← Back to scan
File as GitHub Issue repo: ultralytics/yolov5

Push this scan report to ultralytics/yolov5

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

torch: GHSA-53q9-r3pm-6pq6

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_YOLO` on a `pull_request` trigger .github/workflows/ci-testing.yml:155
CRIT MINED116 Workflow uses `secrets.BRAVE_API_KEY` on a `pull_request` trigger .github/workflows/format.yml:35
CRIT MINED116 Workflow uses `secrets.OPENAI_API_KEY` on a `pull_request` trigger .github/workflows/format.yml:34
CRIT MINED116 Workflow uses `secrets._GITHUB_TOKEN` on a `pull_request` trigger .github/workflows/format.yml:27
CRIT GHSA-53q9-r3pm-6pq6 torch: GHSA-53q9-r3pm-6pq6 requirements.txt
CRIT GHSA-47fc-vmwq-366v torch: GHSA-47fc-vmwq-366v requirements.txt
CRIT GHSA-pr76-5cm5-w9cj gitpython: GHSA-pr76-5cm5-w9cj requirements.txt
CRIT GHSA-8q59-q68h-6hv4 pyyaml: GHSA-8q59-q68h-6hv4 requirements.txt
HIGH MINED006 [MINED006] Overcatch Baseexception: except BaseException: ... — prevents Ctrl+C and Syste… utils/loggers/wandb/wandb_utils.py:171
HIGH SEC103 [SEC103] LDAP injection — non-constant search filter: User input concatenated into an LDA… utils/loggers/clearml/clearml_utils.py:182
HIGH SEC135 [SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint g… utils/flask_rest_api/restapi.py:26
HIGH MINED034 [MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command inje… utils/downloads.py:29
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … utils/flask_rest_api/example_request.py:15
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … utils/downloads.py:35
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… utils/flask_rest_api/example_request.py:15
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… utils/downloads.py:19
HIGH MINED104 [MINED104] Chmod 777: chmod 777 makes a file or directory world-readable, world-writable,… utils/aws/userdata.sh:12
HIGH MINED036 [MINED036] Python Os System Call: os.system() invokes shell with no escaping. utils/__init__.py:76
HIGH MINED108 `self.count` used but never assigned in __init__ utils/dataloaders.py:378
HIGH MINED108 `self.count` used but never assigned in __init__ utils/dataloaders.py:376
HIGH MINED108 `self.count` used but never assigned in __init__ utils/dataloaders.py:390
HIGH MINED108 `self.frame` used but never assigned in __init__ utils/dataloaders.py:384
HIGH MINED108 `self.count` used but never assigned in __init__ utils/dataloaders.py:369
HIGH MINED108 `self.count` used but never assigned in __init__ utils/dataloaders.py:367
HIGH MINED108 `self.count` used but never assigned in __init__ utils/dataloaders.py:365
HIGH MINED108 `self.count` used but never assigned in __init__ utils/dataloaders.py:360
HIGH MINED108 `self.batch_sampler` used but never assigned in __init__ utils/dataloaders.py:236
HIGH MINED108 `self.dataset` used but never assigned in __init__ utils/dataloaders.py:141
HIGH MINED108 `self.rank` used but never assigned in __init__ utils/dataloaders.py:141
HIGH MINED108 `self.num_samples` used but never assigned in __init__ utils/dataloaders.py:148
HIGH MINED108 `self.num_replicas` used but never assigned in __init__ utils/dataloaders.py:141
HIGH MINED108 `self.num_samples` used but never assigned in __init__ utils/dataloaders.py:150
HIGH MINED108 `self.epoch` used but never assigned in __init__ utils/dataloaders.py:138
HIGH MINED108 `self.seed` used but never assigned in __init__ utils/dataloaders.py:138
HIGH MINED108 `self.shuffle` used but never assigned in __init__ utils/dataloaders.py:143
HIGH MINED108 `self.drop_last` used but never assigned in __init__ utils/dataloaders.py:147
HIGH MINED108 `self._timeout_handler` used but never assigned in __init__ utils/general.py:233
