Security Report - eizen-producer-consumer

🔴 Vulnerabilities (6)
Severity	CVE ID	Package	Installed	Fixed In	Description
MEDIUM	CVE-2026-22815	aiohttp	3.13.3	3.13.4	aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling
MEDIUM	CVE-2026-34515	aiohttp	3.13.3	3.13.4	aiohttp: AIOHTTP: Information disclosure via static resource handler on Windows
MEDIUM	CVE-2026-34516	aiohttp	3.13.3	3.13.4	aiohttp: AIOHTTP: Denial of Service via excessive multipart headers
MEDIUM	CVE-2026-34525	aiohttp	3.13.3	3.13.4	aiohttp: aiohttp: Security bypass via multiple Host headers
MEDIUM	CVE-2026-25645	requests	2.32.5	2.33.0	requests: Requests: Security bypass due to predictable temporary file creation
HIGH	CVE-2026-26331	yt-dlp	2026.2.4	2026.02.21	yt-dlp: yt-dlp: Arbitrary command injection via maliciously crafted URL when --netrc-cmd is used
🔑 Secrets (0)
Type	File	Line	Match
✅ No secrets found
⚙️ Misconfigurations (0)
Severity	ID	Check	File	Message
✅ No misconfigurations found
📄 Raw JSON Report (click to expand)
{
  "SchemaVersion": 2,
  "CreatedAt": "2026-04-13T06:54:00.037356522Z",
  "ArtifactName": "/src",
  "ArtifactType": "filesystem",
  "Metadata": {
    "ImageConfig": {
      "architecture": "",
      "created": "0001-01-01T00:00:00Z",
      "os": "",
      "rootfs": {
        "type": "",
        "diff_ids": null
      },
      "config": {}
    }
  },
  "Results": [
    {
      "Target": "requirements.txt",
      "Class": "lang-pkgs",
      "Type": "pip",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2026-22815",
          "PkgName": "aiohttp",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/aiohttp@3.13.3"
          },
          "InstalledVersion": "3.13.3",
          "FixedVersion": "3.13.4",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22815",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling",
          "Description": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.",
          "Severity": "MEDIUM",
          "CweIDs": [
            "CWE-400",
            "CWE-770"
          ],
          "VendorSeverity": {
            "ghsa": 2,
            "redhat": 2
          },
          "CVSS": {
            "ghsa": {},
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "V3Score": 5.3
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2026-22815",
            "https://github.com/aio-libs/aiohttp",
            "https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36",
            "https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4",
            "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-22815",
            "https://www.cve.org/CVERecord?id=CVE-2026-22815"
          ],
          "PublishedDate": "2026-04-01T21:16:58.513Z",
          "LastModifiedDate": "2026-04-06T16:48:48.53Z"
        },
        {
          "VulnerabilityID": "CVE-2026-34515",
          "PkgName": "aiohttp",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/aiohttp@3.13.3"
          },
          "InstalledVersion": "3.13.3",
          "FixedVersion": "3.13.4",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34515",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "aiohttp: AIOHTTP: Information disclosure via static resource handler on Windows",
          "Description": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.",
          "Severity": "MEDIUM",
          "CweIDs": [
            "CWE-36",
            "CWE-918"
          ],
          "VendorSeverity": {
            "ghsa": 2,
            "redhat": 2
          },
          "CVSS": {
            "ghsa": {},
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "V3Score": 5.3
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2026-34515",
            "https://github.com/aio-libs/aiohttp",
            "https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d",
            "https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4",
            "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-34515",
            "https://www.cve.org/CVERecord?id=CVE-2026-34515"
          ],
          "PublishedDate": "2026-04-01T21:16:59.57Z",
          "LastModifiedDate": "2026-04-03T16:10:52.68Z"
        },
        {
          "VulnerabilityID": "CVE-2026-34516",
          "PkgName": "aiohttp",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/aiohttp@3.13.3"
          },
          "InstalledVersion": "3.13.3",
          "FixedVersion": "3.13.4",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34516",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "aiohttp: AIOHTTP: Denial of Service via excessive multipart headers",
          "Description": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.",
          "Severity": "MEDIUM",
          "CweIDs": [
            "CWE-770"
          ],
          "VendorSeverity": {
            "ghsa": 2,
            "redhat": 2
          },
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "V3Score": 7.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "V3Score": 5.3
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2026-34516",
            "https://github.com/aio-libs/aiohttp",
            "https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f",
            "https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4",
            "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m5qp-6w8w-w647",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-34516",
            "https://www.cve.org/CVERecord?id=CVE-2026-34516"
          ],
