gitsafehub
github.com/zanieb/srs ↗

zanieb/srs

scanned 2026-08-13 · git b0589c1
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies59Known OSS vulnerabilities184Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 59 found · 1 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2026-27699 basic-ftp: basic-ftp: File overwrite due to path traversal
    rust/yarn.lock
    A package you depend on has a known security hole (CVE-2026-27699). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45784 rust-openssl: rust-openssl: Heap Corruption from Incorrect Buffer Sizing
    cranelift/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-45784). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3pv8-6f4r-ffg2 tar has a PAX header desynchronization issue
    cranelift/Cargo.lock
    A package you depend on has a known security hole (GHSA-3pv8-6f4r-ffg2). Fix: Update that package to its patched version.
  • Worth fixing GHSA-wwq9-3cpr-mm53 Borsh serialization of HashMap is non-canonical
    cranelift/crates/wasi-nn/examples/classification-component-onnx/Cargo.lock
    A package you depend on has a known security hole (GHSA-wwq9-3cpr-mm53). Fix: Update that package to its patched version.
  • Worth fixing GHSA-vfvv-c25p-m7mm rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution
    rust/Cargo.lock
    A package you depend on has a known security hole (GHSA-vfvv-c25p-m7mm). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3pv8-6f4r-ffg2 tar has a PAX header desynchronization issue
    rust/Cargo.lock
    A package you depend on has a known security hole (GHSA-3pv8-6f4r-ffg2). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7gcf-g7xr-8hxj serde_with: KeyValueMap serialization panics on empty sequence or map entries
    rust/library/stdarch/Cargo.lock
    A package you depend on has a known security hole (GHSA-7gcf-g7xr-8hxj). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3pv8-6f4r-ffg2 tar has a PAX header desynchronization issue
    rust/src/bootstrap/Cargo.lock
    A package you depend on has a known security hole (GHSA-3pv8-6f4r-ffg2). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25541 Bytes is a utility library for working with bytes. From version 1.2.1 ...
    rust/src/ci/citool/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-25541). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-4432 ring: Some AES functions may panic when overflow checking is enabled in ring
    rust/src/ci/citool/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-4432). Fix: Update that package to its patched version.
  • Worth fixing GHSA-82j2-j2ch-gfr8 rustls-webpki: Denial of service via panic on malformed CRL BIT STRING
    rust/src/ci/citool/Cargo.lock
    A package you depend on has a known security hole (GHSA-82j2-j2ch-gfr8). Fix: Update that package to its patched version.
  • Worth fixing GHSA-pwjx-qhcg-rvj4 webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic
    rust/src/ci/citool/Cargo.lock
    A package you depend on has a known security hole (GHSA-pwjx-qhcg-rvj4). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25727 time: time affected by a stack exhaustion denial of service attack
    rust/src/ci/citool/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-25727). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-50185 RustCrypto CMOV provides conditional move CPU intrinsics which are gua ...
    rust/src/tools/cargo/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-50185). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42327 rust-openssl: rust-openssl: Arbitrary code execution via specially crafted certificate
    rust/src/tools/cargo/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-42327). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44662 rust-openssl provides OpenSSL bindings for the Rust programming langua ...
    rust/src/tools/cargo/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-44662). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45784 rust-openssl: rust-openssl: Heap Corruption from Incorrect Buffer Sizing
    rust/src/tools/cargo/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-45784). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3pv8-6f4r-ffg2 tar has a PAX header desynchronization issue
    rust/src/tools/cargo/Cargo.lock
    A package you depend on has a known security hole (GHSA-3pv8-6f4r-ffg2). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
    rust/src/tools/rust-analyzer/editors/code/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
    rust/src/tools/rust-analyzer/editors/code/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    rust/src/tools/rust-analyzer/editors/code/package-lock.json
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2rxc-gjrp-vjhx Unsoundness in anstream
    rust/src/tools/rustfmt/Cargo.lock
    A package you depend on has a known security hole (GHSA-2rxc-gjrp-vjhx). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-36465 An issue was discovered in the generic-array crate before 0.13.3 for R ...
    rust/tests/run-make-cargo/thumb-none-qemu/example/Cargo.lock
    A package you depend on has a known security hole (CVE-2020-36465). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-36465 An issue was discovered in the generic-array crate before 0.13.3 for R ...
    rust/tests/run-make-cargo/thumb-none-qemu/example/Cargo.lock
    A package you depend on has a known security hole (CVE-2020-36465). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
    rust/yarn.lock
    A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
… 34 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 184 found · 2 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious RUSTSEC-2019-0034 HeaderMap::Drain API is unsound
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/rust/tests/rustdoc-gui/src/lib2/Cargo.lock
    A package you depend on has a known security hole (CVE-2019-25009). Fix: Update that package to its patched version.
  • Serious GHSA-5rq4-664w-9x2c Basic FTP has Path Traversal Vulnerability in its downloadToDir() method
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/rust/yarn.lock
    A package you depend on has a known security hole (CVE-2026-27699). Fix: Update that package to its patched version.
  • Worth fixing GHSA-phqj-4mhp-q6mq rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-45784). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0188 WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-58494). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3xgq-45jj-v275 Regular Expression Denial of Service (ReDoS) in cross-spawn
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2024-21538). Fix: Update that package to its patched version.
  • Worth fixing GHSA-25h7-pfq9-p65f flatted vulnerable to unbounded recursion DoS in parse() revive phase
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2026-32141). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rf6f-7fwh-wjgh Prototype Pollution via parse() in NodeJS flatted
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33228). Fix: Update that package to its patched version.
  • Worth fixing GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59869). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2026-53550). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<)
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2025-64718). Fix: Update that package to its patched version.
  • Worth fixing GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/explorer/package-lock.json
    A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2024-0402 Borsh serialization of HashMap is non-canonical
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/cranelift/crates/wasi-nn/examples/classification-component-onnx/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0122 Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/rust/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0103 Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/rust/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-6654). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0194 Quadratic run time when checking a start tag for duplicate attribute names
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/rust/library/stdarch/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0195 Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/rust/library/stdarch/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0194 Quadratic run time when checking a start tag for duplicate attribute names
    /workdirs/scan-dfb40225-5e75-4295-9d63-f80e2e3a2829/rust/library/stdarch/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
… 159 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.