{ "auditReportVersion": 2, "vulnerabilities": { "@babel/core": { "name": "@babel/core", "severity": "low", "isDirect": true, "via": [ { "source": 1123528, "name": "@babel/core", "dependency": "@babel/core", "title": "@babel/core: Arbitrary File Read via sourceMappingURL Comment", "url": "https://github.com/advisories/GHSA-4x5r-pxfx-6jf8", "severity": "low", "cwe": [ "CWE-22", "CWE-200" ], "cvss": { "score": 3.2, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" }, "range": "<=7.29.0" } ], "effects": [], "range": "<=7.29.0", "nodes": [ "node_modules/@babel/core" ], "fixAvailable": true }, "@jest/core": { "name": "@jest/core", "severity": "low", "isDirect": false, "via": [ "jest-config" ], "effects": [], "range": ">=25.2.0-alpha.86", "nodes": [ "node_modules/@jest/core" ], "fixAvailable": true }, "@vue/cli-plugin-router": { "name": "@vue/cli-plugin-router", "severity": "moderate", "isDirect": false, "via": [ "@vue/cli-service" ], "effects": [ "@vue/cli-service" ], "range": "*", "nodes": [ "node_modules/@vue/cli-plugin-router" ], "fixAvailable": false }, "@vue/cli-plugin-vuex": { "name": "@vue/cli-plugin-vuex", "severity": "moderate", "isDirect": false, "via": [ "@vue/cli-service" ], "effects": [], "range": "*", "nodes": [ "node_modules/@vue/cli-plugin-vuex" ], "fixAvailable": true }, "@vue/cli-service": { "name": "@vue/cli-service", "severity": "moderate", "isDirect": true, "via": [ "@vue/cli-plugin-router", "@vue/cli-plugin-vuex", "@vue/component-compiler-utils", "copy-webpack-plugin", "css-minimizer-webpack-plugin", "vue-loader", "vue-template-compiler", "webpack-dev-server" ], "effects": [ "@vue/cli-plugin-router", "@vue/cli-plugin-vuex" ], "range": "*", "nodes": [ "node_modules/@vue/cli-service" ], "fixAvailable": false }, "@vue/component-compiler-utils": { "name": "@vue/component-compiler-utils", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [ "@vue/cli-service", "vue-loader" ], "range": "*", "nodes": [ "node_modules/@vue/component-compiler-utils" ], "fixAvailable": false }, "@vue/test-utils": { "name": "@vue/test-utils", "severity": "moderate", "isDirect": true, "via": [ "vue", "vue-template-compiler" ], "effects": [], "range": "<=1.3.6", "nodes": [ "node_modules/@vue/test-utils" ], "fixAvailable": { "name": "@vue/test-utils", "version": "2.5.1", "isSemVerMajor": true } }, "@wangeditor/editor-for-vue": { "name": "@wangeditor/editor-for-vue", "severity": "low", "isDirect": true, "via": [ "vue" ], "effects": [], "range": "<=1.0.2", "nodes": [ "node_modules/@wangeditor/editor-for-vue" ], "fixAvailable": { "name": "@wangeditor/editor-for-vue", "version": "5.1.12", "isSemVerMajor": true } }, "axios": { "name": "axios", "severity": "high", "isDirect": true, "via": [ { "source": 1138749, "name": "axios", "dependency": "axios", "title": "Axios: Prototype pollution auth subfields can inject Basic auth", "url": "https://github.com/advisories/GHSA-xj6q-8x83-jv6g", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.15.2 <1.18.0" }, { "source": 1147949, "name": "axios", "dependency": "axios", "title": "Axios: Prototype pollution gadgets can alter axios request construction", "url": "https://github.com/advisories/GHSA-mmx7-hfxf-jppx", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.18.0" }, { "source": 1147950, "name": "axios", "dependency": "axios", "title": "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service", "url": "https://github.com/advisories/GHSA-pmv8-rq9r-6j72", "severity": "moderate", "cwe": [ "CWE-400", "CWE-770" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.18.0" }, { "source": 1153175, "name": "axios", "dependency": "axios", "title": "Axios: HTTP/2 streamed uploads bypass `maxBodyLength`", "url": "https://github.com/advisories/GHSA-mwf2-3pr3-8698", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.13.0 <1.18.0" }, { "source": 1153178, "name": "axios", "dependency": "axios", "title": "Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning", "url": "https://github.com/advisories/GHSA-gcfj-64vw-6mp9", "severity": "high", "cwe": [ "CWE-200", "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.15.2 <1.18.0" }, { "source": 1153180, "name": "axios", "dependency": "axios", "title": "Axios: Nested axios option objects can consume polluted prototype values", "url": "https://github.com/advisories/GHSA-7q8q-rj6j-mhjq", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.18.0" }, { "source": 1153182, "name": "axios", "dependency": "axios", "title": "Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`", "url": "https://github.com/advisories/GHSA-jqh4-m9w3-8hp9", "severity": "moderate", "cwe": [ "CWE-770" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.7.0 <1.18.0" }, { "source": 1153184, "name": "axios", "dependency": "axios", "title": "Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios", "url": "https://github.com/advisories/GHSA-f4gw-2p7v-4548", "severity": "moderate", "cwe": [ "CWE-183", "CWE-918" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.15.0 <1.18.0" }, { "source": 1153185, "name": "axios", "dependency": "axios", "title": "Axios: Excessive recursion in formDataToJSON can cause denial of service", "url": "https://github.com/advisories/GHSA-42h9-826w-cgv3", "severity": "moderate", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.18.0" }, { "source": 1193664, "name": "axios", "dependency": "axios", "title": "Axios form serializer maxDepth bypass via {} metatoken", "url": "https://github.com/advisories/GHSA-hcpx-6fm6-wx23", "severity": "moderate", "cwe": [ "CWE-674" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.15.1 <1.18.0" }, { "source": 1240600, "name": "axios", "dependency": "axios", "title": "Axios: Prototype pollution gadget in fetch adapter can alter outbound requests", "url": "https://github.com/advisories/GHSA-vh66-26gq-q6x8", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.7.0 <1.20.0" }, { "source": 1240601, "name": "axios", "dependency": "axios", "title": "Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method", "url": "https://github.com/advisories/GHSA-9fr6-4gfg-395g", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.20.0" }, { "source": 1240604, "name": "axios", "dependency": "axios", "title": "Axios: ReDoS (O(NĀ²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location", "url": "https://github.com/advisories/GHSA-mghh-pgcx-3jjj", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.15.0 <1.20.0" }, { "source": 1240605, "name": "axios", "dependency": "axios", "title": "Axios: Prototype Pollution Gadget in axios toFormData Options", "url": "https://github.com/advisories/GHSA-x97p-jq2g-jp4f", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.15.1 <1.20.0" }, { "source": 1240607, "name": "axios", "dependency": "axios", "title": "Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls", "url": "https://github.com/advisories/GHSA-3pq3-5fj3-cg6v", "severity": "high", "cwe": [ "CWE-918" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.13.0 <1.20.0" }, { "source": 1240608, "name": "axios", "dependency": "axios", "title": "Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization", "url": "https://github.com/advisories/GHSA-542g-h47m-68v8", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.13.0 <1.20.0" }, { "source": 1240626, "name": "axios", "dependency": "axios", "title": "Axios: Header Injection via Inherited headers After Minimal Interceptor", "url": "https://github.com/advisories/GHSA-j8rh-479h-cp32", "severity": "moderate", "cwe": [ "CWE-74", "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.0.0 <1.20.0" }, { "source": 1240627, "name": "axios", "dependency": "axios", "title": "Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders", "url": "https://github.com/advisories/GHSA-4hqw-qxg8-jxx2", "severity": "moderate", "cwe": [ "CWE-74", "CWE-693", "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.12.0 <1.20.0" }, { "source": 1240628, "name": "axios", "dependency": "axios", "title": "Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection", "url": "https://github.com/advisories/GHSA-m8m8-qj5v-23w3", "severity": "high", "cwe": [ "CWE-441", "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.15.2 <1.20.0" }, { "source": 1240629, "name": "axios", "dependency": "axios", "title": "Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges", "url": "https://github.com/advisories/GHSA-44g4-m2mj-wpvx", "severity": "moderate", "cwe": [ "CWE-693" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.15.0 <1.20.0" } ], "effects": [], "range": "1.0.0 - 1.19.0", "nodes": [ "node_modules/axios" ], "fixAvailable": true }, "babel-plugin-transform-es2015-modules-commonjs": { "name": "babel-plugin-transform-es2015-modules-commonjs", "severity": "critical", "isDirect": false, "via": [ "babel-template" ], "effects": [ "vue-jest" ], "range": "<=7.0.0-beta.0", "nodes": [ "node_modules/babel-plugin-transform-es2015-modules-commonjs" ], "fixAvailable": { "name": "vue-jest", "version": "0.6.1", "isSemVerMajor": true } }, "babel-template": { "name": "babel-template", "severity": "critical", "isDirect": false, "via": [ "babel-traverse" ], "effects": [ "babel-plugin-transform-es2015-modules-commonjs" ], "range": "*", "nodes": [ "node_modules/babel-template" ], "fixAvailable": { "name": "vue-jest", "version": "0.6.1", "isSemVerMajor": true } }, "babel-traverse": { "name": "babel-traverse", "severity": "critical", "isDirect": false, "via": [ { "source": 1117412, "name": "babel-traverse", "dependency": "babel-traverse", "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code", "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92", "severity": "critical", "cwe": [ "CWE-184", "CWE-697" ], "cvss": { "score": 9.