zsailer/jupyter-chat

scanned 2026-08-15 · git 0c23f2f

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies56Known OSS vulnerabilities101Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 56 found · 2 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2026-9277 shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators

yarn.lock

A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb

yarn.lock

A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
Worth fixing CVE-2026-44728 Babel is a compiler for writing next generation JavaScript. From 7.12. ...

yarn.lock

A package you depend on has a known security hole (CVE-2026-44728). Fix: Update that package to its patched version.
Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference

yarn.lock

A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference

yarn.lock

A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

yarn.lock

A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
Worth fixing CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

yarn.lock

A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
Worth fixing CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

yarn.lock

A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

yarn.lock

A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
Worth fixing CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

yarn.lock

A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
Worth fixing CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

yarn.lock

A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
Worth fixing CVE-2026-33750 brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern

yarn.lock

A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
Worth fixing CVE-2024-21538 cross-spawn: regular expression denial of service

yarn.lock

A package you depend on has a known security hole (CVE-2024-21538). Fix: Update that package to its patched version.
Worth fixing CVE-2026-13676 fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization

yarn.lock

A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
Worth fixing CVE-2026-16221 fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency

yarn.lock

A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
Worth fixing CVE-2026-18446 fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority

yarn.lock

A package you depend on has a known security hole (CVE-2026-18446). Fix: Update that package to its patched version.
Worth fixing CVE-2026-6321 fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies

yarn.lock

A package you depend on has a known security hole (CVE-2026-6321). Fix: Update that package to its patched version.
Worth fixing CVE-2026-6322 fast-uri: fast-uri: URI authority bypass due to improper delimiter handling

yarn.lock

A package you depend on has a known security hole (CVE-2026-6322). Fix: Update that package to its patched version.
Worth fixing CVE-2026-12143 form-data: form-data: Form field override via CRLF injection

yarn.lock

A package you depend on has a known security hole (CVE-2026-12143). Fix: Update that package to its patched version.
Worth fixing CVE-2025-64756 glob: glob: Command Injection Vulnerability via Malicious Filenames

yarn.lock

A package you depend on has a known security hole (CVE-2025-64756). Fix: Update that package to its patched version.
Worth fixing CVE-2026-69192 ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

yarn.lock

A package you depend on has a known security hole (CVE-2026-69192). Fix: Update that package to its patched version.
Worth fixing CVE-2026-42338 ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

yarn.lock

A package you depend on has a known security hole (CVE-2026-42338). Fix: Update that package to its patched version.
Worth fixing CVE-2026-59869 js-yaml: js-yaml: Denial of Service via crafted YAML documents

yarn.lock

A package you depend on has a known security hole (CVE-2026-59869). Fix: Update that package to its patched version.
Worth fixing GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

yarn.lock

A package you depend on has a known security hole (GHSA-5p4m-2wfm-xmqj). Fix: Update that package to its patched version.
Worth fixing CVE-2026-53550 js-yaml: js-yaml: Denial of Service via crafted YAML merge keys

yarn.lock

A package you depend on has a known security hole (CVE-2026-53550). Fix: Update that package to its patched version.

… 31 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 101 found · 3 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/yarn.lock

A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/yarn.lock

A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/docs/requirements.txt

A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-1691 nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/docs/requirements.txt

A package you depend on has a known security hole (CVE-2025-53000). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-2229 The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intende

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/docs/requirements.txt

A package you depend on has a known security hole (CVE-2026-39377). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-2230 The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markd

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/docs/requirements.txt

A package you depend on has a known security hole (CVE-2026-39378). Fix: Update that package to its patched version.
Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
Worth fixing GHSA-mwp4-54f8-5fhr ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-69192). Fix: Update that package to its patched version.
Worth fixing GHSA-v2v4-37r5-5v8g ip-address has XSS in Address6 HTML-emitting methods

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-42338). Fix: Update that package to its patched version.
Worth fixing GHSA-28wg-ghj8-5hjv nanoid: non-secure generators can loop indefinitely with negative size

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-67214). Fix: Update that package to its patched version.
Worth fixing GHSA-2v37-7h3g-55p8 nanoid: custom generators can loop indefinitely when size is zero

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-67213). Fix: Update that package to its patched version.
Worth fixing GHSA-7mvr-c777-76hp Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2025-59288). Fix: Update that package to its patched version.
Worth fixing GHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-45623). Fix: Update that package to its patched version.
Worth fixing GHSA-fxqj-rqcc-2cmp PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-69153). Fix: Update that package to its patched version.
Worth fixing GHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-41305). Fix: Update that package to its patched version.
Worth fixing GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-73646). Fix: Update that package to its patched version.
Worth fixing GHSA-vccv-cmxp-4j9h sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-53606). Fix: Update that package to its patched version.
Worth fixing GHSA-5xpp-75jx-m839 systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-50289). Fix: Update that package to its patched version.
Worth fixing GHSA-hvx9-hwr7-wjj9 Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-44724). Fix: Update that package to its patched version.
Worth fixing GHSA-34x7-hfp2-rc4v node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-24842). Fix: Update that package to its patched version.
Worth fixing GHSA-83g3-92jg-28cx Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

/workdirs/scan-5b76498b-0de6-4d19-9510-f9dd45f3db12/ui-tests/yarn.lock

A package you depend on has a known security hole (CVE-2026-26960). Fix: Update that package to its patched version.

… 76 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout; pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.