Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

kvcache-ai/ktransformers

https://github.com/kvcache-ai/ktransformers · scanned 2026-07-23 19:43 UTC (1 month, 2 weeks ago)

626 raw signals (0 security + 626 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 2 weeks ago · v4 · 606 actionable findings from 1 signal source. 20 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
65.6
/100
Security checks
66
0 findings
System graph
66
100.0% cov · 606 findings
Critical
18
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: severity: medium × excluding tests × Reset all
Severity: Critical 18 High 143 Medium 272 Low 147 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 606 Crowd 0 Layer: Software 15 Frontend 6 Security 398 Hardware 6 Cicd 3 Quality 108 Dependencies 70
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 65.6/100 with 100.0% coverage. It contains 6625 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 626 findings — concentrated in security (398), quality (108), dependencies (70). Risk profile is high: 18 critical, 143 high, 280 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 272 of 606 actionable findings. 626 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

medium System graph security Semgrep conf 0.55 avoid pickle — archive/kt-sft/ktransformers/server/backend/interfaces/balance_serve.py:322
Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. Rule: python.lang.security.deserial…
archive/kt-sft/ktransformers/server/backend/interfaces/balance_serve.py:322 SecurityPythonNon production context
medium System graph security Semgrep conf 0.55 avoid pickle — archive/kt-sft/ktransformers/server/balance_serve/inference/distributed/custom_all_reduce_utils.py:237
Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. Rule: python.lang.security.deserial…
archive/kt-sft/ktransformers/server/balance_serve/inference/distributed/custom_all_reduce_utils.py:237 SecurityPythonNon production context
medium System graph security Semgrep conf 0.55 avoid pickle — archive/kt-sft/ktransformers/server/balance_serve/inference/distributed/parallel_state.py:567
Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. Rule: python.lang.security.deserial…
archive/kt-sft/ktransformers/server/balance_serve/inference/distributed/parallel_state.py:567 SecurityPythonNon production context
medium System graph security Semgrep conf 0.55 avoid pickle — archive/kt-sft/ktransformers/server/balance_serve/inference/distributed/utils.py:123
Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. Rule: python.lang.security.deserial…
archive/kt-sft/ktransformers/server/balance_serve/inference/distributed/utils.py:123 SecurityPythonNon production context
medium System graph security Semgrep conf 0.55 avoid pickle — archive/kt-sft/ktransformers/server/balance_serve/sched_rpc.py:51
Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. Rule: python.lang.security.deserial…
archive/kt-sft/ktransformers/server/balance_serve/sched_rpc.py:51 SecurityPythonNon production context
medium System graph security Semgrep conf 0.55 avoid pickle — archive/ktransformers/server/backend/interfaces/balance_serve.py:489
Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. Rule: python.lang.security.deserial…
archive/ktransformers/server/backend/interfaces/balance_serve.py:489 SecurityPythonNon production context
medium System graph security Semgrep conf 0.55 avoid pickle — archive/ktransformers/server/balance_serve/inference/distributed/custom_all_reduce_utils.py:237
Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. Rule: python.lang.security.deserial…
archive/ktransformers/server/balance_serve/inference/distributed/custom_all_reduce_utils.py:237 SecurityPythonNon production context
medium System graph security Semgrep conf 0.55 avoid pickle — archive/ktransformers/server/balance_serve/inference/distributed/parallel_state.py:567
Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. Rule: python.lang.security.deserial…
archive/ktransformers/server/balance_serve/inference/distributed/parallel_state.py:567 SecurityPythonNon production context
medium System graph security Semgrep conf 0.55 avoid pickle — archive/ktransformers/server/balance_serve/inference/distributed/utils.py:123
Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. Rule: python.lang.security.deserial…
archive/ktransformers/server/balance_serve/inference/distributed/utils.py:123 SecurityPythonNon production context
medium System graph security Semgrep conf 0.55 avoid pickle — archive/ktransformers/server/balance_serve/sched_rpc.py:70
Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. Rule: python.lang.security.deserial…
archive/ktransformers/server/balance_serve/sched_rpc.py:70 SecurityPythonNon production context
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2022-33987: got 8.3.2 — archive/kt-sft/ktransformers/website/package-lock.json
nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket. Package: got Installed: 8.3.2 Fixed in: 12.1.0, 11.8.5 Severity: MEDIUM Fix: Upgrade got to 12.1.0, 11.8.5
VulnCve 2022 33987
medium System graph security Trivy conf 1.00 CVE-2022-33987: got 8.3.2 — archive/ktransformers/website/package-lock.json
nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket. Package: got Installed: 8.3.2 Fixed in: 12.1.0, 11.8.5 Severity: MEDIUM Fix: Upgrade got to 12.1.0, 11.8.5
VulnCve 2022 33987
medium System graph security Trivy conf 1.00 CVE-2024-4067: micromatch 3.1.10 — archive/kt-sft/ktransformers/website/package-lock.json
micromatch: vulnerable to Regular Expression Denial of Service The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passin…
VulnCve 2024 4067
medium System graph security Trivy conf 1.00 CVE-2024-4067: micromatch 3.1.10 — archive/ktransformers/website/package-lock.json
micromatch: vulnerable to Regular Expression Denial of Service The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passin…
VulnCve 2024 4067
medium System graph security Trivy conf 1.00 CVE-2024-4067: micromatch 4.0.5 — archive/kt-sft/ktransformers/website/package-lock.json
micromatch: vulnerable to Regular Expression Denial of Service The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passin…
VulnCve 2024 4067
medium System graph security Trivy conf 1.00 CVE-2024-4067: micromatch 4.0.5 — archive/ktransformers/website/package-lock.json
micromatch: vulnerable to Regular Expression Denial of Service The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passin…
VulnCve 2024 4067
medium System graph security Trivy conf 1.00 CVE-2024-43788: webpack 5.91.0 — archive/kt-sft/ktransformers/website/package-lock.json
webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have disc…
VulnCve 2024 43788
medium System graph security Trivy conf 1.00 CVE-2024-43788: webpack 5.91.0 — archive/ktransformers/website/package-lock.json
webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have disc…
VulnCve 2024 43788
medium System graph security Trivy conf 1.00 CVE-2024-52809: @intlify/core-base 9.13.1 — archive/kt-sft/ktransformers/website/package-lock.json
vue-i18n has cross-site scripting vulnerability with prototype pollution vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibili…
VulnCve 2024 52809
medium System graph security Trivy conf 1.00 CVE-2024-52809: @intlify/core-base 9.13.1 — archive/ktransformers/website/package-lock.json
vue-i18n has cross-site scripting vulnerability with prototype pollution vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibili…
VulnCve 2024 52809
medium System graph security Trivy conf 1.00 CVE-2024-52809: vue-i18n 9.13.1 — archive/kt-sft/ktransformers/website/package-lock.json
vue-i18n has cross-site scripting vulnerability with prototype pollution vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibili…
VulnCve 2024 52809
medium System graph security Trivy conf 1.00 CVE-2024-52809: vue-i18n 9.13.1 — archive/ktransformers/website/package-lock.json
vue-i18n has cross-site scripting vulnerability with prototype pollution vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibili…
VulnCve 2024 52809
medium System graph security Trivy conf 1.00 CVE-2024-52810: @intlify/shared 9.13.1 — archive/kt-sft/ktransformers/website/package-lock.json
@intlify/shared Prototype Pollution vulnerability @intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype sett…
VulnCve 2024 52810
medium System graph security Trivy conf 1.00 CVE-2024-52810: @intlify/shared 9.13.1 — archive/ktransformers/website/package-lock.json
@intlify/shared Prototype Pollution vulnerability @intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype sett…
VulnCve 2024 52810
medium System graph security Trivy conf 1.00 CVE-2024-52810: vue-i18n 9.13.1 — archive/kt-sft/ktransformers/website/package-lock.json