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }, "range": "<7.23.2" } ], "effects": [ "babel-template" ], "range": "*", "nodes": [ "node_modules/babel-traverse" ], "fixAvailable": { "name": "vue-jest", "version": "0.6.1", "isSemVerMajor": true } }, "baseline-browser-mapping": { "name": "baseline-browser-mapping", "severity": "moderate", "isDirect": false, "via": [ { "source": 1193686, "name": "baseline-browser-mapping", "dependency": "baseline-browser-mapping", "title": "baseline-browser-mapping process termination on invalid input causes denial of service", "url": "https://github.com/advisories/GHSA-w5vr-8v7q-w6rv", "severity": "moderate", "cwe": [ "CWE-705" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=2.0.0 <2.11.0" } ], "effects": [], "range": ">=2.0.0 <2.11.0", "nodes": [ "node_modules/baseline-browser-mapping" ], "fixAvailable": true }, "body-parser": { "name": "body-parser", "severity": "high", "isDirect": false, "via": [ { "source": 1123977, "name": "body-parser", "dependency": "body-parser", "title": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement", "url": "https://github.com/advisories/GHSA-v422-hmwv-36x6", "severity": "low", "cwe": [ "CWE-770" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.20.6" }, { "source": 1243073, "name": "body-parser", "dependency": "body-parser", "title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body", "url": "https://github.com/advisories/GHSA-27r3-jxmh-p828", "severity": "high", "cwe": [ "CWE-248" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.20.9" } ], "effects": [], "range": "<=1.20.8", "nodes": [ "node_modules/body-parser" ], "fixAvailable": true }, "brace-expansion": { "name": "brace-expansion", "severity": "high", "isDirect": false, "via": [ { "source": 1123896, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups", "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.0.0 <2.1.2" }, { "source": 1123897, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups", "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.1.16" }, { "source": 1130588, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash", "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg", "severity": "high", "cwe": [ "CWE-400", "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.1.17" }, { "source": 1130589, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash", "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg", "severity": "high", "cwe": [ "CWE-400", "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=2.0.0 <2.1.3" }, { "source": 1130736, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation", "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895", "severity": "high", "cwe": [ "CWE-400", "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=2.0.0 <2.1.4" }, { "source": 1130737, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation", "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895", "severity": "high", "cwe": [ "CWE-400", "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.1.18" }, { "source": 1240100, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service", "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr", "severity": "moderate", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.1.21" }, { "source": 1240101, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service", "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr", "severity": "moderate", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.0.0 <2.1.7" }, { "source": 1240104, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion", "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7", "severity": "high", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.1.20" }, { "source": 1240105, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion", "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7", "severity": "high", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=2.0.0 <2.1.6" }, { "source": 1240108, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion", "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p", "severity": "high", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.1.19" }, { "source": 1240109, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion", "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p", "severity": "high", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=2.0.0 <2.1.5" } ], "effects": [], "range": "<=1.1.20 || 2.0.0 - 2.1.6", "nodes": [ "node_modules/brace-expansion", "node_modules/editorconfig/node_modules/brace-expansion", "node_modules/js-beautify/node_modules/brace-expansion" ], "fixAvailable": true }, "browserslist": { "name": "browserslist", "severity": "high", "isDirect": false, "via": [ { "source": 1153171, "name": "browserslist", "dependency": "browserslist", "title": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM", "url": "https://github.com/advisories/GHSA-c83g-rgw3-j3cx", "severity": "high", "cwe": [ "CWE-770" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=4.28.6" }, { "source": 1153172, "name": "browserslist", "dependency": "browserslist", "title": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)", "url": "https://github.com/advisories/GHSA-73wf-gq98-2v4g", "severity": "high", "cwe": [ "CWE-248", "CWE-1321" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=4.28.6" } ], "effects": [], "range": "<=4.28.6", "nodes": [ "node_modules/browserslist" ], "fixAvailable": true }, "colord": { "name": "colord", "severity": "moderate", "isDirect": false, "via": [ { "source": 1193675, "name": "colord", "dependency": "colord", "title": "Colord: Slow rejection of oversized malformed color strings", "url": "https://github.com/advisories/GHSA-2wm5-q62r-hmrv", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 0, "vectorString": null }, "range": "<2.9.4" } ], "effects": [], "range": "<2.9.4", "nodes": [ "node_modules/colord" ], "fixAvailable": true }, "compression": { "name": "compression", "severity": "high", "isDirect": false, "via": [ { "source": 1241221, "name": "compression", "dependency": "compression", "title": "compression vulnerable to Denial of Service via memory leak on premature response close", "url": "https://github.com/advisories/GHSA-vc2v-76pw-4v95", "severity": "high", "cwe": [ "CWE-401", "CWE-459" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.8.2" } ], "effects": [], "range": "<1.8.2", "nodes": [ "node_modules/compression" ], "fixAvailable": true }, "copy-webpack-plugin": { "name": "copy-webpack-plugin", "severity": "moderate", "isDirect": false, "via": [ "serialize-javascript" ], "effects": [], "range": "6.1.1 - 13.0.1", "nodes": [ "node_modules/copy-webpack-plugin" ], "fixAvailable": true }, "create-jest": { "name": "create-jest", "severity": "low", "isDirect": false, "via": [ "jest-config" ], "effects": [ "jest-cli" ], "range": ">=29.7.0", "nodes": [ "node_modules/create-jest" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "css": { "name": "css", "severity": "high", "isDirect": false, "via": [ "source-map-resolve" ], "effects": [], "range": ">=2.2.2", "nodes": [ "node_modules/css" ], "fixAvailable": true }, "css-minimizer-webpack-plugin": { "name": "css-minimizer-webpack-plugin", "severity": "moderate", "isDirect": false, "via": [ "serialize-javascript" ], "effects": [ "@vue/cli-service" ], "range": "1.1.4 - 7.0.4", "nodes": [ "node_modules/css-minimizer-webpack-plugin" ], "fixAvailable": false }, "decode-uri-component": { "name": "decode-uri-component", "severity": "high", "isDirect": false, "via": [ { "source": 1147955, "name": "decode-uri-component", "dependency": "decode-uri-component", "title": "decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input", "url": "https://github.com/advisories/GHSA-vcc3-ghjq-m6fr", "severity": "moderate", "cwe": [ "CWE-400", "CWE-405", "CWE-407", "CWE-1176" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=0.4.2" }, { "source": 1243857, "name": "decode-uri-component", "dependency": "decode-uri-component", "title": "decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs", "url": "https://github.com/advisories/GHSA-qr28-fpjm-wq7f", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=0.5.0" } ], "effects": [ "source-map-resolve" ], "range": "<=0.5.0", "nodes": [ "node_modules/decode-uri-component" ], "fixAvailable": true }, "deepmerge": { "name": "deepmerge", "severity": "low", "isDirect": false, "via": [ { "source": 1243505, "name": "deepmerge", "dependency": "deepmerge", "title": "deepmerge mergeObject() allows prototype poisoning of returned objects", "url": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4", "severity": "low", "cwe": [ "CWE-1321" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": ">=4.2.0 <=4.3.1" } ], "effects": [ "jest-config" ], "range": ">=4.2.0", "nodes": [ "node_modules/jest-config/node_modules/deepmerge" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "editorconfig": { "name": "editorconfig", "severity": "moderate", "isDirect": false, "via": [ "minimatch" ], "effects": [ "js-beautify" ], "range": ">=1.0.3", "nodes": [ "node_modules/editorconfig" ], "fixAvailable": true }, "element-ui": { "name": "element-ui", "severity": "low", "isDirect": true, "via": [ "vue" ], "effects": [], "range": ">=1.0.0-rc.1", "nodes": [ "node_modules/element-ui" ], "fixAvailable": { "name": "element-ui", "version": "0.2.6", "isSemVerMajor": true } }, "fast-uri": { "name": "fast-uri", "severity": "high", "isDirect": false, "via": [ { "source": 1124064, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to host confusion via literal backslash authority delimiter", "url": "https://github.com/advisories/GHSA-v2hh-gcrm-f6hx", "severity": "high", "cwe": [ "CWE-436" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.0.0 <=3.1.3" }, { "source": 1130720, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to host confusion via backslash