HIGH MINED108 `self.time` used but never assigned in __init__ utils/general.py:207
HIGH MINED108 `self.start` used but never assigned in __init__ utils/general.py:207
HIGH MINED108 `self.dt` used but never assigned in __init__ utils/general.py:208
HIGH MINED108 `self.dt` used but never assigned in __init__ utils/general.py:207
HIGH MINED108 `self.time` used but never assigned in __init__ utils/general.py:202
HIGH MINED108 `self.start` used but never assigned in __init__ utils/general.py:202
HIGH COMP001 [COMP001] High cognitive complexity: Function `run` has cognitive complexity 67 (SonarSou… classify/predict.py:68
HIGH MINED115 Action `slackapi/slack-github-action` pinned to mutable ref `@v3.0.3` .github/workflows/ci-testing.yml:152
HIGH MINED115 Action `astral-sh/setup-uv` pinned to mutable ref `@v7` .github/workflows/ci-testing.yml:71
HIGH MINED115 Action `actions/setup-python` pinned to mutable ref `@v6` .github/workflows/ci-testing.yml:68
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/ci-testing.yml:67
HIGH MINED115 Action `astral-sh/setup-uv` pinned to mutable ref `@v7` .github/workflows/ci-testing.yml:33
HIGH MINED115 Action `actions/setup-python` pinned to mutable ref `@v6` .github/workflows/ci-testing.yml:30
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/ci-testing.yml:29
HIGH MINED115 Action `actions/setup-python` pinned to mutable ref `@v6` .github/workflows/merge-main-into-prs.y…:27
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/merge-main-into-prs.y…:24
HIGH MINED115 Action `actions/stale` pinned to mutable ref `@v10` .github/workflows/stale.yml:17
HIGH MINED115 Action `ultralytics/actions` pinned to mutable ref `@main` .github/workflows/format.yml:25
HIGH MINED115 Action `contributor-assistant/github-action` pinned to mutable ref `@v2.6.1` .github/workflows/cla.yml:30
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/docker.yml:22
HIGH MINED115 Action `ultralytics/actions/retry` pinned to mutable ref `@main` .github/workflows/links.yml:59
HIGH MINED115 Action `ultralytics/actions/retry` pinned to mutable ref `@main` .github/workflows/links.yml:33
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/links.yml:25
HIGH MINED119 Dockerfile `ADD https://ultralytics.com/assets/Arial.ttf` utils/docker/Dockerfile:10
HIGH MINED118 Dockerfile FROM `pytorch/pytorch:2.8.0-cuda12.8-cudnn9-runtime` not pinned by digest utils/docker/Dockerfile:7
HIGH MINED118 Dockerfile FROM `gcr.io/google-appengine/python (no tag)` not pinned by digest utils/google_app_engine/Dockerfile:1
HIGH GHSA-2g68-c3qc-8985 werkzeug: GHSA-2g68-c3qc-8985 utils/google_app_engine/additional_requ…
HIGH GHSA-38jv-5279-wg99 urllib3: GHSA-38jv-5279-wg99 requirements.txt
HIGH PYSEC-2026-142 urllib3: PYSEC-2026-142 requirements.txt
HIGH PYSEC-2026-141 urllib3: PYSEC-2026-141 requirements.txt
HIGH PYSEC-2026-139 torch: PYSEC-2026-139 requirements.txt
HIGH PYSEC-2025-209 torch: PYSEC-2025-209 requirements.txt
HIGH PYSEC-2025-208 torch: PYSEC-2025-208 requirements.txt
HIGH PYSEC-2025-207 torch: PYSEC-2025-207 requirements.txt
HIGH PYSEC-2025-206 torch: PYSEC-2025-206 requirements.txt
HIGH PYSEC-2025-205 torch: PYSEC-2025-205 requirements.txt
HIGH PYSEC-2025-204 torch: PYSEC-2025-204 requirements.txt
HIGH PYSEC-2025-203 torch: PYSEC-2025-203 requirements.txt
HIGH PYSEC-2025-198 torch: PYSEC-2025-198 requirements.txt
HIGH PYSEC-2025-191 torch: PYSEC-2025-191 requirements.txt
HIGH PYSEC-2024-259 torch: PYSEC-2024-259 requirements.txt
HIGH PYSEC-2024-252 torch: PYSEC-2024-252 requirements.txt
HIGH PYSEC-2024-251 torch: PYSEC-2024-251 requirements.txt
HIGH PYSEC-2024-250 torch: PYSEC-2024-250 requirements.txt
HIGH PYSEC-2025-49 setuptools: PYSEC-2025-49 requirements.txt