@intlify/shared Prototype Pollution vulnerability @intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype sett…
VulnCve 2024 52810
medium System graph security Trivy conf 1.00 CVE-2024-52810: vue-i18n 9.13.1 — archive/ktransformers/website/package-lock.json
@intlify/shared Prototype Pollution vulnerability @intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype sett…
VulnCve 2024 52810
medium System graph security Trivy conf 1.00 CVE-2024-53382: prismjs 1.29.0 — archive/kt-sft/ktransformers/website/package-lock.json
prismjs: DOM Clobbering vulnerability within the Prism library's prism-autoloader plugin Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shado…
VulnCve 2024 53382
medium System graph security Trivy conf 1.00 CVE-2024-53382: prismjs 1.29.0 — archive/ktransformers/website/package-lock.json
prismjs: DOM Clobbering vulnerability within the Prism library's prism-autoloader plugin Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shado…
VulnCve 2024 53382
medium System graph security Trivy conf 1.00 CVE-2024-55565: nanoid 2.1.11 — archive/kt-sft/ktransformers/website/package-lock.json
nanoid: nanoid mishandles non-integer values nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version. Package: nanoid Installed: 2.1.11 Fixed in: 5.0.9, 3.3.8 Severity: MEDIUM Fix: Upgrade nanoid to 5.0.9, 3.3.8
VulnCve 2024 55565
medium System graph security Trivy conf 1.00 CVE-2024-55565: nanoid 2.1.11 — archive/ktransformers/website/package-lock.json
nanoid: nanoid mishandles non-integer values nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version. Package: nanoid Installed: 2.1.11 Fixed in: 5.0.9, 3.3.8 Severity: MEDIUM Fix: Upgrade nanoid to 5.0.9, 3.3.8
VulnCve 2024 55565
medium System graph security Trivy conf 1.00 CVE-2024-55565: nanoid 3.3.7 — archive/kt-sft/ktransformers/website/package-lock.json
nanoid: nanoid mishandles non-integer values nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version. Package: nanoid Installed: 3.3.7 Fixed in: 5.0.9, 3.3.8 Severity: MEDIUM Fix: Upgrade nanoid to 5.0.9, 3.3.8
VulnCve 2024 55565
medium System graph security Trivy conf 1.00 CVE-2024-55565: nanoid 3.3.7 — archive/ktransformers/website/package-lock.json
nanoid: nanoid mishandles non-integer values nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version. Package: nanoid Installed: 3.3.7 Fixed in: 5.0.9, 3.3.8 Severity: MEDIUM Fix: Upgrade nanoid to 5.0.9, 3.3.8
VulnCve 2024 55565
medium System graph security Trivy conf 1.00 CVE-2025-13465: lodash 4.17.21 — archive/kt-sft/ktransformers/website/package-lock.json
lodash: prototype pollution in _.unset and _.omit functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion o…
VulnCve 2025 13465
medium System graph security Trivy conf 1.00 CVE-2025-13465: lodash 4.17.21 — archive/ktransformers/website/package-lock.json
lodash: prototype pollution in _.unset and _.omit functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion o…
VulnCve 2025 13465
medium System graph security Trivy conf 1.00 CVE-2025-13465: lodash-es 4.17.21 — archive/kt-sft/ktransformers/website/package-lock.json
lodash: prototype pollution in _.unset and _.omit functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion o…
VulnCve 2025 13465
medium System graph security Trivy conf 1.00 CVE-2025-13465: lodash-es 4.17.21 — archive/ktransformers/website/package-lock.json
lodash: prototype pollution in _.unset and _.omit functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion o…
VulnCve 2025 13465
medium System graph security Trivy conf 1.00 CVE-2025-15284: qs 6.11.0 — archive/kt-sft/ktransformers/website/package-lock.json
qs: qs: Denial of Service via improper input validation in array parsing Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed…
VulnCve 2025 15284
medium System graph security Trivy conf 1.00 CVE-2025-15284: qs 6.11.0 — archive/ktransformers/website/package-lock.json
qs: qs: Denial of Service via improper input validation in array parsing Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed…
VulnCve 2025 15284
medium System graph security Trivy conf 1.00 CVE-2025-15284: qs 6.12.1 — archive/kt-sft/ktransformers/website/package-lock.json
qs: qs: Denial of Service via improper input validation in array parsing Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed…
VulnCve 2025 15284
medium System graph security Trivy conf 1.00 CVE-2025-15284: qs 6.12.1 — archive/ktransformers/website/package-lock.json
qs: qs: Denial of Service via improper input validation in array parsing Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed…
VulnCve 2025 15284
medium System graph security Trivy conf 1.00 CVE-2025-27789: @babel/helpers 7.24.5 — archive/kt-sft/ktransformers/website/package-lock.json
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel w…
VulnCve 2025 27789
medium System graph security Trivy conf 1.00 CVE-2025-27789: @babel/helpers 7.24.5 — archive/ktransformers/website/package-lock.json
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel w…
VulnCve 2025 27789
medium System graph security Trivy conf 1.00 CVE-2025-27789: @babel/runtime 7.24.5 — archive/kt-sft/ktransformers/website/package-lock.json
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel w…
VulnCve 2025 27789
medium System graph security Trivy conf 1.00 CVE-2025-27789: @babel/runtime 7.24.5 — archive/ktransformers/website/package-lock.json
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel w…
VulnCve 2025 27789
medium System graph security Trivy conf 1.00 CVE-2025-53892: @intlify/core-base 9.13.1 — archive/kt-sft/ktransformers/website/package-lock.json
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, start…
VulnCve 2025 53892
medium System graph security Trivy conf 1.00 CVE-2025-53892: @intlify/core-base 9.13.1 — archive/ktransformers/website/package-lock.json
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, start…
VulnCve 2025 53892
medium System graph security Trivy conf 1.00 CVE-2025-53892: vue-i18n 9.13.1 — archive/kt-sft/ktransformers/website/package-lock.json
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, start…
VulnCve 2025 53892
medium System graph security Trivy conf 1.00 CVE-2025-53892: vue-i18n 9.13.1 — archive/ktransformers/website/package-lock.json
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, start…
VulnCve 2025 53892
medium System graph security Trivy conf 1.00 CVE-2025-57665: element-plus 2.7.3 — archive/kt-sft/ktransformers/website/package-lock.json
Element Plus Link component (el-link) implements insufficient input validation for the href attribute Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. Th…
VulnCve 2025 57665
medium System graph security Trivy conf 1.00 CVE-2025-57665: element-plus 2.7.3 — archive/ktransformers/website/package-lock.json
Element Plus Link component (el-link) implements insufficient input validation for the href attribute Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. Th…
VulnCve 2025 57665
medium System graph security Trivy conf 1.00 CVE-2025-62718: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback …
VulnCve 2025 62718
medium System graph security Trivy conf 1.00 CVE-2025-62718: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback …
VulnCve 2025 62718
medium System graph security Trivy conf 1.00 CVE-2025-64718: js-yaml 3.14.1 — archive/kt-sft/ktransformers/website/package-lock.json
js-yaml: js-yaml prototype pollution in merge js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml …
VulnCve 2025 64718
medium System graph security Trivy conf 1.00 CVE-2025-64718: js-yaml 3.14.1 — archive/ktransformers/website/package-lock.json
js-yaml: js-yaml prototype pollution in merge js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml …
VulnCve 2025 64718
medium System graph security Trivy conf 1.00 CVE-2025-64718: js-yaml 4.1.0 — archive/kt-sft/ktransformers/website/package-lock.json
js-yaml: js-yaml prototype pollution in merge js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml …
VulnCve 2025 64718
medium System graph security Trivy conf 1.00 CVE-2025-64718: js-yaml 4.1.0 — archive/ktransformers/website/package-lock.json
js-yaml: js-yaml prototype pollution in merge js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml …
VulnCve 2025 64718
medium System graph security Trivy conf 1.00 CVE-2025-69873: ajv 6.12.6 — archive/kt-sft/ktransformers/website/package-lock.json
ajv: ReDoS via $data reference ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaS…
VulnCve 2025 69873
medium System graph security Trivy conf 1.00 CVE-2025-69873: ajv 6.12.6 — archive/ktransformers/website/package-lock.json
ajv: ReDoS via $data reference ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaS…