authority introducer", "url": "https://github.com/advisories/GHSA-7p8r-x3mc-p8w7", "severity": "high", "cwe": [ "CWE-436" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.0.0 <3.1.5" }, { "source": 1158524, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization", "url": "https://github.com/advisories/GHSA-f65p-4m7j-42xc", "severity": "high", "cwe": [ "CWE-20", "CWE-918" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.0.0 <3.1.6" }, { "source": 1158527, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding", "url": "https://github.com/advisories/GHSA-fph4-wmhf-6fwf", "severity": "high", "cwe": [ "CWE-174", "CWE-918" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.1.2 <3.1.6" }, { "source": 1158530, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to host confusion via percent-encoded scheme normalization", "url": "https://github.com/advisories/GHSA-jqff-g426-hqxp", "severity": "high", "cwe": [ "CWE-177" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.0.0 <3.1.6" }, { "source": 1204921, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to host confusion via failed IDN canonicalization", "url": "https://github.com/advisories/GHSA-4c8g-83qw-93j6", "severity": "high", "cwe": [ "CWE-436", "CWE-551" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.0.0 <3.1.3" }, { "source": 1239943, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to authority injection via an unvalidated port in serialize", "url": "https://github.com/advisories/GHSA-qw65-cvwx-89v3", "severity": "high", "cwe": [ "CWE-116" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=3.0.0 <3.1.7" }, { "source": 1240091, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets", "url": "https://github.com/advisories/GHSA-hrr3-gc8f-f4qj", "severity": "moderate", "cwe": [ "CWE-178" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": ">=3.0.0 <3.1.8" }, { "source": 1243098, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding", "url": "https://github.com/advisories/GHSA-w74x-v6f9-j3xg", "severity": "moderate", "cwe": [ "CWE-172", "CWE-180" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": ">=3.0.0 <3.1.9" }, { "source": 1243101, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to improper path equivalence in relative reference normalization", "url": "https://github.com/advisories/GHSA-xhq7-xmqj-769h", "severity": "low", "cwe": [ "CWE-41" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": ">=3.0.0 <3.1.9" }, { "source": 1243107, "name": "fast-uri", "dependency": "fast-uri", "title": "fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references", "url": "https://github.com/advisories/GHSA-333x-w4r6-6crp", "severity": "low", "cwe": [ "CWE-41", "CWE-116" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": ">=3.0.0 <3.1.9" } ], "effects": [], "range": "3.0.0 - 3.1.8", "nodes": [ "node_modules/fast-uri" ], "fixAvailable": true }, "follow-redirects": { "name": "follow-redirects", "severity": "high", "isDirect": false, "via": [ { "source": 1242604, "name": "follow-redirects", "dependency": "follow-redirects", "title": "follow-redirects array-form headers bypass cross-origin credential stripping", "url": "https://github.com/advisories/GHSA-q3jh-wrc6-jgq8", "severity": "high", "cwe": [ "CWE-200", "CWE-212" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.16.0 <1.16.1" }, { "source": 1242605, "name": "follow-redirects", "dependency": "follow-redirects", "title": "follow-redirects sensitiveHeaders regex escaping can expose credential headers", "url": "https://github.com/advisories/GHSA-8r9p-f939-6h3c", "severity": "high", "cwe": [ "CWE-185", "CWE-200" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.16.0 <1.16.1" }, { "source": 1244003, "name": "follow-redirects", "dependency": "follow-redirects", "title": "follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects", "url": "https://github.com/advisories/GHSA-mrwp-f3q8-3g9p", "severity": "high", "cwe": [ "CWE-201" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "range": ">=1.16.0 <=1.16.1" } ], "effects": [], "range": "1.16.0 - 1.16.1", "nodes": [ "node_modules/follow-redirects" ], "fixAvailable": true }, "form-data": { "name": "form-data", "severity": "high", "isDirect": false, "via": [ { "source": 1120743, "name": "form-data", "dependency": "form-data", "title": "form-data: CRLF injection in form-data via unescaped multipart field names and filenames", "url": "https://github.com/advisories/GHSA-hmw2-7cc7-3qxx", "severity": "high", "cwe": [ "CWE-93" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": ">=4.0.0 <4.0.6" } ], "effects": [], "range": "4.0.0 - 4.0.5", "nodes": [ "node_modules/form-data" ], "fixAvailable": true }, "glob": { "name": "glob", "severity": "high", "isDirect": false, "via": [ { "source": 1109842, "name": "glob", "dependency": "glob", "title": "glob CLI: Command injection via -c/--cmd executes matches with