HIGH PYSEC-2023-114 scipy: PYSEC-2023-114 requirements.txt
HIGH PYSEC-2023-102 scipy: PYSEC-2023-102 requirements.txt
HIGH GHSA-whj4-6x5x-4v2j pillow: GHSA-whj4-6x5x-4v2j requirements.txt
HIGH GHSA-pwv6-vv43-88gr pillow: GHSA-pwv6-vv43-88gr requirements.txt
HIGH GHSA-cfh3-3jmp-rvhc pillow: GHSA-cfh3-3jmp-rvhc requirements.txt
HIGH PYSEC-2026-165 pillow: PYSEC-2026-165 requirements.txt
HIGH GHSA-q799-q27x-vp7w opencv-python: GHSA-q799-q27x-vp7w requirements.txt
HIGH GHSA-fw99-f933-rgh8 opencv-python: GHSA-fw99-f933-rgh8 requirements.txt
HIGH GHSA-fm39-cw8h-3p63 opencv-python: GHSA-fm39-cw8h-3p63 requirements.txt
HIGH GHSA-8849-5h85-98qw opencv-python: GHSA-8849-5h85-98qw requirements.txt
HIGH GHSA-3448-vrgh-85xr opencv-python: GHSA-3448-vrgh-85xr requirements.txt
HIGH PYSEC-2023-183 opencv-python: PYSEC-2023-183 requirements.txt
HIGH GHSA-x2qx-6953-8485 gitpython: GHSA-x2qx-6953-8485 requirements.txt
HIGH GHSA-v87r-6q3f-2j67 gitpython: GHSA-v87r-6q3f-2j67 requirements.txt
HIGH GHSA-mv93-w799-cj2w gitpython: GHSA-mv93-w799-cj2w requirements.txt
HIGH GHSA-7545-fcxq-7j24 gitpython: GHSA-7545-fcxq-7j24 requirements.txt
HIGH GHSA-2mqj-m65w-jghx gitpython: GHSA-2mqj-m65w-jghx requirements.txt
HIGH PYSEC-2023-165 gitpython: PYSEC-2023-165 requirements.txt
HIGH PYSEC-2023-161 gitpython: PYSEC-2023-161 requirements.txt
HIGH PYSEC-2023-137 gitpython: PYSEC-2023-137 requirements.txt
MED SEC123 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production … utils/flask_rest_api/restapi.py:71
MED MINED111 Bare except continues silently utils/segment/plots.py:145
MED MINED111 Bare except continues silently utils/flask_rest_api/restapi.py:51
MED MINED111 Bare except continues silently models/yolo.py:492
MED MINED111 Bare except continues silently utils/plots.py:488
MED MINED111 Bare except continues silently utils/downloads.py:120
MED MINED111 Bare except continues silently utils/downloads.py:117
MED MINED111 Bare except continues silently utils/downloads.py:114
MED MINED111 Bare except continues silently utils/torch_utils.py:193
MED MINED111 Bare except continues silently utils/torch_utils.py:203
MED MINED111 Bare except continues silently utils/torch_utils.py:182
MED MINED111 Bare except continues silently utils/torch_utils.py:390
MED MINED111 Bare except continues silently utils/torch_utils.py:316
MED MINED111 Bare except continues silently utils/torch_utils.py:108
MED MINED111 Bare except continues silently utils/dataloaders.py:595
MED MINED111 Bare except continues silently utils/dataloaders.py:1171
MED MINED111 Bare except continues silently utils/general.py:1274
MED MINED111 Bare except continues silently utils/general.py:367
MED MINED111 Bare except continues silently export.py:743
MED MINED111 Bare except continues silently export.py:624
MED MINED111 Bare except continues silently hubconf.py:85
MED MINED111 Bare except continues silently benchmarks.py:204
MED COMP001 [COMP001] High cognitive complexity: Function `attempt_load` has cognitive complexity 21 … models/experimental.py:89
MED COMP001 [COMP001] High cognitive complexity: Function `run` has cognitive complexity 21 (SonarSou… classify/val.py:53
MED DKR002 Dockerfile base image has no explicit tag utils/google_app_engine/Dockerfile:1
MED DKR017 Dockerfile installs dependencies after copying the full source tree utils/docker/Dockerfile:33
MED MINED124 requirements.txt: `packaging # Migration of deprecated pkg_resources packages` has no ve… requirements.txt:42
MED MINED124 requirements.txt: `psutil # system resources` has no version pin requirements.txt:10
MED GHSA-q34m-jh98-gwm2 werkzeug: GHSA-q34m-jh98-gwm2 utils/google_app_engine/additional_requ…