VulnCve 2025 69873
medium System graph security Trivy conf 1.00 CVE-2026-2739: bn.js 4.12.0 — archive/kt-sft/ktransformers/website/package-lock.json
bn.js: bn.js: Denial of Service via calling maskn(0) This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely. Package: bn.j…
VulnCve 2026 2739
medium System graph security Trivy conf 1.00 CVE-2026-2739: bn.js 4.12.0 — archive/ktransformers/website/package-lock.json
bn.js: bn.js: Denial of Service via calling maskn(0) This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely. Package: bn.j…
VulnCve 2026 2739
medium System graph security Trivy conf 1.00 CVE-2026-2739: bn.js 5.2.1 — archive/kt-sft/ktransformers/website/package-lock.json
bn.js: bn.js: Denial of Service via calling maskn(0) This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely. Package: bn.j…
VulnCve 2026 2739
medium System graph security Trivy conf 1.00 CVE-2026-2739: bn.js 5.2.1 — archive/ktransformers/website/package-lock.json
bn.js: bn.js: Denial of Service via calling maskn(0) This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely. Package: bn.j…
VulnCve 2026 2739
medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash 4.17.21 — archive/kt-sft/ktransformers/website/package-lock.json
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…
VulnCve 2026 2950
medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash 4.17.21 — archive/ktransformers/website/package-lock.json
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…
VulnCve 2026 2950
medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash-es 4.17.21 — archive/kt-sft/ktransformers/website/package-lock.json
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…
VulnCve 2026 2950
medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash-es 4.17.21 — archive/ktransformers/website/package-lock.json
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…
VulnCve 2026 2950
medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 2.3.1 — archive/kt-sft/ktransformers/website/package-lock.json
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…
VulnCve 2026 33672
medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 2.3.1 — archive/ktransformers/website/package-lock.json
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…
VulnCve 2026 33672
medium System graph security Trivy conf 1.00 CVE-2026-33750: brace-expansion 1.1.11 — archive/kt-sft/ktransformers/website/package-lock.json
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) caus…
VulnCve 2026 33750
medium System graph security Trivy conf 1.00 CVE-2026-33750: brace-expansion 1.1.11 — archive/ktransformers/website/package-lock.json
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) caus…
VulnCve 2026 33750
medium System graph security Trivy conf 1.00 CVE-2026-33750: brace-expansion 2.0.1 — archive/kt-sft/ktransformers/website/package-lock.json
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) caus…
VulnCve 2026 33750
medium System graph security Trivy conf 1.00 CVE-2026-33750: brace-expansion 2.0.1 — archive/ktransformers/website/package-lock.json
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) caus…
VulnCve 2026 33750
medium System graph security Trivy conf 1.00 CVE-2026-34043: serialize-javascript 6.0.2 — archive/kt-sft/ktransformers/website/package-lock.json
serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exh…
VulnCve 2026 34043
medium System graph security Trivy conf 1.00 CVE-2026-34043: serialize-javascript 6.0.2 — archive/ktransformers/website/package-lock.json
serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exh…
VulnCve 2026 34043
medium System graph security Trivy conf 1.00 CVE-2026-40175: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Axios: Remote Code Execution via Prototype Pollution escalation Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leverag…
VulnCve 2026 40175
medium System graph security Trivy conf 1.00 CVE-2026-40175: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Axios: Remote Code Execution via Prototype Pollution escalation Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leverag…
VulnCve 2026 40175
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.4.38 — archive/kt-sft/ktransformers/website/package-lock.json
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.4.38 — archive/ktransformers/website/package-lock.json
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — archive/kt-sft/ktransformers/website/package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — archive/ktransformers/website/package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 9.0.1 — archive/kt-sft/ktransformers/website/package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 9.0.1 — archive/ktransformers/website/package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-42034: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). …
VulnCve 2026 42034
medium System graph security Trivy conf 1.00 CVE-2026-42034: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). …
VulnCve 2026 42034
medium System graph security Trivy conf 1.00 CVE-2026-42036: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLe…
VulnCve 2026 42036
medium System graph security Trivy conf 1.00 CVE-2026-42036: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLe…
VulnCve 2026 42036
medium System graph security Trivy conf 1.00 CVE-2026-42037: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the…
VulnCve 2026 42037
medium System graph security Trivy conf 1.00 CVE-2026-42037: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the…
VulnCve 2026 42037
medium System graph security Trivy conf 1.00 CVE-2026-42038: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Axios: Information disclosure due to `no_proxy` bypass Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route t…
VulnCve 2026 42038
medium System graph security Trivy conf 1.00 CVE-2026-42038: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Axios: Information disclosure due to `no_proxy` bypass Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route t…
VulnCve 2026 42038
medium System graph security Trivy conf 1.00 CVE-2026-42039: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value pas…
VulnCve 2026 42039
medium System graph security Trivy conf 1.00 CVE-2026-42039: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value pas…
VulnCve 2026 42039
medium System graph security Trivy conf 1.00 CVE-2026-42041: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to…
VulnCve 2026 42041
medium System graph security Trivy conf 1.00 CVE-2026-42041: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to…
VulnCve 2026 42041
medium System graph security Trivy conf 1.00 CVE-2026-42042: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Axios: XSRF token bypass leading to information disclosure Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXS…
VulnCve 2026 42042
medium System graph security Trivy conf 1.00 CVE-2026-42042: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Axios: XSRF token bypass leading to information disclosure Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXS…
VulnCve 2026 42042
medium System graph security Trivy conf 1.00 CVE-2026-42044: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the ap…
VulnCve 2026 42044
medium System graph security Trivy conf 1.00 CVE-2026-42044: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the ap…
VulnCve 2026 42044
medium System graph security Trivy conf 1.00 CVE-2026-44288: @protobufjs/utf8 1.1.0 — archive/kt-sft/ktransformers/website/package-lock.json
protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decode…
VulnCve 2026 44288
medium System graph security Trivy conf 1.00 CVE-2026-44288: @protobufjs/utf8 1.1.0 — archive/ktransformers/website/package-lock.json
protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decode…
VulnCve 2026 44288
medium System graph security Trivy conf 1.00 CVE-2026-44490: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
axios: Axios: Information disclosure and denial of service due to prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency i…
VulnCve 2026 44490
medium System graph security Trivy conf 1.00 CVE-2026-44490: axios 1.7.0 — archive/ktransformers/website/package-lock.json
axios: Axios: Information disclosure and denial of service due to prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency i…
VulnCve 2026 44490
medium System graph security Trivy conf 1.00 CVE-2026-48038: joi 17.13.1 — archive/kt-sft/ktransformers/website/package-lock.json
joi: joi: Denial of Service via uncaught RangeError on deeply nested input through recursive link() schemas joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supp…