shell:true", "url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2", "severity": "high", "cwe": [ "CWE-78" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "range": ">=10.2.0 <10.5.0" }, { "source": 1244013, "name": "glob", "dependency": "glob", "title": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal", "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=9.0.0 <=14.0.1" }, "minimatch" ], "effects": [], "range": "9.0.0 - 14.0.1", "nodes": [ "node_modules/js-beautify/node_modules/glob" ], "fixAvailable": true }, "http-proxy-middleware": { "name": "http-proxy-middleware", "severity": "moderate", "isDirect": false, "via": [ { "source": 1121360, "name": "http-proxy-middleware", "dependency": "http-proxy-middleware", "title": "http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass", "url": "https://github.com/advisories/GHSA-64mm-vxmg-q3vj", "severity": "moderate", "cwe": [ "CWE-20", "CWE-187" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=0.16.0 <2.0.10" } ], "effects": [], "range": ">=0.16.0 <2.0.10", "nodes": [ "node_modules/http-proxy-middleware" ], "fixAvailable": true }, "jest": { "name": "jest", "severity": "low", "isDirect": true, "via": [ "@jest/core", "jest-cli" ], "effects": [], "range": ">=25.2.0-alpha.86", "nodes": [ "node_modules/jest" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "jest-cli": { "name": "jest-cli", "severity": "low", "isDirect": false, "via": [ "@jest/core", "create-jest", "jest-config" ], "effects": [ "jest" ], "range": ">=25.2.0-alpha.86", "nodes": [ "node_modules/jest-cli" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "jest-config": { "name": "jest-config", "severity": "low", "isDirect": false, "via": [ "deepmerge" ], "effects": [ "@jest/core", "create-jest", "jest-cli" ], "range": ">=25.2.0-alpha.86", "nodes": [ "node_modules/jest-config" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "joi": { "name": "joi", "severity": "high", "isDirect": false, "via": [ { "source": 1120656, "name": "joi", "dependency": "joi", "title": "joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas", "url": "https://github.com/advisories/GHSA-q7cg-457f-vx79", "severity": "moderate", "cwe": [ "CWE-248", "CWE-400" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<17.13.4" }, { "source": 1193674, "name": "joi", "dependency": "joi", "title": "joi: Prototype pollution via a `__proto__` language key in custom messages", "url": "https://github.com/advisories/GHSA-6w3j-5fw6-r9vr", "severity": "low", "cwe": [ "CWE-1321" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": ">=17.2.0 <17.13.6" }, { "source": 1193679, "name": "joi", "dependency": "joi", "title": "joi: object().rename() with a template target can set the validated object's prototype", "url": "https://github.com/advisories/GHSA-gg4h-3hg2-grpc", "severity": "low", "cwe": [ "CWE-1321" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": ">=16.0.0 <17.13.5" }, { "source": 1241212, "name": "joi", "dependency": "joi", "title": "joi messages compilation allows prototype replacement through __proto__ error codes", "url": "https://github.com/advisories/GHSA-wr44-6hxh-3jwq", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<17.13.8" }, { "source": 1241279, "name": "joi", "dependency": "joi", "title": "joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`", "url": "https://github.com/advisories/GHSA-6h2x-m376-mqjq", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=17.2.0 <17.13.7" }, { "source": 1244009, "name": "joi", "dependency": "joi", "title": "joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service", "url": "https://github.com/advisories/GHSA-4528-x5fx-h6hg", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=17.1.1 <17.13.9" } ], "effects": [], "range": "<=17.13.8", "nodes": [ "node_modules/joi" ], "fixAvailable": true }, "js-beautify": { "name": "js-beautify", "severity": "moderate", "isDirect": false, "via": [ "editorconfig" ], "effects": [], "range": ">=1.14.9", "nodes": [ "node_modules/js-beautify" ], "fixAvailable": true }, "js-cookie": { "name": "js-cookie", "severity": "high", "isDirect": false, "via": [ { "source": 1120607, "name": "js-cookie", "dependency": "js-cookie", "title": "JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection", "url": "https://github.com/advisories/GHSA-qjx8-664m-686j", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<=3.0.5" } ], "effects": [], "range": "<=3.0.5", "nodes": [ "node_modules/js-cookie" ], "fixAvailable": true }, "js-yaml": { "name": "js-yaml", "severity": "high", "isDirect": false, "via": [ { "source": 1121859, "name": "js-yaml", "dependency": "js-yaml", "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases", "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68", "severity": "moderate", "cwe": [ "CWE-407" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<3.15.0" }, { "source": 