gitsafehub
github.com/uber/peloton ↗

uber/peloton

scanned 2026-08-11 · git a69e935
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets8Vulnerable dependencies6Known OSS vulnerabilities32Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ 8 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    pkg/common/logging/secrets_formatter.go:65
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    pkg/common/logging/secrets_formatter.go:65
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    pkg/hostmgr/matcher_test.go:572
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    pkg/hostmgr/summary/summary_test.go:798
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    pkg/jobmgr/task/placement/placement_test.go:64
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    pkg/placement/plugins/mimir/strategy_test.go:179
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    tests/integration/batch_job_test/test_job_constraints.py:86
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    tests/integration/stateless_job_test/test_placement.py:187
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 6 found · 2 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code
    tools/deploy/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious CVE-2020-14343 PyYAML: incomplete fix for CVE-2020-1747
    tools/deploy/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-68146 filelock: filelock: Time-of-Check-Time-of-Use (TOCTOU) race condition and symlink attack allows arbitrary file corruption or truncation
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-68146). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-22701 filelock: filelock Time-of-Check-Time-of-Use (TOCTOU) in SoftFileLock
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-22701). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-71176 pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-71176 pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling
    tests/requirements.txt
    A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 32 found · 4 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/tools/deploy/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/tools/deploy/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/tools/vcluster/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/tools/vcluster/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-8 The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file wit
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2014-1402). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-82 FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2014-0012). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2019-217 In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2019-10906). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2019-220 In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2016-10745). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-66 This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1473 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1474 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1475 Jinja has a sandbox breakout through indirect reference to format method
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1374 filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2026-22701). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1375 filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2025-68146). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1845 pytest has vulnerable tmpdir handling
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-92 A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying m
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2020-29651). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-43012 Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2022-40897). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2025-49 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to versio
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2025-47273). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1918 setuptools vulnerable to Command Injection via package URL
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2024-6345). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-3447 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude,
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/requirements.txt
    A package you depend on has a known security hole (CVE-2026-59890). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1845 pytest has vulnerable tmpdir handling
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/tests/requirements.txt
    A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-8 The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file wit
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/tools/vcluster/requirements.txt
    A package you depend on has a known security hole (CVE-2014-1402). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-82 FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/tools/vcluster/requirements.txt
    A package you depend on has a known security hole (CVE-2014-0012). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2019-217 In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
    /workdirs/scan-82ef0802-5a1d-4ab5-a815-0c361327e0ea/tools/vcluster/requirements.txt
    A package you depend on has a known security hole (CVE-2019-10906). Fix: Update that package to its patched version.
… 7 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.