VulnCve 2026 48038
medium System graph security Trivy conf 1.00 CVE-2026-48038: joi 17.13.1 — archive/ktransformers/website/package-lock.json
joi: joi: Denial of Service via uncaught RangeError on deeply nested input through recursive link() schemas joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supp…
VulnCve 2026 48038
medium System graph security Trivy conf 1.00 CVE-2026-53550: js-yaml 3.14.1 — archive/kt-sft/ktransformers/website/package-lock.json
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence.…
VulnCve 2026 53550
medium System graph security Trivy conf 1.00 CVE-2026-53550: js-yaml 3.14.1 — archive/ktransformers/website/package-lock.json
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence.…
VulnCve 2026 53550
medium System graph security Trivy conf 1.00 CVE-2026-53550: js-yaml 4.1.0 — archive/kt-sft/ktransformers/website/package-lock.json
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence.…
VulnCve 2026 53550
medium System graph security Trivy conf 1.00 CVE-2026-53550: js-yaml 4.1.0 — archive/ktransformers/website/package-lock.json
js-yaml: js-yaml: Denial of Service via crafted YAML merge keys js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence.…
VulnCve 2026 53550
medium System graph security Trivy conf 1.00 CVE-2026-53632: launch-editor 2.6.1 — archive/kt-sft/ktransformers/website/package-lock.json
launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a U…
VulnCve 2026 53632
medium System graph security Trivy conf 1.00 CVE-2026-53632: launch-editor 2.6.1 — archive/ktransformers/website/package-lock.json
launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a U…
VulnCve 2026 53632
medium System graph security Trivy conf 1.00 CVE-2026-53655: tar 6.2.1 — archive/kt-sft/ktransformers/website/package-lock.json
node-tar: node-tar: File smuggling due to inconsistent tar archive parsing node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata heade…
VulnCve 2026 53655
medium System graph security Trivy conf 1.00 CVE-2026-53655: tar 6.2.1 — archive/ktransformers/website/package-lock.json
node-tar: node-tar: File smuggling due to inconsistent tar archive parsing node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata heade…
VulnCve 2026 53655
medium System graph security Trivy conf 1.00 CVE-2026-59871: tar 6.2.1 — archive/kt-sft/ktransformers/website/package-lock.json
node-tar: node-tar: Denial of Service due to incorrect PAX path handling node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindo…
VulnCve 2026 59871
medium System graph security Trivy conf 1.00 CVE-2026-59871: tar 6.2.1 — archive/ktransformers/website/package-lock.json
node-tar: node-tar: Denial of Service due to incorrect PAX path handling node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindo…
VulnCve 2026 59871
medium System graph security Trivy conf 1.00 CVE-2026-59875: tar 6.2.1 — archive/kt-sft/ktransformers/website/package-lock.json
node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.l…
VulnCve 2026 59875
medium System graph security Trivy conf 1.00 CVE-2026-59875: tar 6.2.1 — archive/ktransformers/website/package-lock.json
node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.l…
VulnCve 2026 59875
medium System graph security Trivy conf 1.00 CVE-2026-8723: qs 6.12.1 — archive/kt-sft/ktransformers/website/package-lock.json
### Summary `qs.stringify` throws `TypeError` when called with `arr ... ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's nul…
VulnCve 2026 8723
medium System graph security Trivy conf 1.00 CVE-2026-8723: qs 6.12.1 — archive/ktransformers/website/package-lock.json
### Summary `qs.stringify` throws `TypeError` when called with `arr ... ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's nul…
VulnCve 2026 8723
medium System graph dependencies dependencies conf 0.90 Dependency apexcharts is two or more major versions behind
`apexcharts` is pinned at `3.49.1` in `archive/kt-sft/ktransformers/website/package.json` while the latest release on the npm registry is `6.5.0` — 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and …
archive/kt-sft/ktransformers/website/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency marked is two or more major versions behind
`marked` is pinned at `12.0.2` in `archive/kt-sft/ktransformers/website/package.json` while the latest release on the npm registry is `18.0.7` — 6 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upg…
archive/kt-sft/ktransformers/website/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency vue-i18n is two or more major versions behind
`vue-i18n` is pinned at `9.13.1` in `archive/kt-sft/ktransformers/website/package.json` while the latest release on the npm registry is `11.4.7` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and u…
archive/kt-sft/ktransformers/website/package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency webpack-cli is two or more major versions behind
`webpack-cli` is pinned at `5.1.4` in `archive/kt-sft/ktransformers/website/package.json` while the latest release on the npm registry is `7.2.1` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and …
archive/kt-sft/ktransformers/website/package.json FreshnessOutdated
medium System graph hardware Security conf 1.00 Dockerfile runs as root: archive/.devcontainer/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: archive/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: archive/kt-sft/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: docker/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph security Trivy conf 1.00 DS-0013: 'RUN cd ...' to change directory — archive/Dockerfile.xpu
'RUN cd ...' to change directory RUN should not be used to change directory: 'bash -c " source $CONDA_DIR/etc/profile.d/conda.sh && conda activate ktransformers && git clone https://github.com/kvcache-ai/ktransformers.git && cd ktransformers && git submodule update --init && …
Misconfig
medium System graph security Trivy conf 1.00 DS-0013: 'RUN cd ...' to change directory — archive/kt-sft/Dockerfile.xpu
'RUN cd ...' to change directory RUN should not be used to change directory: 'bash -c " source $CONDA_DIR/etc/profile.d/conda.sh && conda activate ktransformers && git clone https://github.com/kvcache-ai/ktransformers.git && cd ktransformers && git submodule update --init && …
Misconfig
medium System graph security Trivy conf 1.00 DS-0013: 'RUN cd ...' to change directory — docker/Dockerfile
'RUN cd ...' to change directory RUN should not be used to change directory: '. /opt/miniconda3/etc/profile.d/conda.sh && conda activate serve && cd /workspace/ktransformers/kt-kernel && CPUINFER_BUILD_ALL_VARIANTS=1 ./install.sh build'. Use 'WORKDIR' statement instead. Rule: DS-0013 Seve…
Misconfig
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — archive/kt-sft/setup.py:300
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
archive/kt-sft/setup.py:300 SecurityPythonNon production context
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — archive/setup.py:281
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
archive/setup.py:281 SecurityPythonNon production context
medium System graph security Semgrep conf 0.55 exec detected — kt-kernel/python/__init__.py:80
Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. Rule: python.lang.security.audit.exec-detected.…
kt-kernel/python/__init__.py:80 SecurityPython
medium System graph security Semgrep conf 0.55 exec detected — kt-kernel/python/cli/__init__.py:18
Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. Rule: python.lang.security.audit.exec-detected.…
kt-kernel/python/cli/__init__.py:18 SecurityPython
medium System graph security Semgrep conf 0.55 exec detected — kt-kernel/setup.py:753
Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. Rule: python.lang.security.audit.exec-detected.…
kt-kernel/setup.py:753 SecurityPython
medium System graph security Semgrep conf 0.55 exec detected — ktransformers.py:17
Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. Rule: python.lang.security.audit.exec-detected.…
ktransformers.py:17 SecurityPython
medium System graph security Semgrep conf 0.55 exec detected — setup.py:12
Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. Rule: python.lang.security.audit.exec-detected.…
setup.py:12 SecurityPython
medium System graph security auth conf 0.50 FastAPI DELETE `delete_assistant` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/assistants.py:62
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
archive/kt-sft/ktransformers/server/api/openai/assistants/assistants.py:62 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI DELETE `delete_assistant` without auth dependency — archive/ktransformers/server/api/openai/assistants/assistants.py:62
