wonder-sk/pdal

scanned 2026-08-09 · git 7de1efa

1 of 6 checks flagged a security issue

🔴 Needs attention

Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies✓Known OSS vulnerabilities27Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 27 found · 3 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious PYSEC-2026-366 Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2026-44727). Fix: Update that package to its patched version.
Serious CVE-2025-66570 cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2025-66570). Fix: Update that package to its patched version.
Serious CVE-2026-45372 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2026-45372). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
Worth fixing PYSEC-2023-272 The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests c

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2023-49080). Fix: Update that package to its patched version.
Worth fixing PYSEC-2024-165 The Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows use

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2024-35178). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-2187 Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2026-40110). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-2532 Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2026-5422). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-3472 jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2026-6657). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-67 Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redi

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2025-61669). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-68 Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_di

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2026-35397). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-69 Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runti

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2026-40934). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-1691 nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2025-53000). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-2229 The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intende

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2026-39377). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-2230 The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markd

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/doc/requirements.txt

A package you depend on has a known security hole (CVE-2026-39378). Fix: Update that package to its patched version.
Worth fixing CVE-2025-66577 cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2025-66577). Fix: Update that package to its patched version.
Worth fixing CVE-2026-21428 cpp-httplib has CRLF injection in http headers

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2026-21428). Fix: Update that package to its patched version.
Worth fixing CVE-2026-22776 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2026-22776). Fix: Update that package to its patched version.
Worth fixing CVE-2026-28434 cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2026-28434). Fix: Update that package to its patched version.
Worth fixing CVE-2026-28435 Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2026-28435). Fix: Update that package to its patched version.
Worth fixing CVE-2026-29076 cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2026-29076). Fix: Update that package to its patched version.
Worth fixing CVE-2026-31870 cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2026-31870). Fix: Update that package to its patched version.
Worth fixing CVE-2026-32627 cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2026-32627). Fix: Update that package to its patched version.
Worth fixing CVE-2026-33745 cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2026-33745). Fix: Update that package to its patched version.
Worth fixing CVE-2026-34441 cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body

/workdirs/scan-2877157f-5147-47d7-b2bc-bda6a6d91952/vendor/gtest

A package you depend on has a known security hole (CVE-2026-34441). Fix: Update that package to its patched version.

… 2 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.