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-19 An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attrib
    /workdirs/scan-ff8ba564-ee88-402d-9264-e80fb7d0618f/tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2021-28957). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-852 lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content
    /workdirs/scan-ff8ba564-ee88-402d-9264-e80fb7d0618f/tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2021-43818). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-230 NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlie
    /workdirs/scan-ff8ba564-ee88-402d-9264-e80fb7d0618f/tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2022-2309). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-87 lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML inp
    /workdirs/scan-ff8ba564-ee88-402d-9264-e80fb7d0618f/tools/l10n/android2po/requirements.txt
    A package you depend on has a known security hole (CVE-2026-41066). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.