saf | Snyk

Direct Vulnerabilities

Known vulnerabilities in the saf package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Validation of Specified Quantity in Input	<1.7.0-r3
L GHSA-68fv-2mgg-jv7q	<1.7.0-r3
L GHSA-7q85-xj36-vmfc	<1.7.0-r2
L GHSA-vwc7-r8mq-g2x9	<1.7.0-r2
L Uncontrolled Memory Allocation	<1.7.0-r2
M Link Following	<1.7.0-r2
M CVE-2026-16729	<1.7.0-r0
L Resource Exhaustion	<1.7.0-r0
L GHSA-8xcm-r25x-g524	<1.7.0-r0
L GHSA-r292-9mhp-454m	<1.7.0-r0
M CVE-2026-15157	<1.7.0-r0
L Improper Input Validation	<1.7.0-r0
L GHSA-v3r7-h72x-cjcm	<1.7.0-r0
L GHSA-xcpc-8h2w-3j85	<1.7.0-r0
L CVE-2026-39244	<1.7.0-r0
L GHSA-4xrf-jv44-h6hh	<1.7.0-r0
M CVE-2026-16728	<1.7.0-r0
L GHSA-22jq-vg5j-6vgg	<1.7.0-r0
L Improper Input Validation	<1.7.0-r0
L GHSA-mwp4-54f8-5fhr	<1.7.0-r0
L Improper Input Validation	<1.7.0-r0
L GHSA-m8rv-5g2x-5cg5	<1.7.0-r0
L CVE-2026-14257	<1.7.0-r0
L Resource Exhaustion	<1.7.0-r0
L GHSA-mh99-v99m-4gvg	<1.7.0-r0
L GHSA-rgw5-rvv9-x895	<1.7.0-r0
L GHSA-fxqj-rqcc-2cmp	<1.6.0-r4
L CVE-2026-18446	<1.6.0-r4
L GHSA-7p8r-x3mc-p8w7	<1.6.0-r4
M Directory Traversal	<1.6.0-r4
L GHSA-5p4m-2wfm-xmqj	<1.6.0-r4
L GHSA-2v37-7h3g-55p8	<1.6.0-r4
H Loop with Unreachable Exit Condition ('Infinite Loop')	<1.6.0-r4
L GHSA-3jxr-9vmj-r5cp	<1.6.0-r3
L GHSA-gvwx-54wh-qm9j	<1.6.0-r3
L Incorrect Type Conversion or Cast	<1.6.0-r3
L Allocation of Resources Without Limits or Throttling	<1.6.0-r3
L CVE-2026-13149	<1.6.0-r3
L Uncaught Exception	<1.6.0-r3
L GHSA-w8wr-v893-vjvp	<1.6.0-r3
L GHSA-8x88-c5mf-7j5w	<1.6.0-r3
L GHSA-23hp-3jrh-7fpw	<1.6.0-r3
L Loop with Unreachable Exit Condition ('Infinite Loop')	<1.6.0-r3
L GHSA-35p6-xmwp-9g52	<1.6.0-r2
L CVE-2026-11525	<1.6.0-r2
L GHSA-g8m3-5g58-fq7m	<1.6.0-r2
L CVE-2026-6733	<1.6.0-r2
L CVE-2026-9679	<1.6.0-r2
L CVE-2026-12151	<1.6.0-r2
L GHSA-vxpw-j846-p89q	<1.6.0-r2
L GHSA-p88m-4jfj-68fv	<1.6.0-r2
L CVE-2026-12143	<1.6.0-r1
L GHSA-hmw2-7cc7-3qxx	<1.6.0-r1
L Algorithmic Complexity	<1.6.0-r1
L GHSA-h67p-54hq-rp68	<1.6.0-r1
L Improper Input Validation	<1.6.0-r1
L Interpretation Conflict	<1.6.0-r1
L GHSA-7c78-jf6q-g5cm	<1.6.0-r1
L GHSA-vmf3-w455-68vh	<1.6.0-r1
L Allocation of Resources Without Limits or Throttling	<1.6.0-r0
L Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')	<1.6.0-r0
L GHSA-jmr7-xgp7-cmfj	<1.6.0-r0
L GHSA-xx6v-rp6x-q39c	<1.6.0-r0
L GHSA-xhjh-pmcv-23jw	<1.6.0-r0
L GHSA-pmwg-cvhr-8vh7	<1.6.0-r0
L XML Injection	<1.6.0-r0
H Server-Side Request Forgery (SSRF)	<1.6.0-r0
