Scan report

pygae / galgebra

View on GitHub (opens in a new tab)
Python
285 stars
Scanned 24 Sep 2026, 10:15

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

55 risk score

Real issues worth reviewing before you rely on this code.

High: 7
Medium: 20
Low: 20

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

2 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 1
Medium: 1
Low: 0

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

49 total findings

Likely real: 11
Uncertain: 17
Likely noise: 21

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a medium vulnerability risk score of 55.0, which means there are several insecure coding patterns that an attacker could potentially exploit if they gain access to the code. While the malicious-pattern risk is very low at 2.0, suggesting the code does not appear to be intentionally harmful, the most concerning issues involve unsafe subprocess calls and shell usage that could lead to command injection attacks. Additionally, there are supply chain risks because some dependencies like 'sympy' lack version locks, making them vulnerable to tampering by others who control their installation. The scan also flagged a specific YARA rule indicating that downloading files from the internet and executing them together is a dangerous combination, which requires careful handling. Overall, while the code may not be malicious, it contains significant security holes that should be addressed before using this library in production environments.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Bandit 32

Python security linter · Vulnerability
Semgrep 15

Pattern-based code analysis · Vulnerability
YARA 1

Malware signature rules · Malicious pattern
Dependency checker 1

CVEs, typosquats and risky installs · Supply chain

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/printer.py line 1046

Likely real
Uncertain, 35% confidence

Starting a process with a shell, possible injection detected, security issue.
```
1045         if png:
1046             os.system('Pdf2Png ' + filename[:-4])
1047     return
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/printer.py line 1034

Likely real
Uncertain, 35% confidence

Starting a process with a shell, possible injection detected, security issue.
```
1033 
1034         os.system(print_cmd)
1035         eval(input('!!!!Return to continue!!!!\n'))
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/printer.py line 1027

Likely real
Uncertain, 35% confidence

Starting a process with a shell, possible injection detected, security issue.
```
1026         if debug:  # Display latex excution output for debugging purposes
1027             os.system(pdfprog + ' ' + filename[:-4])
1028         else:  # Works for Linux don't know about Windows
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/printer.py line 1029

Likely real
Uncertain, 35% confidence

Starting a process with a shell, possible injection detected, security issue.
```
1028         else:  # Works for Linux don't know about Windows
1029             os.system(pdfprog + ' ' + filename[:-4] + sys_cmd['null'])
1030
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/printer.py line 1038

Likely real
Uncertain, 35% confidence

Starting a process with a shell, possible injection detected, security issue.
```
1037         if debug:
1038             os.system(sys_cmd['rm'] + ' ' + filename[:-4] + '.aux ' + filename[:-4] + '.log')
1039         else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/printer.py line 1040

Likely real
Uncertain, 35% confidence

Starting a process with a shell, possible injection detected, security issue.
```
1039         else:
1040             os.system(sys_cmd['rm'] + ' ' + filename[:-4] + '.aux ' + filename[:-4] + '.log ' + filename[:-4] + '.tex')
1041         if crop:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/printer.py line 1042

Likely real
Uncertain, 35% confidence

Starting a process with a shell, possible injection detected, security issue.
```
1041         if crop:
1042             os.system('pdfcrop ' + filename[:-4] + '.pdf')
1043             os.remove(filename[:-4] + '.pdf')
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Yes, 54% confidence

Unpinned dependency: 'sympy' has no version lock — supply chain risk
```
sympy
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 109

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 31

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 33

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-python@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 44

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: hidakatsuya/action-setup-diff-pdf@v1.4.0
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 48

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/cache@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 56

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: wtfjoke/setup-tectonic@v2
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 83

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: codecov/codecov-action@v3
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 86

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
- uses: actions/upload-artifact@v4
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 111

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-python@v5
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/ci.yml line 121

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: pypa/gh-action-pypi-publish@release/v1
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/galgebra/ga.py line 635

Likely real
Uncertain, 50% confidence

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
```
g = eval(set_lst[1])
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/galgebra/ga.py line 636

Likely real
Uncertain, 50% confidence

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
```
simps = eval(set_lst[2])
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/galgebra/ga.py line 644

Likely real
Uncertain, 50% confidence

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
```
kwargs[name] = eval(value)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/galgebra/printer.py line 1157

Likely real
Uncertain, 50% confidence

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
```
return eval(seval, _eval_global_dict)
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/galgebra/printer.py line 1035

Likely real
Uncertain, 49% confidence

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
```
eval(input('!!!!Return to continue!!!!\n'))
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/ga.py line 644

Likely real
Uncertain, 41% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.
```
643                 [name, value] = arg.split('=')
644                 kwargs[name] = eval(value)
645
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/ga.py line 635

