xtc002007/DeepSeekCode

scanned 2026-07-26 · git 106ceaf

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies14Known OSS vulnerabilities27Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 14 found · 1 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2026-34987 wasmtime: bytecodealliance/wasmtime: Wasmtime: Arbitrary code execution via incorrect memory offset handling in Winch compiler

Cargo.lock

A package you depend on has a known security hole (CVE-2026-34987). Fix: Update that package to its patched version.
Worth fixing CVE-2026-24116 Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and ...

Cargo.lock

A package you depend on has a known security hole (CVE-2026-24116). Fix: Update that package to its patched version.
Worth fixing CVE-2026-27204 wasmtime: Wasmtime: Denial of Service via guest-controlled resource exhaustion in WASI host interfaces

Cargo.lock

A package you depend on has a known security hole (CVE-2026-27204). Fix: Update that package to its patched version.
Worth fixing CVE-2026-27572 wasmtime: Wasmtime: Denial of Service via excessive HTTP header fields

Cargo.lock

A package you depend on has a known security hole (CVE-2026-27572). Fix: Update that package to its patched version.
Worth fixing CVE-2026-34941 wasmtime: Wasmtime: Denial of Service and potential information disclosure via incorrect UTF-16 string validation

Cargo.lock

A package you depend on has a known security hole (CVE-2026-34941). Fix: Update that package to its patched version.
Worth fixing CVE-2026-34942 wasmtime: Wasmtime: Denial of Service via improper string alignment verification

Cargo.lock

A package you depend on has a known security hole (CVE-2026-34942). Fix: Update that package to its patched version.
Worth fixing CVE-2026-34943 Wasmtime: Wasmtime: Denial of Service due to malformed flags-typed component model value processing

Cargo.lock

A package you depend on has a known security hole (CVE-2026-34943). Fix: Update that package to its patched version.
Worth fixing CVE-2026-34944 wasmtime: Wasmtime: Denial of Service due to out-of-bounds read during WebAssembly compilation

Cargo.lock

A package you depend on has a known security hole (CVE-2026-34944). Fix: Update that package to its patched version.
Worth fixing CVE-2026-34946 wasmtime: Wasmtime: Denial of Service via WebAssembly compilation error

Cargo.lock

A package you depend on has a known security hole (CVE-2026-34946). Fix: Update that package to its patched version.
Worth fixing CVE-2026-35186 Wasmtime: github.com/bytecodealliance/wasmtime: Wasmtime: Denial of Service and potential information disclosure via Winch compiler type confusion

Cargo.lock

A package you depend on has a known security hole (CVE-2026-35186). Fix: Update that package to its patched version.
Worth fixing CVE-2026-35195 Wasmtime: Wasmtime: Data corruption and potential arbitrary code execution via unvalidated memory reallocation

Cargo.lock

A package you depend on has a known security hole (CVE-2026-35195). Fix: Update that package to its patched version.
Minor CVE-2025-64345 wasmtime: Wasmtime unsound API access to shared linear memory

Cargo.lock

A package you depend on has a known security hole (CVE-2025-64345). Fix: Update that package to its patched version.
Minor CVE-2026-34945 wasmtime: winch: Wasmtime Winch compiler: Information disclosure via incorrect table.size instruction translation

Cargo.lock

A package you depend on has a known security hole (CVE-2026-34945). Fix: Update that package to its patched version.
Minor CVE-2026-34988 wasmtime: Wasmtime: Information disclosure due to improper memory handling in pooling allocator

Cargo.lock

A package you depend on has a known security hole (CVE-2026-34988). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 27 found · 2 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious RUSTSEC-2026-0095 Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-34987). Fix: Update that package to its patched version.
Serious RUSTSEC-2026-0096 Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-34971). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0194 Quadratic run time when checking a start tag for duplicate attribute names

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0195 Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0194 Quadratic run time when checking a start tag for duplicate attribute names

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0195 Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2023-0071 Marvin Attack: potential key recovery through timing sidechannels

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2023-49092). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0006 Wasmtime segfault or unused out-of-sandbox load with `f64.copysign` operator on x86-64

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-24116). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0020 Guest-controlled resource exhaustion in WASI implementations

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-27204). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0021 Panic adding excessive fields to a `wasi:http/types.fields` instance

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-27572). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0085 Panic when lifting `flags` component value

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-34943). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0086 Host data leakage with 64-bit tables and Winch

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-34945). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0087 Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-34944). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0089 Host panic when Winch compiler executes `table.fill`

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-34946). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0091 Out-of-bounds write or crash when transcoding component model strings

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-35195). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0092 Panic when transcoding misaligned component model UTF-16 strings

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-34942). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0093 Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-34941). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0094 Improperly masked return value from `table.grow` with Winch compiler backend

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-35186). Fix: Update that package to its patched version.
Minor RUSTSEC-2025-0046 Host panic with `fd_renumber` WASIp1 function

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2025-53901). Fix: Update that package to its patched version.
Minor RUSTSEC-2025-0118 Unsound API access to a WebAssembly shared linear memory

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2025-64345). Fix: Update that package to its patched version.
Minor RUSTSEC-2026-0088 Data leakage between pooling allocator instances

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole (CVE-2026-34988). Fix: Update that package to its patched version.
FYI RUSTSEC-2025-0057 fxhash - no longer maintained

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
FYI RUSTSEC-2024-0436 paste - no longer maintained

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
FYI RUSTSEC-2026-0173 proc-macro-error2 is unmaintained

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
FYI RUSTSEC-2026-0206 `rustybuzz` is unmaintained

/workdirs/scan-8165f3a4-9f62-4677-b10b-d850a615e2a9/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.

… 2 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.