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
archive/ktransformers/server/api/openai/assistants/assistants.py:62 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI DELETE `delete_message` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/messages.py:48
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
archive/kt-sft/ktransformers/server/api/openai/assistants/messages.py:48 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI DELETE `delete_message` without auth dependency — archive/ktransformers/server/api/openai/assistants/messages.py:48
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
archive/ktransformers/server/api/openai/assistants/messages.py:48 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI DELETE `delete_thread` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/threads.py:33
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
archive/kt-sft/ktransformers/server/api/openai/assistants/threads.py:33 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI DELETE `delete_thread` without auth dependency — archive/ktransformers/server/api/openai/assistants/threads.py:33
`@router.delete` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachab…
archive/ktransformers/server/api/openai/assistants/threads.py:33 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `cancel_run` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/runs.py:80
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/assistants/runs.py:80 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `cancel_run` without auth dependency — archive/ktransformers/server/api/openai/assistants/runs.py:80
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/assistants/runs.py:80 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `chat_completion` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/endpoints/chat.py:135
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/endpoints/chat.py:135 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `chat_completion` without auth dependency — archive/ktransformers/server/api/openai/endpoints/chat.py:135
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/endpoints/chat.py:135 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `chat` without auth dependency — archive/kt-sft/ktransformers/server/api/ollama/completions.py:139
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/ollama/completions.py:139 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `chat` without auth dependency — archive/ktransformers/server/api/ollama/completions.py:139
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/ollama/completions.py:139 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_assistant` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/assistants.py:18
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/assistants/assistants.py:18 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_assistant` without auth dependency — archive/ktransformers/server/api/openai/assistants/assistants.py:18
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/assistants/assistants.py:18 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_completion` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/legacy/completions.py:14
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/legacy/completions.py:14 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_completion` without auth dependency — archive/ktransformers/server/api/openai/legacy/completions.py:14
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/legacy/completions.py:14 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_message` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/messages.py:15
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/assistants/messages.py:15 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_message` without auth dependency — archive/ktransformers/server/api/openai/assistants/messages.py:15
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/assistants/messages.py:15 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_run` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/runs.py:19
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/assistants/runs.py:19 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_run` without auth dependency — archive/ktransformers/server/api/openai/assistants/runs.py:19
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/assistants/runs.py:19 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_thread_and_run` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/runs.py:39
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/assistants/runs.py:39 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_thread_and_run` without auth dependency — archive/ktransformers/server/api/openai/assistants/runs.py:39
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/assistants/runs.py:39 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_thread` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/threads.py:13
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/assistants/threads.py:13 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `create_thread` without auth dependency — archive/ktransformers/server/api/openai/assistants/threads.py:13
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/assistants/threads.py:13 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `generate` without auth dependency — archive/kt-sft/ktransformers/server/api/ollama/completions.py:57
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/ollama/completions.py:57 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `generate` without auth dependency — archive/ktransformers/server/api/ollama/completions.py:57
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/ollama/completions.py:57 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `modify_assistant` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/assistants.py:54
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/assistants/assistants.py:54 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `modify_assistant` without auth dependency — archive/ktransformers/server/api/openai/assistants/assistants.py:54
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/assistants/assistants.py:54 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `modify_message` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/messages.py:42
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/assistants/messages.py:42 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `modify_message` without auth dependency — archive/ktransformers/server/api/openai/assistants/messages.py:42
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/assistants/messages.py:42 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `modify_run` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/runs.py:66
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/assistants/runs.py:66 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `modify_run` without auth dependency — archive/ktransformers/server/api/openai/assistants/runs.py:66
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/assistants/runs.py:66 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `modify_thread` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/threads.py:28
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/assistants/threads.py:28 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `modify_thread` without auth dependency — archive/ktransformers/server/api/openai/assistants/threads.py:28
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/assistants/threads.py:28 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `show` without auth dependency — archive/kt-sft/ktransformers/server/api/ollama/completions.py:266
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/ollama/completions.py:266 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `show` without auth dependency — archive/ktransformers/server/api/ollama/completions.py:267
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/ollama/completions.py:267 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `submit_tool_outputs_to_run` without auth dependency — archive/kt-sft/ktransformers/server/api/openai/assistants/runs.py:75
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/kt-sft/ktransformers/server/api/openai/assistants/runs.py:75 securityAuth fastapi unauth mutationNon production context
medium System graph security auth conf 0.50 FastAPI POST `submit_tool_outputs_to_run` without auth dependency — archive/ktransformers/server/api/openai/assistants/runs.py:75
`@router.post` has no route-local auth dependency, and `router` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable.