L Improper Validation of Specified Quantity in Input	<1.6.0-r0
L GHSA-x6wf-f3px-wcqx	<1.6.0-r0
C Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	<1.6.0-r0
M Cross-site Scripting (XSS)	<1.6.0-r0
L XML Injection	<1.6.0-r0
L GHSA-ph9p-34f9-6g65	<1.6.0-r0
L GHSA-5c9x-8gcm-mpgx	<1.6.0-r0
L Cross-site Scripting (XSS)	<1.6.0-r0
C Improperly Controlled Modification of Dynamically-Determined Object Attributes	<1.6.0-r0
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	<1.6.0-r0
L GHSA-r6q2-hw4h-h46w	<1.6.0-r0
L GHSA-7r86-cg39-jmmj	<1.6.0-r0
L GHSA-fvcv-3m26-pcqx	<1.6.0-r0
L GHSA-gh4j-gqv2-49f6	<1.6.0-r0
L GHSA-3w6x-2g7m-8v23	<1.6.0-r0
M Directory Traversal	<1.6.0-r0
M Improper Authentication	<1.6.0-r0
L CRLF Injection	<1.6.0-r0
L Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')	<1.6.0-r0
M CVE-2026-2950	<1.6.0-r0
L Inefficient Regular Expression Complexity	<1.6.0-r0
M Improper Handling of Unicode Encoding	<1.6.0-r0
L GHSA-qx2v-qp2m-jg93	<1.6.0-r0
L GHSA-3p68-rc4w-qgx5	<1.6.0-r0
L GHSA-445q-vr5w-6q77	<1.6.0-r0
L GHSA-f886-m6hf-6m8v	<1.6.0-r0
L Allocation of Resources Without Limits or Throttling	<1.6.0-r0
L GHSA-2g4f-4pwh-qvx6	<1.6.0-r0
L Improper Encoding or Escaping of Output	<1.6.0-r0
L GHSA-34x7-hfp2-rc4v	<1.6.0-r0
L GHSA-q8qp-cvcw-x6jj	<1.6.0-r0
L Directory Traversal	<1.6.0-r0
L GHSA-j759-j44w-7fr8	<1.6.0-r0
L CVE-2026-8723	<1.6.0-r0
H CVE-2026-2391	<1.6.0-r0
H Directory Traversal	<1.6.0-r0
M Directory Traversal	<1.6.0-r0
L GHSA-w9j2-pvgh-6h63	<1.6.0-r0
L XML Injection	<1.6.0-r0
L GHSA-9ppj-qmqm-q256	<1.6.0-r0
L GHSA-m7jm-9gc2-mpf2	<1.6.0-r0
L GHSA-w7fw-mjwx-w883	<1.6.0-r0
L GHSA-27v5-c462-wpq7	<1.6.0-r0
L GHSA-f23m-r3pf-42rh	<1.6.0-r0
L GHSA-qffp-2rhf-9h96	<1.6.0-r0
C Permissive Whitelist	<1.6.0-r0
L GHSA-fj3w-jwp8-x2g3	<1.6.0-r0
C CVE-2026-4800	<1.6.0-r0
L GHSA-w5hq-g745-h8pq	<1.6.0-r0
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	<1.6.0-r0
M HTTP Response Splitting	<1.6.0-r0
L GHSA-43fc-jf86-j433	<1.6.0-r0
L GHSA-2v35-w6hq-6mfw	<1.6.0-r0
L Uncontrolled Recursion	<1.6.0-r0
L GHSA-8qq5-rm4j-mr97	<1.6.0-r0
L GHSA-vf2m-468p-8v99	<1.6.0-r0
L GHSA-3v7f-55p6-f55p	<1.6.0-r0
H Uncontrolled Recursion	<1.6.0-r0
L OS Command Injection	<1.6.0-r0
L GHSA-8gc5-j5rx-235r	<1.6.0-r0
L GHSA-5j98-mcp5-4vw2	<1.6.0-r0
L GHSA-6chq-wfr3-2hj9	<1.6.0-r0
L XML Injection	<1.6.0-r0
L Uncontrolled Recursion	<1.6.0-r0
L GHSA-c2c7-rcm5-vvqj	<1.6.0-r0
L Inefficient Regular Expression Complexity	<1.6.0-r0
