Skip to content

Preview/OSV scanner #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

alexcoderabbitai wants to merge 2 commits into main

from preview/osv-scanner

Open

Preview/OSV scanner #82

Changes from all commits

Commits

Show all changes

Select commit Hold shift + click to select a range

Preview/google osv-scanner

alexcoderabbitai Aug 14, 2025

add bad python libraries

alexcoderabbitai Sep 26, 2025

File filter

Filter by extension

Conversations

Jump to

Jump to file

Failed to load files.

Loading

Diff view

Diff view

6 changes: 6 additions & 0 deletions requirements.txt

Show comments View file Open in desktop

Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,6 @@
	ecdsa==0.19.1
	fastapi==0.104.1
	jinja2==3.1.2
	python-jose==3.3.0
	python-multipart==0.0.6
	starlette==0.27.0
Comment on lines +1 to +6 Copy link @coderabbitai coderabbitai bot Sep 26, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. ⚠️ Potential issue \| 🔴 Critical Blocker: Newly added pins introduce known high/critical CVEs Every dependency added in this hunk is flagged by OSV/GHSA with active HIGH or CRITICAL vulnerabilities: `ecdsa==0.19.1` → GHSA-wj6h-64fc-37mp (Minerva timing attack). `fastapi==0.104.1` → PYSEC-2024-38 (security advisory published for this release). `jinja2==3.1.2` → multiple sandbox breakout/XSS advisories (GHSA-cpwx-vrp4-4pq7, GHSA-gmj6-6f8f-6699, GHSA-h5c8-rqwp-cp95, GHSA-h75v-3vvj-5mfj, GHSA-q2x7-8rv6-6q7h). `python-jose==3.3.0` → critical algorithm-confusion and decompression DoS issues (GHSA-6c5p-j8vq-pqhj, GHSA-cjwg-qfpm-7377, PYSEC-2024-232/233). `python-multipart==0.0.6` → multiple multipart parsing DoS advisories (GHSA-2jv5-9r88-3w3p, GHSA-59g5-xgcq-4qw3). `starlette==0.27.0` → multipart DoS advisories (GHSA-2c2j-9gv5-cj73, GHSA-f96h-pmfr-66vw). Please update each pin to a version that is listed as patched in the corresponding advisory (or apply an alternative mitigation/library if no fixed release exists yet) before merging. Right now this PR would ship known-vulnerable packages into production. 🧰 Tools 🪛 OSV Scanner (2.2.2) [HIGH] 1-1: ecdsa 0.19.1: Minerva timing attack on P-256 in python-ecdsa (GHSA-wj6h-64fc-37mp) [HIGH] 2-2: fastapi 0.104.1: undefined (PYSEC-2024-38) [HIGH] 3-3: jinja2 3.1.2: Jinja2 vulnerable to sandbox breakout through attr filter selecting format method (GHSA-cpwx-vrp4-4pq7) [HIGH] 3-3: jinja2 3.1.2: Jinja has a sandbox breakout through malicious filenames (GHSA-gmj6-6f8f-6699) [HIGH] 3-3: jinja2 3.1.2: Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter (GHSA-h5c8-rqwp-cp95) [HIGH] 3-3: jinja2 3.1.2: Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter (GHSA-h75v-3vvj-5mfj) [HIGH] 3-3: jinja2 3.1.2: Jinja has a sandbox breakout through indirect reference to format method (GHSA-q2x7-8rv6-6q7h) [CRITICAL] 4-4: python-jose 3.3.0: undefined (PYSEC-2024-232) [CRITICAL] 4-4: python-jose 3.3.0: undefined (PYSEC-2024-233) [CRITICAL] 4-4: python-jose 3.3.0: python-jose algorithm confusion with OpenSSH ECDSA keys (GHSA-6c5p-j8vq-pqhj) [CRITICAL] 4-4: python-jose 3.3.0: python-jose denial of service via compressed JWE content (GHSA-cjwg-qfpm-7377) [HIGH] 5-5: python-multipart 0.0.6: python-multipart vulnerable to Content-Type Header ReDoS (GHSA-2jv5-9r88-3w3p) [HIGH] 5-5: python-multipart 0.0.6: Denial of service (DoS) via deformation `multipart/form-data` boundary (GHSA-59g5-xgcq-4qw3) [HIGH] 6-6: starlette 0.27.0: Starlette has possible denial-of-service vector when parsing large files in multipart forms (GHSA-2c2j-9gv5-cj73) [HIGH] 6-6: starlette 0.27.0: Starlette Denial of service (DoS) via multipart/form-data (GHSA-f96h-pmfr-66vw) 🤖 Prompt for AI Agents In requirements.txt lines 1-6 the newly added exact pins include versions with known HIGH/CRITICAL CVEs (ecdsa 0.19.1, fastapi 0.104.1, jinja2 3.1.2, python-jose 3.3.0, python-multipart 0.0.6, starlette 0.27.0); update each pinned version to the minimum fixed/patched release cited in the corresponding advisories (or replace with an alternative maintained library if no patched release exists), verify the chosen versions against OSV/GHSA advisories, run dependency checks (e.g., pip-audit/safety or GitHub Dependabot reports) to confirm vulnerabilities are resolved, and update the requirements file with the new safe pins before merging.