archive/ktransformers/server/api/openai/assistants/runs.py:75 securityAuth fastapi unauth mutationNon production context
medium System graph security Trivy conf 1.00 GHSA-42h9-826w-cgv3: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
Axios: Excessive recursion in formDataToJSON can cause denial of service ## Summary Axios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData …
VulnGhsa 42h9 826w cgv3
medium System graph security Trivy conf 1.00 GHSA-42h9-826w-cgv3: axios 1.7.0 — archive/ktransformers/website/package-lock.json
Axios: Excessive recursion in formDataToJSON can cause denial of service ## Summary Axios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData …
VulnGhsa 42h9 826w cgv3
medium System graph security Trivy conf 1.00 GHSA-7q8q-rj6j-mhjq: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
Axios: Nested axios option objects can consume polluted prototype values ## Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`. The top-level merged config is protected with a null prototype, but…
VulnGhsa 7q8q rj6j mhjq
medium System graph security Trivy conf 1.00 GHSA-7q8q-rj6j-mhjq: axios 1.7.0 — archive/ktransformers/website/package-lock.json
Axios: Nested axios option objects can consume polluted prototype values ## Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`. The top-level merged config is protected with a null prototype, but…
VulnGhsa 7q8q rj6j mhjq
medium System graph security Trivy conf 1.00 GHSA-9q82-xgwf-vj6h: apollo-server-core 3.13.0 — archive/kt-sft/ktransformers/website/package-lock.json
Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention # Impact In a Cross-Site Request Forgery attack, untrusted web content causes browsers to send authenticated requests to web servers which use cookies for authentication. While the web cont…
VulnGhsa 9q82 xgwf vj6h
medium System graph security Trivy conf 1.00 GHSA-9q82-xgwf-vj6h: apollo-server-core 3.13.0 — archive/ktransformers/website/package-lock.json
Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention # Impact In a Cross-Site Request Forgery attack, untrusted web content causes browsers to send authenticated requests to web servers which use cookies for authentication. While the web cont…
VulnGhsa 9q82 xgwf vj6h
medium System graph security Trivy conf 1.00 GHSA-jqh4-m9w3-8hp9: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` ## Summary axios’ fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose size cannot be determined before dispatch. Applications that use `adapter: "fetch"` and rely on `maxBodyLengt…
VulnGhsa jqh4 m9w3 8hp9
medium System graph security Trivy conf 1.00 GHSA-jqh4-m9w3-8hp9: axios 1.7.0 — archive/ktransformers/website/package-lock.json
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` ## Summary axios’ fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose size cannot be determined before dispatch. Applications that use `adapter: "fetch"` and rely on `maxBodyLengt…
VulnGhsa jqh4 m9w3 8hp9
medium System graph security Trivy conf 1.00 GHSA-mmx7-hfxf-jppx: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
Axios: Prototype pollution gadgets can alter axios request construction ## Summary axios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method alia…
VulnGhsa mmx7 hfxf jppx
medium System graph security Trivy conf 1.00 GHSA-mmx7-hfxf-jppx: axios 1.7.0 — archive/ktransformers/website/package-lock.json
Axios: Prototype pollution gadgets can alter axios request construction ## Summary axios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method alia…
VulnGhsa mmx7 hfxf jppx
medium System graph security Trivy conf 1.00 GHSA-pmv8-rq9r-6j72: axios 1.7.0 — archive/kt-sft/ktransformers/website/package-lock.json
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service ## Summary Axios versions starting with `0.28.0` contain uncontrolled recursion in `formDataToJSON`, which is exposed as `axios.formToJSON()` and used internally when axios serialises `FormData` with `Content-Type: application/json`…
VulnGhsa pmv8 rq9r 6j72
medium System graph security Trivy conf 1.00 GHSA-pmv8-rq9r-6j72: axios 1.7.0 — archive/ktransformers/website/package-lock.json
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service ## Summary Axios versions starting with `0.28.0` contain uncontrolled recursion in `formDataToJSON`, which is exposed as `axios.formToJSON()` and used internally when axios serialises `FormData` with `Content-Type: application/json`…
VulnGhsa pmv8 rq9r 6j72
medium System graph security Trivy conf 1.00 GHSA-r4q5-vmmm-2653: follow-redirects 1.15.6 — archive/kt-sft/ktransformers/website/package-lock.json
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets ## Summary When an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-47…
VulnGhsa r4q5 vmmm 2653
medium System graph security Trivy conf 1.00 GHSA-r4q5-vmmm-2653: follow-redirects 1.15.6 — archive/ktransformers/website/package-lock.json
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets ## Summary When an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-47…
VulnGhsa r4q5 vmmm 2653
medium System graph cicd CI/CD security conf 1.00 5 occurrences GitHub Action is tag-pinned rather than SHA-pinned
peaceiris/actions-mdbook@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
5 files, 5 locations
.github/workflows/book-ci.yml:28
.github/workflows/deploy.yml:35
.github/workflows/docker-image.yml:55
.github/workflows/kt-kernel-tests.yml:23
.github/workflows/sync-sglang-submodule.yml:20
CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 5 occurrences GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
5 files, 5 locations
.github/workflows/deploy.yml
.github/workflows/release-fake-tag.yml
.github/workflows/release-pypi.yml
.github/workflows/release-sglang-kt.yml
.github/workflows/sync-sglang-submodule.yml
CI/CD securitySupply chainGithub actions
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in archive/kt-sft/ktransformers/server/main.py:38
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
archive/kt-sft/ktransformers/server/main.py:38 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in archive/ktransformers/server/main.py:46
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
archive/ktransformers/server/main.py:46 Cors wildcard
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in archive/kt-sft/ktransformers/website/src/assets/iconfont/iconfont.js:1
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
archive/kt-sft/ktransformers/website/src/assets/iconfont/iconfont.js:1 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in archive/ktransformers/website/src/assets/iconfont/iconfont.js:1
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
archive/ktransformers/website/src/assets/iconfont/iconfont.js:1 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'vue_v_html' in archive/kt-sft/ktransformers/website/src/components/chat/index.vue:40
Found a known-risky pattern (vue_v_html). Review and replace if possible.
archive/kt-sft/ktransformers/website/src/components/chat/index.vue:40 Vue v html
medium System graph security security conf 0.65 Insecure pattern 'vue_v_html' in archive/ktransformers/website/src/components/chat/index.vue:40
Found a known-risky pattern (vue_v_html). Review and replace if possible.