          "PublishedDate": "2026-04-01T21:16:59.723Z",
          "LastModifiedDate": "2026-04-04T04:17:20.147Z"
        },
        {
          "VulnerabilityID": "CVE-2026-34525",
          "PkgName": "aiohttp",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/aiohttp@3.13.3"
          },
          "InstalledVersion": "3.13.3",
          "FixedVersion": "3.13.4",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34525",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "aiohttp: aiohttp: Security bypass via multiple Host headers",
          "Description": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.",
          "Severity": "MEDIUM",
          "CweIDs": [
            "CWE-20",
            "CWE-444"
          ],
          "VendorSeverity": {
            "ghsa": 2,
            "redhat": 2
          },
          "CVSS": {
            "ghsa": {},
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
              "V3Score": 5.4
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2026-34525",
            "https://github.com/aio-libs/aiohttp",
            "https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000",
            "https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349",
            "https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4",
            "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-c427-h43c-vf67",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-34525",
            "https://www.cve.org/CVERecord?id=CVE-2026-34525"
          ],
          "PublishedDate": "2026-04-01T21:17:00.49Z",
          "LastModifiedDate": "2026-04-03T16:10:52.68Z"
        },
        {
          "VulnerabilityID": "CVE-2026-25645",
          "PkgName": "requests",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/requests@2.32.5"
          },
          "InstalledVersion": "2.32.5",
          "FixedVersion": "2.33.0",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "Description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.",
          "Severity": "MEDIUM",
          "CweIDs": [
            "CWE-377"
          ],
          "VendorSeverity": {
            "azure": 2,
            "ghsa": 2,
            "nvd": 2,
            "photon": 2,
            "redhat": 2
          },
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
              "V3Score": 4.4
            },
            "nvd": {
              "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "V3Score": 5.5
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "V3Score": 4.7
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2026-25645",
            "https://github.com/psf/requests",
            "https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7",
            "https://github.com/psf/requests/releases/tag/v2.33.0",
            "https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-25645",
            "https://www.cve.org/CVERecord?id=CVE-2026-25645"
          ],
          "PublishedDate": "2026-03-25T17:16:52.97Z",
          "LastModifiedDate": "2026-03-30T14:23:16.127Z"
        },
        {
          "VulnerabilityID": "CVE-2026-26331",
          "PkgName": "yt-dlp",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/yt-dlp@2026.2.4"
          },
          "InstalledVersion": "2026.2.4",
          "FixedVersion": "2026.02.21",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-26331",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "yt-dlp: yt-dlp: Arbitrary command injection via maliciously crafted URL when --netrc-cmd is used",
          "Description": "yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be trivial for a maliciously crafted webpage with an inconspicuous URL to covertly exploit this vulnerability via HTTP redirect. Users without `--netrc-cmd` in their arguments or `netrc_cmd` in their scripts are unaffected. No evidence has been found of this exploit being used in the wild. yt-dlp version 2026.02.21 fixes this issue by validating all netrc \"machine\" values and raising an error upon unexpected input. As a workaround, users who are unable to upgrade should avoid using the `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter), or they should at least not pass a placeholder (`{}`) in their `--netrc-cmd` argument.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-78"
          ],
          "VendorSeverity": {
            "ghsa": 3,
            "redhat": 3
          },
          "CVSS": {
            "ghsa": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "V3Score": 8.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "V3Score": 8.8
            }
          },
          "References": [
            "https://access.redhat.com/security/cve/CVE-2026-26331",
            "https://github.com/yt-dlp/yt-dlp",
            "https://github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a",
            "https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21",
            "https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-26331",
            "https://www.cve.org/CVERecord?id=CVE-2026-26331"
          ],
          "PublishedDate": "2026-02-24T03:16:01.71Z",
          "LastModifiedDate": "2026-02-25T19:32:30.417Z"
        }
      ]
    },
    {
      "Target": "Dockerfile",
      "Class": "config",
      "Type": "dockerfile",
      "MisconfSummary": {
        "Successes": 24,
        "Failures": 0,
        "Exceptions": 0
      }
    }
  ]
}
🛡️ Security Scan Report

0

1

5

0

0

0