H Resource Exhaustion	<1.6.0-r0
L GHSA-48c2-rrv3-qjmp	<1.6.0-r0
L GHSA-23c5-xmqv-rm74	<1.6.0-r0
M Directory Traversal	<1.6.0-r0
L Incorrect Regular Expression	<1.6.0-r0
L Improper Check for Unusual or Exceptional Conditions	<1.6.0-r0
L CVE-2026-4926	<1.6.0-r0
L GHSA-j3q9-mxjg-w52f	<1.6.0-r0
H Buffer Overflow	<1.6.0-r0
L GHSA-73rr-hh4g-fpgx	<1.6.0-r0
L GHSA-37qj-frw5-hhjh	<1.6.0-r0
L GHSA-f6ww-3ggp-fr8h	<1.6.0-r0
L CVE-2026-4923	<1.6.0-r0
L GHSA-pf86-5x62-jrwf	<1.6.0-r0
H Resource Exhaustion	<1.6.0-r0
L HTTP Response Splitting	<1.6.0-r0
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	<1.6.0-r0
L XML Injection	<1.6.0-r0
C Unintended Proxy or Intermediary ('Confused Deputy')	<1.6.0-r0
L GHSA-r4q5-vmmm-2653	<1.6.0-r0
L GHSA-v2v4-37r5-5v8g	<1.6.0-r0
L GHSA-jp2q-39xq-3w4g	<1.6.0-r0
L Inefficient Regular Expression Complexity	<1.6.0-r0
L GHSA-qjx8-664m-686j	<1.6.0-r0
L GHSA-83g3-92jg-28cx	<1.6.0-r0
H Directory Traversal	<1.6.0-r0
L GHSA-q8mj-m7cp-5q26	<1.6.0-r0
L GHSA-m7pr-hjqh-92cm	<1.6.0-r0
H Inefficient Regular Expression Complexity	<1.6.0-r0
L GHSA-62hf-57xw-28j9	<1.6.0-r0
L GHSA-wh4c-j3r5-mjhp	<1.6.0-r0
L GHSA-r5fr-rjxr-66jc	<1.6.0-r0
L Improper Input Validation	<1.6.0-r0
L Algorithmic Complexity	<1.6.0-r0
H Out-of-bounds Write	<1.6.0-r0
L GHSA-3ppc-4f35-3m26	<1.6.0-r0
L Permissive Whitelist	<1.6.0-r0
L CVE-2026-6321	<1.5.3-r1
L GHSA-v39h-62p7-jpjc	<1.5.3-r1
L CVE-2026-6322	<1.5.3-r1
L GHSA-q3j6-qgpj-74h6	<1.5.3-r1
L GHSA-3966-f6p6-2qr9	<1.5.3-r1
L Allocation of Resources Without Limits or Throttling	<1.5.1-r0
L Improperly Controlled Modification of Dynamically-Determined Object Attributes	<1.5.1-r0
L CVE-2025-15284	<1.5.3-r1
L GHSA-pj86-cfqh-vqx6	<1.5.1-r0
L GHSA-4hjh-wcwx-xvwj	<1.5.1-r0
L GHSA-mh29-5h37-fv8m	<1.5.2-r0
L GHSA-869p-cjfg-cm3x	<1.5.2-r0
L GHSA-xxjr-mmjv-4gpg	<1.5.3-r1
M CVE-2025-13465	<1.5.3-r1
L GHSA-rm8p-cx58-hcvx	<1.4.22-r1
L CVE-2025-54371	<1.4.22-r1
L CVE-2025-56200	<1.5.2-r0
L GHSA-vghf-hv5q-vc2g	<1.5.2-r0
L CVE-2025-13466	<1.5.2-r0
L CVE-2025-12758	<1.5.2-r0
L GHSA-9965-vmph-33xx	<1.5.2-r0
M Link Following	<1.5.1-r0
L GHSA-wqch-xfxh-vrr4	<1.5.2-r0
L GHSA-52f5-9888-hmc6	<1.5.1-r0
L Incorrect Permission Assignment for Critical Resource	<1.5.3-r1
L Improper Verification of Cryptographic Signature	<1.5.2-r0
L GHSA-6rw7-vpxm-498p	<1.5.3-r1
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	<1.5.2-r0

Vulnerability

Vulnerable Version

Improper Validation of Specified Quantity in Input

<1.7.0-r3