Scan report

mixxorz / slippers

View on GitHub (opens in a new tab)
Python
576 stars
Scanned 24 Sep 2026, 10:13

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

41 risk score

Real issues worth reviewing before you rely on this code.

High: 0
Medium: 21
Low: 0

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Safe

Does this code look like it is trying to cause harm?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 4

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

25 total findings

Likely real: 18
Uncertain: 3
Likely noise: 4

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

The repository has a medium vulnerability score of 41.0, which means there are several insecure coding patterns that an attacker could exploit if they find and use the code. However, the malicious-pattern risk is zero, indicating that the code does not appear to be intentionally designed to harm others. The most serious issues involve using functions like mark_safe() and exec() without proper checks, which can lead to cross-site scripting attacks or dangerous code injection. Additionally, there are several loose version constraints for popular libraries like Django and PyYAML, meaning attackers might push malicious updates that could break your application. While the code itself is not malicious, it relies on outdated versions of critical packages that could be vulnerable to known exploits.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 16

Pattern-based code analysis · Vulnerability
Bandit 5

Python security linter · Vulnerability
Dependency checker 4

CVEs, typosquats and risky installs · Supply chain

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/slippers/props.py line 163

Likely real
Yes, 100% confidence

'mark_safe()' is used to mark a string as "safe" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.
```
return mark_safe(data_html)  # type: ignore
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/slippers/templatetags/slippers.py line 129

Likely real
Yes, 100% confidence

'mark_safe()' is used to mark a string as "safe" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.
```
output_template_section = mark_safe(extract_template_parts(raw_output)[1])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/slippers/props.py line 163

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
162 
163     return mark_safe(data_html)  # type: ignore
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/slippers/templatetags/slippers.py line 129

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
128 
129         output_template_section = mark_safe(extract_template_parts(raw_output)[1])
130
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/slippers/props.py line 163

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
162 
163     return mark_safe(data_html)  # type: ignore
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/slippers/templatetags/slippers.py line 129

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
128 
129         output_template_section = mark_safe(extract_template_parts(raw_output)[1])
130
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/docs.yml line 12

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: astral-sh/setup-uv@v7
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/tests.yml line 37

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-python@v6
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/tests.yml line 34

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v6
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/tests.yml line 24

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: pre-commit/action@v3.0.1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/tests.yml line 18

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: astral-sh/setup-uv@v7
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/tests.yml line 15

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/setup-python@v6
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/tests.yml line 14

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v6
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 22

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: pypa/gh-action-pypi-publish@release/v1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 15

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: astral-sh/setup-uv@v7
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/release.yml line 12

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v6
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/docs.yml line 16

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: JamesIves/github-pages-deploy-action@v4.8.0
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/docs.yml line 11

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/checkout@v6
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/slippers/props.py line 51

Likely real
Uncertain, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
```
exec(f"from typing import *\n{code}", {}, code_locals)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/slippers/templatetags/slippers.py line 127

Likely real
Uncertain, 49% confidence

Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS.
```
raw_output = template.render(Context({**attributes, "children": children}, autoescape=context.autoescape))
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/slippers/props.py line 51

Likely real
Uncertain, 40% confidence

Use of exec detected.
```
50         # Execute the source code in a local scope
51         exec(f"from typing import *\n{code}", {}, code_locals)
52
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'typing-extensions>=4.4.0' — attacker could push malicious update
```
typing-extensions>=4.4.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'typeguard>=2.13.3,<3' — attacker could push malicious update
```
typeguard>=2.13.3,<3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'PyYAML>=5.4.0' — attacker could push malicious update
```
PyYAML>=5.4.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'Django>=3.2' — attacker could push malicious update
```
Django>=3.2
```