← Scan another repo

github.com/3b1b/manim

@ d6c31f2d606a

Submitted 8/4/2026, 10:25:54 AM · Status: ok

Risk grade
B
28 / 100
Findings
4
0 critical2 high2 medium0 low0 info0 on CISA KEV0ATT&CK
Showing 4 of 4 findings

Findings

  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepmanimlib/mobject/mobject.py:626
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepmanimlib/utils/sounds.py:26
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(docs)
    checkov.github/workflows/docs.yml:0
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Upload Python Package)
    checkov.github/workflows/publish.yml:0

This report is public.