Likely real
Uncertain, 41% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.
```
634         X = symbols(set_lst[0], real=True)
635         g = eval(set_lst[1])
636         simps = eval(set_lst[2])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/ga.py line 636

Likely real
Uncertain, 41% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.
```
635         g = eval(set_lst[1])
636         simps = eval(set_lst[2])
637         args = [root]
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/printer.py line 1035

Likely real
Uncertain, 41% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.
```
1034         os.system(print_cmd)
1035         eval(input('!!!!Return to continue!!!!\n'))
1036
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/printer.py line 1157

Likely real
Uncertain, 40% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.
```
1156         print(seval)
1157     return eval(seval, _eval_global_dict)
1158
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 2

Likely real
Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.
```
1 from .printer import GaLatexPrinter, isinteractive, Format_cnt, latex
2 import subprocess
3 import sys
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/validate_nb_refresh.py line 77

Likely real
Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.
```
76 import re
77 import subprocess
78 import sys
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 260

Likely real
Probably noise, 12% confidence

Starting a process with a partial executable path
```
259         if crop:
260             subprocess.call(['pdfcrop', pdf_filename])
261             subprocess.call(['rm', pdf_filename])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 261

Likely real
Probably noise, 12% confidence

Starting a process with a partial executable path
```
260             subprocess.call(['pdfcrop', pdf_filename])
261             subprocess.call(['rm', pdf_filename])
262             subprocess.call(['mv', rootfilename+'-crop.pdf', pdf_filename])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 262

Likely real
Probably noise, 12% confidence

Starting a process with a partial executable path
```
261             subprocess.call(['rm', pdf_filename])
262             subprocess.call(['mv', rootfilename+'-crop.pdf', pdf_filename])
263         if png:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 264

Likely real
Probably noise, 12% confidence

Starting a process with a partial executable path
```
263         if png:
264             subprocess.call(['Pdf2Png', rootfilename])
265     return
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/validate_nb_refresh.py line 450

Likely real
Probably noise, 12% confidence

Starting a process with a partial executable path
```
449         nb_path = Path(nb_path_str)
450         result = subprocess.run(
451             ['git', 'show', f'{ref}:{nb_path_str}'],
452             capture_output=True,
453         )
454         if result.returncode != 0:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 246

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
245             else:
246                 subprocess.call([pdfprog, tex_filename])
247             # os.system(pdfprog + ' ' + filename[:-4] + sys_cmd['null'])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 244

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
243             if null:
244                 subprocess.call([pdfprog, tex_filename, sys_cmd['null']])
245             else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 262

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
261             subprocess.call(['rm', pdf_filename])
262             subprocess.call(['mv', rootfilename+'-crop.pdf', pdf_filename])
263         if png:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 250

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
249         if evince:
250             subprocess.call([sys_cmd['evince'], pdf_filename])
251
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 256

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
255             if debug:
256                 subprocess.call([sys_cmd['rm'], rootfilename+'.aux ', rootfilename+'.log'])
257             else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 258

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
257             else:
258                 subprocess.call([sys_cmd['rm'], rootfilename+'.aux ', rootfilename+'.log ', rootfilename+'.tex'])
259         if crop:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 260

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
259         if crop:
260             subprocess.call(['pdfcrop', pdf_filename])
261             subprocess.call(['rm', pdf_filename])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 261

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
260             subprocess.call(['pdfcrop', pdf_filename])
261             subprocess.call(['rm', pdf_filename])
262             subprocess.call(['mv', rootfilename+'-crop.pdf', pdf_filename])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/validate_nb_refresh.py line 450

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
449         nb_path = Path(nb_path_str)
450         result = subprocess.run(
451             ['git', 'show', f'{ref}:{nb_path_str}'],
452             capture_output=True,
453         )
454         if result.returncode != 0:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/gprinter.py line 264

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
263         if png:
264             subprocess.call(['Pdf2Png', rootfilename])
265     return
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/mv.py line 825

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
824             return NotImplemented
825         assert not isinstance(A, Mv)
826         return Mv(ga=self.Ga)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/mv.py line 805

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
804             return NotImplemented
805         assert not isinstance(A, Mv)
806         return Mv(A * self.obj, ga=self.Ga)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/galgebra/dop.py line 358

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
357     def __rmul__(self, other):  # functional product of arg and self (arg*self)
358         assert not isinstance(other, Pdop)
359         return Sdop([(other, self)])
```