archive/ktransformers/website/src/components/chat/index.vue:40 Vue v html
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — archive/kt-sft/setup.py:106
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
archive/kt-sft/setup.py:106 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — archive/setup.py:81
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
archive/setup.py:81 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_bf16_moe.py:52
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_bf16_moe.py:52 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_fp8_moe.py:53
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_fp8_moe.py:53 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_fp8_perchannel_moe.py:52
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_fp8_perchannel_moe.py:52 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_k2_moe_amx.py:49
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_k2_moe_amx.py:49 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_k2_write_buffer.py:49
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_k2_write_buffer.py:49 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_mla.py:78
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_mla.py:78 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_moe.py:54
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_moe.py:54 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_moe_amx.py:101
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_moe_amx.py:101 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_moe_amx_k.py:60
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_moe_amx_k.py:60 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_moe_kernel.py:66
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_moe_kernel.py:66 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_moe_kml.py:60
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_moe_kml.py:60 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/bench/bench_write_buffer.py:57
`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/bench/bench_write_buffer.py:57 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/python/cli/commands/config.py:115
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/python/cli/commands/config.py:115 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/python/cli/commands/quant.py:368
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/python/cli/commands/quant.py:368 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — kt-kernel/setup.py:721
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
kt-kernel/setup.py:721 runtime safetyRobustness
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 59 placeholder/mock markers across 27 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @babel/helpers 7.24.5: GHSA-968p-4wvh-cqc8
OSV.dev reports `@babel/helpers` at version `7.24.5` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-968p-4wvh-cqc8 (aka CVE-2025-27789). Note: `@babel/helpers` is a transitive dependency — pulled in by another package, not declared directly in a manifest.…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa 968p 4wvh cqc8
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @babel/plugin-transform-modules-systemjs 7.24.1: GHSA-fv7c-fp4j-7gwp
OSV.dev reports `@babel/plugin-transform-modules-systemjs` at version `7.24.1` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-fv7c-fp4j-7gwp. Note: `@babel/plugin-transform-modules-systemjs` is a transitive dependency — pulled in by another package, not d…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa fv7c fp4j 7gwp
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @babel/runtime 7.24.5: GHSA-968p-4wvh-cqc8
OSV.dev reports `@babel/runtime` at version `7.24.5` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-968p-4wvh-cqc8 (aka CVE-2025-27789). Note: `@babel/runtime` is a transitive dependency — pulled in by another package, not declared directly in a manifest.…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa 968p 4wvh cqc8
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @intlify/core-base 9.13.1: GHSA-9r9m-ffp6-9x4v
OSV.dev reports `@intlify/core-base` at version `9.13.1` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-9r9m-ffp6-9x4v (aka CVE-2024-52809). Note: `@intlify/core-base` is a transitive dependency — pulled in by another package, not declared directly in a m…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa 9r9m ffp6 9x4v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @intlify/core-base 9.13.1: GHSA-x8qp-wqqm-57ph
OSV.dev reports `@intlify/core-base` at version `9.13.1` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-x8qp-wqqm-57ph (aka CVE-2025-53892). Note: `@intlify/core-base` is a transitive dependency — pulled in by another package, not declared directly in a m…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa x8qp wqqm 57ph
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @intlify/shared 9.13.1: GHSA-hjwq-mjwj-4x6c
OSV.dev reports `@intlify/shared` at version `9.13.1` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-hjwq-mjwj-4x6c (aka CVE-2024-52810). Note: `@intlify/shared` is a transitive dependency — pulled in by another package, not declared directly in a manifes…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa hjwq mjwj 4x6c
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @protobufjs/utf8 1.1.0: GHSA-q6x5-8v7m-xcrf
OSV.dev reports `@protobufjs/utf8` at version `1.1.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-q6x5-8v7m-xcrf. Note: `@protobufjs/utf8` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary publi…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa q6x5 8v7m xcrf
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @tootallnate/once 1.1.2: GHSA-vpq2-c234-7xj6
OSV.dev reports `@tootallnate/once` at version `1.1.2` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-vpq2-c234-7xj6. Note: `@tootallnate/once` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary pub…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa vpq2 c234 7xj6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6
OSV.dev reports `ajv` at version `6.12.6` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-2g4f-4pwh-qvx6 (aka CVE-2025-69873). Note: `ajv` is a transitive dependency — pulled in by another package, not declared directly in a manifest. ajv has ReDoS when u…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa 2g4f 4pwh qvx6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency ajv 8.13.0: GHSA-2g4f-4pwh-qvx6
OSV.dev reports `ajv` at version `8.13.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-2g4f-4pwh-qvx6 (aka CVE-2025-69873). Note: `ajv` is a transitive dependency — pulled in by another package, not declared directly in a manifest. ajv has ReDoS when u…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa 2g4f 4pwh qvx6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency apollo-server-core 3.13.0: GHSA-9q82-xgwf-vj6h
OSV.dev reports `apollo-server-core` at version `3.13.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-9q82-xgwf-vj6h. Note: `apollo-server-core` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary …
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa 9q82 xgwf vj6h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-3p68-rc4w-qgx5
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-3p68-rc4w-qgx5 (aka CVE-2025-62718). Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF Aliases: CVE-2025-62718 Advisory: https://osv.dev/vulner…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 3p68 rc4w qgx5
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-3w6x-2g7m-8v23
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-3w6x-2g7m-8v23 (aka CVE-2026-42044). Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` Aliases: CVE-2026-42044 Advisory: ht…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 3w6x 2g7m 8v23
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-42h9-826w-cgv3
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-42h9-826w-cgv3. Axios: Excessive recursion in formDataToJSON can cause denial of service Advisory: https://osv.dev/vulnerability/GHSA-42h9-826w-cgv3 Fix: upgrade `…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 42h9 826w cgv3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-445q-vr5w-6q77
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-445q-vr5w-6q77 (aka CVE-2026-42037). Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream Aliases: CVE-2026-42037 Adviso…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 445q vr5w 6q77
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-5c9x-8gcm-mpgx
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-5c9x-8gcm-mpgx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-5c9x-8gcm-mpgx Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 5c9x 8gcm mpgx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-62hf-57xw-28j9
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-62hf-57xw-28j9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-62hf-57xw-28j9 Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 62hf 57xw 28j9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-6chq-wfr3-2hj9
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-6chq-wfr3-2hj9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-6chq-wfr3-2hj9 Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 6chq wfr3 2hj9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-777c-7fjr-54vf
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-777c-7fjr-54vf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-777c-7fjr-54vf Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 777c 7fjr 54vf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-7q8q-rj6j-mhjq
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-7q8q-rj6j-mhjq. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-7q8q-rj6j-mhjq Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 7q8q rj6j mhjq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-898c-q2cr-xwhg
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-898c-q2cr-xwhg. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-898c-q2cr-xwhg Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 898c q2cr xwhg
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-8hc4-vh64-cxmj
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-8hc4-vh64-cxmj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-8hc4-vh64-cxmj Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 8hc4 vh64 cxmj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-fvcv-3m26-pcqx
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-fvcv-3m26-pcqx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fvcv-3m26-pcqx Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa fvcv 3m26 pcqx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-hfxv-24rg-xrqf
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-hfxv-24rg-xrqf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hfxv-24rg-xrqf Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa hfxv 24rg xrqf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-j5f8-grm9-p9fc