MED GHSA-hgf8-39gv-g3f2 werkzeug: GHSA-hgf8-39gv-g3f2 utils/google_app_engine/additional_requ…
MED GHSA-f9vj-2wh5-fj8j werkzeug: GHSA-f9vj-2wh5-fj8j utils/google_app_engine/additional_requ…
MED GHSA-87hc-h4r5-73f7 werkzeug: GHSA-87hc-h4r5-73f7 utils/google_app_engine/additional_requ…
MED GHSA-29vq-49wr-vm6x werkzeug: GHSA-29vq-49wr-vm6x utils/google_app_engine/additional_requ…
MED GHSA-887c-mr87-cxwp torch: GHSA-887c-mr87-cxwp requirements.txt
MED GHSA-gc5v-m9x4-r6x2 requests: GHSA-gc5v-m9x4-r6x2 requirements.txt
MED GHSA-9hjg-9r4m-mvj7 requests: GHSA-9hjg-9r4m-mvj7 requirements.txt
MED GHSA-r73j-pqj5-w3x7 pillow: GHSA-r73j-pqj5-w3x7 requirements.txt
MED GHSA-x3rm-644h-67m8 opencv-python: GHSA-x3rm-644h-67m8 requirements.txt
MED GHSA-hxfw-jm98-v4mq opencv-python: GHSA-hxfw-jm98-v4mq requirements.txt
MED DKR009 Dockerfile separates apt update from install utils/docker/Dockerfile:14
MED DKR013 Dockerfile ADD downloads remote content utils/docker/Dockerfile:10
MED DKR001 Docker final stage has no non-root USER utils/google_app_engine/Dockerfile:1
MED DKR001 Docker final stage has no non-root USER utils/docker/Dockerfile:7
MED DKR014 Dockerfile copies broad context with incomplete .dockerignore utils/docker/Dockerfile:28
MED AGT015 Remote install command pipes network code directly to a shell data/scripts/get_imagenet.sh:45
MED SEC005 [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input. utils/downloads.py:29
LOW AIC003 Duplicated implementation block across source files val.py:37
LOW AIC003 Duplicated implementation block across source files val.py:7
LOW AIC003 Duplicated implementation block across source files utils/segment/plots.py:21
LOW AIC003 Duplicated implementation block across source files utils/segment/loss.py:15
LOW AIC003 Duplicated implementation block across source files utils/segment/augmentations.py:21
LOW AIC003 Duplicated implementation block across source files utils/loggers/comet/hpo.py:40
LOW AIC003 Duplicated implementation block across source files train.py:46
LOW AIC003 Duplicated implementation block across source files segment/predict.py:91
LOW AIC003 Duplicated implementation block across source files segment/predict.py:35
LOW AIC003 Duplicated implementation block across source files detect.py:239
LOW AIC003 Duplicated implementation block across source files classify/val.py:8
LOW WEB005 robots.txt does not advertise a sitemap .github/workflows/links.yml
LOW DKR010 Dockerfile leaves apt package indexes in the image layer utils/google_app_engine/Dockerfile:13
LOW DKR012 Dockerfile keeps pip download cache utils/google_app_engine/Dockerfile:18
LOW DKR011 Dockerfile installs recommended OS packages utils/google_app_engine/Dockerfile:13
LOW DKR008 .dockerignore misses sensitive defaults .dockerignore
LOW DKR012 Dockerfile keeps pip download cache utils/docker/Dockerfile:33
LOW DKR012 Dockerfile keeps pip download cache utils/docker/Dockerfile:32
LOW DKR011 Dockerfile installs recommended OS packages utils/docker/Dockerfile:15
INFO MINED069 [MINED069] Debug True Prod: Django/Flask DEBUG=True or app.debug=True in non-test files. utils/flask_rest_api/restapi.py:71
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… utils/flask_rest_api/example_request.py:15
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… utils/downloads.py:35
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… utils/loggers/wandb/wandb_utils.py:149
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… utils/__init__.py:23
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… data/scripts/get_coco.sh:41
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… classify/predict.py:91
Reset to top 5 174 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `ultralytics/yolov5`

