getredash/redash dependency check
Make Your Company Data Driven. Connect to any data source, easily visualize, dashboard and share your data.
getredash/redash: 7 critical findings, each with a fixed version. Plus 14 warnings.
Last checked against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, endoflife.date, Docker Hub, PyPI and npm.
21 things your coding agent doesn’t know about this repo
getredash/redash on GitHub (opens in a new tab)
7 critical14 warnings39 low priority
One task with every fix, most urgent first, the file to change and why. Paste it into Claude Code, Cursor or Codex.
- CriticalVulnerabilityviz-lib/package.json
2 known vulnerabilities in lodash 4.17.23
EPSS: top 3%1 rated high or critical. Most serious: CVE-2021-23337, lodash vulnerable to Code Injection via `_.template` imports key names. Upgrading to 4.18.0 fixes all of them.
- CriticalVulnerabilitypyproject.toml
7 known vulnerabilities in werkzeug 2.3.8
EPSS: top 12%1 rated high or critical. Most serious: CVE-2024-34069, Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain. Upgrading to 3.1.9 fixes all of them.
- CriticalVulnerabilitypyproject.toml
7 known vulnerabilities in urllib3 1.26.19
EPSS: top 14%6 rated high or critical. Most serious: CVE-2026-21441, Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API). Upgrading to 2.8.0 fixes all of them.
- CriticalVulnerabilitypyproject.toml
CVE-2026-59939 in httplib2 0.19.0
EPSS: top 50%httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling. Fixed in 0.32.0.
- CriticalVulnerabilitypyproject.toml
2 known vulnerabilities in restrictedpython 8.1
EPSS: top 52%2 rated high or critical. Most serious: CVE-2026-76825, RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution. Upgrading to 8.4 fixes all of them.
- CriticalVulnerabilitypackage.json
2 known vulnerabilities in axios 0.33.0
EPSS: top 67%1 rated high or critical. Most serious: CVE-2026-101909, Axios: Prototype Pollution Gadget in axios toFormData Options. Upgrading to 0.34.0 fixes all of them.
- CriticalVulnerabilitypyproject.toml
4 known vulnerabilities in cryptography 48.0.0
EPSS: top 78%3 rated high or critical. Most serious: CVE-2026-69247, cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing. Upgrading to 50.0.0 fixes all of them.
- WarningVulnerabilitypackage.json
19 known vulnerabilities in dompurify 2.5.8
EPSS: top 53%Most serious: CVE-2025-26791, DOMPurify allows Cross-site Scripting (XSS). Upgrading to 3.4.16 fixes 18 of them; 1 has no fixed version listed.
- WarningVulnerabilitypyproject.toml
CVE-2025-27516 in jinja2 3.1.5
EPSS: top 59%Jinja2 vulnerable to sandbox breakout through attr filter selecting format method. Fixed in 3.1.6.
- WarningVulnerabilitypackage.json
2 known vulnerabilities in bootstrap 3.4.1
EPSS: top 60%Most serious: CVE-2024-6485, Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes.
3.4.1No fixed version yetView advisory, source: OSV.dev (opens in a new tab) - WarningVulnerabilitypyproject.toml
2 known vulnerabilities in pyjwt 2.14.0
EPSS: top 73%Most serious: CVE-2026-101918, PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False). Upgrading to 2.15.0 fixes all of them.
- WarningVulnerabilitypyproject.toml
4 known vulnerabilities in pymongo 4.6.3
EPSS: top 83%Dev onlyMost serious: CVE-2026-96748, PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters. Upgrading to 4.18.2 fixes all of them.
- WarningVulnerabilitypyproject.toml
CVE-2026-28684 in python-dotenv 0.19.2
EPSS: top 93%python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback. Fixed in 1.2.2.
- WarningOutdatedpackage.json
react 16.14.0 is 3 major versions behind
Latest release is 19.3.1.
- WarningOutdatedpyproject.toml
aniso8601 8.0.0 is 2 major versions behind
Latest release is 10.0.1.
- WarningOutdatedpyproject.toml
flask-migrate 2.5.2 is 2 major versions behind
Latest release is 4.1.0.
- WarningOutdatedpyproject.toml
gunicorn 22.0.0 is 4 major versions behind
Latest release is 26.2.0.
- WarningOutdatedpyproject.toml
redis 4.6.0 is 4 major versions behind
Latest release is 8.1.0.
- WarningOutdatedpyproject.toml
regex 2023.8.8 is 3 major versions behind
Latest release is 2026.9.29.
- WarningOutdatedpyproject.toml
sqlalchemy-searchable 1.2.0 is 2 major versions behind
Latest release is 3.0.0.
- WarningOutdatedpackage.json
react-dom 16.14.0 is 3 major versions behind
Latest release is 19.3.1.
Checked 249 packages and 5 base images from package.json, pyproject.toml, pnpm-lock.yaml, uv.lock and 3 more against:
Add this badge to your README
It shows today’s result and links to this report, so anyone opening the repo sees what needs fixing.
[](https://stackprism.ai/check/github/getredash/redash)What next
Want your agent to check before it adds a package? Connect Claude Code, Cursor or Codex to StackPrism. Setup steps
Ask Prism Agent about getredash/redash
Map the repo (free) and ask what to fix first, whether an upgrade is safe, or what breaks if a service goes down. Prism Agent checks live sources before it answers.
How this report works
StackPrism read package.json, pyproject.toml, pnpm-lock.yaml, uv.lock and 3 more from the default branch of getredash/redash and checked its 249 packages and 5 base images against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, endoflife.date, Docker Hub, PyPI and npm. Nothing was installed or run, and there’s no AI in the findings: each one comes from a source you can open.
Vulnerabilities come from OSV.dev, with known-exploited ones from CISA marked and listed first. Runtimes, frameworks and base images are checked against endoflife.date, and packages against their registry for deprecations and major versions you’ve fallen behind. The fix task above lists every change with the file to edit.
This page refreshes every few hours; after you push a fix, “Check again” runs it now. Only the repo’s root is read. For an app in a sub-folder, paste the folder’s link into the dependency check, and for a private repo, connect GitHub.