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-j5f8-grm9-p9fc. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-j5f8-grm9-p9fc Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa j5f8 grm9 p9fc
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-jqh4-m9w3-8hp9
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-jqh4-m9w3-8hp9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jqh4-m9w3-8hp9 Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa jqh4 m9w3 8hp9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-jr5f-v2jv-69x6
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-jr5f-v2jv-69x6. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jr5f-v2jv-69x6 Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa jr5f v2jv 69x6
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-m7pr-hjqh-92cm
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-m7pr-hjqh-92cm. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m7pr-hjqh-92cm Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa m7pr hjqh 92cm
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-mmx7-hfxf-jppx
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-mmx7-hfxf-jppx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mmx7-hfxf-jppx Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa mmx7 hfxf jppx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-p92q-9vqr-4j8v
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-p92q-9vqr-4j8v. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p92q-9vqr-4j8v Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa p92q 9vqr 4j8v
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-pf86-5x62-jrwf
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-pf86-5x62-jrwf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pf86-5x62-jrwf Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa pf86 5x62 jrwf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-pmv8-rq9r-6j72
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-pmv8-rq9r-6j72. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pmv8-rq9r-6j72 Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa pmv8 rq9r 6j72
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-pmwg-cvhr-8vh7
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-pmwg-cvhr-8vh7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pmwg-cvhr-8vh7 Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa pmwg cvhr 8vh7
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-q8qp-cvcw-x6jj
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-q8qp-cvcw-x6jj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q8qp-cvcw-x6jj Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa q8qp cvcw x6jj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-vf2m-468p-8v99
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-vf2m-468p-8v99. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vf2m-468p-8v99 Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa vf2m 468p 8v99
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-w9j2-pvgh-6h63
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-w9j2-pvgh-6h63. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w9j2-pvgh-6h63 Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa w9j2 pvgh 6h63
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-xhjh-pmcv-23jw
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-xhjh-pmcv-23jw. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xhjh-pmcv-23jw Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa xhjh pmcv 23jw
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.7.0: GHSA-xx6v-rp6x-q39c
OSV.dev reports `axios` at version `1.7.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-xx6v-rp6x-q39c. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xx6v-rp6x-q39c Fix: upgrade `axios` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa xx6v rp6x q39c
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency element-plus 2.7.3: GHSA-5m5x-9j46-h678
OSV.dev reports `element-plus` at version `2.7.3` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-5m5x-9j46-h678. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-5m5x-9j46-h678 Fix: upgrade `element-plus` past the affected range pe…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 5m5x 9j46 h678
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency form-data 4.0.0: GHSA-fjxv-7rqg-78g4
OSV.dev reports `form-data` at version `4.0.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-fjxv-7rqg-78g4. Note: `form-data` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Adv…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa fjxv 7rqg 78g4
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency form-data 4.0.0: GHSA-hmw2-7cc7-3qxx
OSV.dev reports `form-data` at version `4.0.0` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-hmw2-7cc7-3qxx. Note: `form-data` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Adv…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa hmw2 7cc7 3qxx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 3.14.1: GHSA-h67p-54hq-rp68
OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-h67p-54hq-rp68. Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Adviso…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa h67p 54hq rp68
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 3.14.1: GHSA-mh29-5h37-fv8m
OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-mh29-5h37-fv8m. Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Adviso…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa mh29 5h37 fv8m
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 7.0.39: GHSA-6g55-p6wh-862q
OSV.dev reports `postcss` at version `7.0.39` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-6g55-p6wh-862q. Note: `postcss` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Adviso…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa 6g55 p6wh 862q
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 7.0.39: GHSA-7fh5-64p2-3v2j
OSV.dev reports `postcss` at version `7.0.39` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-7fh5-64p2-3v2j. Note: `postcss` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Adviso…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa 7fh5 64p2 3v2j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 7.0.39: GHSA-qx2v-qp2m-jg93
OSV.dev reports `postcss` at version `7.0.39` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-qx2v-qp2m-jg93. Note: `postcss` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Adviso…
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa qx2v qp2m jg93
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency torch 2.9.1: GHSA-qfhq-4f3w-5fph
OSV.dev reports `torch` at version `2.9.1` (declared in `kt-kernel/pyproject.toml`) is affected by GHSA-qfhq-4f3w-5fph. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qfhq-4f3w-5fph Fix: upgrade `torch` past the affected range per the advisory.
kt-kernel/pyproject.toml ScaOsvGhsa qfhq 4f3w 5fph
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency torch 2.9.1: GHSA-rrmf-rvhw-rf47
OSV.dev reports `torch` at version `2.9.1` (declared in `kt-kernel/pyproject.toml`) is affected by GHSA-rrmf-rvhw-rf47. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rrmf-rvhw-rf47 Fix: upgrade `torch` past the affected range per the advisory.
kt-kernel/pyproject.toml ScaOsvGhsa rrmf rvhw rf47
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency torch 2.9.1: PYSEC-2026-139
OSV.dev reports `torch` at version `2.9.1` (declared in `kt-kernel/pyproject.toml`) is affected by PYSEC-2026-139. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-139 Fix: upgrade `torch` past the affected range per the advisory.
kt-kernel/pyproject.toml ScaOsvPysec 2026 139
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency torch 2.9.1: PYSEC-2026-2286
OSV.dev reports `torch` at version `2.9.1` (declared in `kt-kernel/pyproject.toml`) is affected by PYSEC-2026-2286. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2286 Fix: upgrade `torch` past the affected range per the advisory.
kt-kernel/pyproject.toml ScaOsvPysec 2026 2286
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency vue 2.7.16: GHSA-5j4c-8p2g-v4jx
OSV.dev reports `vue` at version `2.7.16` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-5j4c-8p2g-v4jx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-5j4c-8p2g-v4jx Fix: upgrade `vue` past the affected range per the advisory.
archive/kt-sft/ktransformers/website/package-lock.json ScaOsvGhsa 5j4c 8p2g v4jx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency vue-i18n 9.13.1: GHSA-9r9m-ffp6-9x4v
OSV.dev reports `vue-i18n` at version `9.13.1` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-9r9m-ffp6-9x4v (aka CVE-2024-52809). vue-i18n has cross-site scripting vulnerability with prototype pollution Aliases: CVE-2024-52809 Advisory: https://osv.dev…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 9r9m ffp6 9x4v
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency vue-i18n 9.13.1: GHSA-hjwq-mjwj-4x6c
OSV.dev reports `vue-i18n` at version `9.13.1` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-hjwq-mjwj-4x6c (aka CVE-2024-52810). @intlify/shared Prototype Pollution vulnerability Aliases: CVE-2024-52810 Advisory: https://osv.dev/vulnerability/GHSA-hjw…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa hjwq mjwj 4x6c
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency vue-i18n 9.13.1: GHSA-p2ph-7g93-hw3m
OSV.dev reports `vue-i18n` at version `9.13.1` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-p2ph-7g93-hw3m. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p2ph-7g93-hw3m Fix: upgrade `vue-i18n` past the affected range per the a…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa p2ph 7g93 hw3m
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency vue-i18n 9.13.1: GHSA-x8qp-wqqm-57ph
OSV.dev reports `vue-i18n` at version `9.13.1` (resolved in `archive/kt-sft/ktransformers/website/package-lock.json`) is affected by GHSA-x8qp-wqqm-57ph (aka CVE-2025-53892). vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes Aliases: CVE-2025-53892 Advisory:…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa x8qp wqqm 57ph
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency webpack 5.91.0: GHSA-4vvj-4cpr-p986
OSV.dev reports `webpack` at version `5.91.0` (declared in `archive/kt-sft/ktransformers/website/package.json`) is affected by GHSA-4vvj-4cpr-p986 (aka CVE-2024-43788). Note: `5.91.0` is the declared floor of a range — the installed version may be newer. Webpack's AutoPublicPathRuntimeModule has a…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 4vvj 4cpr p986
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency webpack 5.91.0: GHSA-8fgc-7cc6-rx7x
OSV.dev reports `webpack` at version `5.91.0` (declared in `archive/kt-sft/ktransformers/website/package.json`) is affected by GHSA-8fgc-7cc6-rx7x. Note: `5.91.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerabili…
archive/kt-sft/ktransformers/website/package.json ScaOsvGhsa 8fgc 7cc6 rx7x
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/5a2dcb17-955a-4003-a052-52b5eb857cff/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/5a2dcb17-955a-4003-a052-52b5eb857cff/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.