**Score: 64/100 (C-)**  ·  174 findings  ·  scanned 2026-06-05 09:57 UTC  ·  17,927 LOC

| Severity | Count |
|---|---|
| CRITICAL | 8 |
| HIGH | 94 |
| MEDIUM | 46 |
| LOW | 19 |

📊 [Full filterable report](https://repobility.com/scan/bed6286b-1a4f-46b9-a1ce-2f60cf0cf858/)  ·  ![scorecard](https://repobility.com/scan/bed6286b-1a4f-46b9-a1ce-2f60cf0cf858/report.png?v=1780653448-s2)

### Top findings

1. **CRITICAL** `MINED116` — Workflow uses `secrets.SLACK_WEBHOOK_URL_YOLO` on a `pull_request` trigger
   `.github/workflows/ci-testing.yml:155` · ✓ Repobility
2. **CRITICAL** `MINED116` — Workflow uses `secrets.BRAVE_API_KEY` on a `pull_request` trigger
   `.github/workflows/format.yml:35` · ✓ Repobility
3. **CRITICAL** `MINED116` — Workflow uses `secrets.OPENAI_API_KEY` on a `pull_request` trigger
   `.github/workflows/format.yml:34` · ✓ Repobility
4. **CRITICAL** `MINED116` — Workflow uses `secrets._GITHUB_TOKEN` on a `pull_request` trigger
   `.github/workflows/format.yml:27` · ✓ Repobility
5. **CRITICAL** `GHSA-53q9-r3pm-6pq6` — torch: GHSA-53q9-r3pm-6pq6
   `requirements.txt`

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/bed6286b-1a4f-46b9-a1ce-2f60cf0cf858/_
Megaproject â high spam risk
Could not determine 'ultralytics/yolov5' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Already filed
77/177 findings (44%) on this scan are already flagged as test-file, won't-fix, or suppressed. The scan is too noisy to file as a single issue. Curate down to specific actionable findings, or address the FP source first.
Open in GitHub to file this issue Filing guard overridden Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.