gitsafehub
github.com/zhuozhuocrayon/djangocli ↗

zhuozhuocrayon/djangocli

scanned 2026-08-10 · git c5b40c4
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secretsVulnerable dependencies25Known OSS vulnerabilities109Risky code patternsMalicious dependenciesProject health

Security checks

Leaked secrets — Gitleaks none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivy 25 found · 2 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2021-35042 django: potential SQL injection via unsanitized QuerySet.order_by() input
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-35042). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-31542 django: Potential directory-traversal via uploaded files
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-31542). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-33571 django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-33571). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-36359 An issue was discovered in the HTTP FileResponse class in Django 3.2 b ...
    requirements.txt
    A package you depend on has a known security hole (CVE-2022-36359). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-57833 django: Django SQL injection in FilteredRelation column aliases
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-64458 Django: Denial-of-service vulnerability in Django on Windows
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-64458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-28658 django: potential directory-traversal via uploaded files
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-28658). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-32052 django: header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-32052). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-3281 django: Potential directory-traversal via archive.extract()
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-3281). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-33203 django: Potential directory traversal via ``admindocs``
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-33203). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-44420 django: potential bypass of an upstream access control based on URL paths
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-44420). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-45231 python-django: Potential user email enumeration via response status on password reset
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-48432 django: Django Path Injection Vulnerability
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-48432). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53877 django: Django: Information disclosure via heap buffer over-read in GDALRaster
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-53877). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53878 django: Django: HTTP header injection via DomainNameValidator accepting newlines
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-53878). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-23727 celery: stored command injection vulnerability may allow privileges escalation
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-23727). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-1135 python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-1135). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-6827 gunicorn: HTTP Request Smuggling in benoitc/gunicorn
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-6827). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-28684 python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-28684). Fix: Update that package to its patched version.
  • Minor CVE-2026-48587 django: Django: Information disclosure via improper handling of Vary header whitespace
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-48587). Fix: Update that package to its patched version.
  • Minor CVE-2026-48588 django: Django: Information disclosure due to improper caching of Set-Cookie responses
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-48588). Fix: Update that package to its patched version.
  • Minor CVE-2026-6873 python-django: Django: Information disclosure via non-injective cookie salt derivation
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-6873). Fix: Update that package to its patched version.
  • Minor CVE-2026-8404 Django: Django: Information disclosure due to improper handling of Cache-Control directives
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-8404). Fix: Update that package to its patched version.
  • Minor CVE-2024-21520 djangorestframework: Cross-site Scripting (XSS) via break_long_headers
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-21520). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scanner 109 found · 7 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2021-109 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2021-35042). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-109 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/support-files/deploy/dev/requirements.txt
    A package you depend on has a known security hole (CVE-2021-35042). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/support-files/deploy/dev/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-109 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/support-files/requirements_complete.txt
    A package you depend on has a known security hole (CVE-2021-35042). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/support-files/requirements_complete.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious PYSEC-2024-187 virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/support-files/requirements_complete.txt
    A package you depend on has a known security hole (CVE-2024-53899). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-439 In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2021-44420). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-6 In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2021-28658). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-7 In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2021-31542). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-8 In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2021-32052). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-9 In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal v
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2021-3281). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-98 Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the exist
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2021-33203). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-99 In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This ma
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2021-33571). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1297 Django allows enumeration of user e-mail addresses
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6w2r-r2m5-xq5w Django is subject to SQL injection through its column aliases
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7xr5-9hcq-chf9 Django Improper Output Neutralization for Logs vulnerability
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2025-48432). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8qcx-xf44-272x Django: DomainNameValidator permits newline characters that may enable HTTP header injection
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2026-53878). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8x94-hmjh-97hq Django vulnerable to Reflected File Download attack
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2022-36359). Fix: Update that package to its patched version.
  • Worth fixing GHSA-crhf-3pfg-w68w Django: GDALRaster may over-read heap memory when constructed from bytes
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2026-53877). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qw25-v68c-qjf3 Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64458). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-858 This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized.
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2021-23727). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1304 Cross-site Scripting in djangorestframework
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2024-21520). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1433 Gunicorn HTTP Request/Response Smuggling vulnerability
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2024-6827). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1434 Request smuggling leading to endpoint restriction bypass in Gunicorn
    /workdirs/scan-2873522a-0b51-450e-9733-0ee17414b05b/requirements.txt
    A package you depend on has a known security hole (CVE-2024-1135). Fix: Update that package to its patched version.
… 84 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrep none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddog timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecard didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.