1123912, "name": "js-yaml", "dependency": "js-yaml", "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption", "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=3.0.0 <3.15.0" }, { "source": 1138114, "name": "js-yaml", "dependency": "js-yaml", "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) ā€” CVE-2026-59870 fix not backported", "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj", "severity": "high", "cwe": [ "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=3.0.0 <3.15.1" }, { "source": 1193726, "name": "js-yaml", "dependency": "js-yaml", "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources", "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=3.0.0 <3.15.2" } ], "effects": [], "range": "<=3.15.1", "nodes": [ "node_modules/js-yaml" ], "fixAvailable": true }, "launch-editor": { "name": "launch-editor", "severity": "high", "isDirect": false, "via": [ { "source": 1120787, "name": "launch-editor", "dependency": "launch-editor", "title": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows", "url": "https://github.com/advisories/GHSA-v6wh-96g9-6wx3", "severity": "moderate", "cwe": [ "CWE-73", "CWE-522" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=2.14.0" }, { "source": 1242627, "name": "launch-editor", "dependency": "launch-editor", "title": "launch-editor: escapeCmdArgs() omits % escaping on Windows", "url": "https://github.com/advisories/GHSA-698v-4r3x-3vcv", "severity": "moderate", "cwe": [ "CWE-78" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=2.14.1" }, { "source": 1242656, "name": "launch-editor", "dependency": "launch-editor", "title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors", "url": "https://github.com/advisories/GHSA-r825-w8mm-5pxw", "severity": "moderate", "cwe": [ "CWE-88" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=2.14.1" }, { "source": 1242663, "name": "launch-editor", "dependency": "launch-editor", "title": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows", "url": "https://github.com/advisories/GHSA-587h-7wmj-h5pm", "severity": "high", "cwe": [ "CWE-77" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=2.14.1" } ], "effects": [], "range": "<=2.14.1", "nodes": [ "node_modules/launch-editor" ], "fixAvailable": true }, "minimatch": { "name": "minimatch", "severity": "moderate", "isDirect": false, "via": [ { "source": 1244623, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "severity": "moderate", "cwe": [ "CWE-405" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=7.0.0 <11.0.1" } ], "effects": [ "editorconfig", "glob" ], "range": "7.0.0 - 11.0.0", "nodes": [ "node_modules/editorconfig/node_modules/minimatch", "node_modules/js-beautify/node_modules/minimatch" ], "fixAvailable": true }, "nanoid": { "name": "nanoid", "severity": "high", "isDirect": false, "via": [ { "source": 1138811, "name": "nanoid", "dependency": "nanoid", "title": "nanoid: non-secure generators can loop indefinitely with negative size", "url": "https://github.com/advisories/GHSA-28wg-ghj8-5hjv", "severity": "high", "cwe": [ "CWE-835" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.3.16" }, { "source": 1139427, "name": "nanoid", "dependency": "nanoid", "title": "nanoid: custom generators can loop indefinitely when size is zero", "url": "https://github.com/advisories/GHSA-2v37-7h3g-55p8", "severity": "high", "cwe": [ "CWE-835" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.3.18" } ], "effects": [], "range": "<=3.3.17", "nodes": [ "node_modules/nanoid" ], "fixAvailable": true }, "node-forge": { "name": "node-forge", "severity": "high", "isDirect": false, "via": [ { "source": 1240912, "name": "node-forge", "dependency": "node-forge", "title": "node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements", "url": "https://github.com/advisories/GHSA-86w9-cpqp-85rv", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<=1.4.0" }, { "source": 1244014, "name": "node-forge", "dependency": "node-forge", "title": "Forge: ASN.1 OID first arc truncation in asn1.oidToDer", "url": "https://github.com/advisories/GHSA-4642-5mcj-2rqw", "severity": "low", "cwe": [ "CWE-190" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<=1.4.0" }, { "source": 1244015, "name": "node-forge", "dependency": "node-forge", "title": "Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie", "url": "https://github.com/advisories/GHSA-6wvx-3r32-xmcg", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, "range": "<=1.4.0" }, { "source": 1244016, "name": "node-forge", "dependency": "node-forge", "title": "Forge: TLS client crash when the server sends no certificate", "url": "https://github.com/advisories/GHSA-525v-9gp9-w22h", "severity": "moderate", "cwe": [ "CWE-476" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=1.4.0" }, { "source": 1244017, "name": "node-forge", "dependency": "node-forge", "title": "Forge: Regular expression denial of service in PEM decoding (pem.decode)", "url": "https://github.com/advisories/GHSA-7wch-p9px-956x", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=1.4.0" }, { "source": 1244018, "name": "node-forge", "dependency": "node-forge", "title": "Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)", "url": "https://github.com/advisories/GHSA-h6cr-wjv9-3cpp", "severity": "low", "cwe": [ "CWE-835" ], "cvss": { "score": 2.9, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<=1.4.0" }, { "source": 1244019, "name": "node-forge", "dependency": "node-forge", "title": "Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store", "url": "https://github.com/advisories/GHSA-4487-j8r4-4g2f", "severity": "low", "cwe": [ "CWE-295", "CWE-471" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<=1.4.0" }, { "source": 1244020, "name": "node-forge", "dependency": "node-forge", "title": "Forge: AES-GCM authentication bypass via unvalidated tagLength option", "url": "https://github.com/advisories/GHSA-5cwg-6vw7-rj6p", "severity": "moderate", "cwe": [ "CWE-354", "CWE-1284" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<=1.4.0" }, { "source": 1244021, "name": "node-forge", "dependency": "node-forge", "title": "Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count", "url": "https://github.com/advisories/GHSA-jc66-7q78-782g", "severity": "high", "cwe": [ "CWE-354", "CWE-1284" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<=1.4.0" }, { "source": 1244022, "name": "node-forge", "dependency": "node-forge", "title": "Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message", "url": "https://github.com/advisories/GHSA-8hrf-8g6f-7xwp", "severity": "high", "cwe": [ "CWE-248", "CWE-476" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=1.4.0" }, { "source": 1244023, "name": "node-forge", "dependency": "node-forge", "title": "Forge: Denial of service in TLS record processing via call stack exhaustion", "url": "https://github.com/advisories/GHSA-hqq3-7jhf-c5jx", "severity": "high", "cwe": [ "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=1.4.0" }, { "source": 1244024, "name": "node-forge", "dependency": "node-forge", "title": "Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13", "url": "https://github.com/advisories/GHSA-5x38-2vff-x55p", "severity": "high", "cwe": [ "CWE-295", "CWE-436" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": "<=1.4.0" } ], "effects": [], "range": "<=1.4.0", "nodes": [ "node_modules/node-forge" ], "fixAvailable": true }, "pnpm": { "name": "pnpm", "severity": "high", "isDirect": true, "via": [ { "source": 1121808, "name": "pnpm", "dependency": "pnpm", "title": "pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)", "url": "https://github.com/advisories/GHSA-rxhj-4m44-96r4", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H" }, "range": ">=11.0.0 <11.4.0" }, { "source": 1121810, "name": "pnpm", "dependency": "pnpm", "title": "pnpm binds unscoped user-level npm auth credentials to a repository-selected registry", "url": "https://github.com/advisories/GHSA-cjhr-43r9-cfmw", "severity": "moderate", "cwe": [ "CWE-200", "CWE-522" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=11.0.0 <11.4.0" }, { "source": 1121812, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement", "url": "https://github.com/advisories/GHSA-hwx4-2j3j-g496", "severity": "high", "cwe": [ "CWE-23" ], "cvss": { "score": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, "range": ">=11.0.0 <11.4.0" }, { "source": 1121814, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Git Fetch Argument Injection via Lockfile resolution.commit", "url": "https://github.com/advisories/GHSA-p4xf-rf54-rj3x", "severity": "moderate", "cwe": [ "CWE-88" ], "cvss": { "score": 6.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N" }, "range": ">=11.0.0 <11.4.0" }, { "source": 1121817, "name": "pnpm", "dependency": "pnpm", "title": "pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field", "url": "https://github.com/advisories/GHSA-q6j5-fjx5-2mc3", "severity": "moderate", "cwe": [ "CWE-354" ], "cvss": { "score": 6.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" }, "range": ">=11.0.0 <11.4.0" }, { "source": 1121818, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Unsafe default behavior breaks integrity check", "url": "https://github.com/advisories/GHSA-54hh-g5mx-jqcp", "severity": "moderate", "cwe": [ "CWE-345" ], "cvss": { "score": 6.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" }, "range": ">=11.0.0 <11.4.0" }, { "source": 1121823, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle", "url": "https://github.com/advisories/GHSA-5wx6-mg75-v57r", "severity": "high", "cwe": [ "CWE-346", "CWE-693", "CWE-829" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, "range": ">=11.0.0 <11.5.3" }, { "source": 1121825, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Repository config can expand victim environment secrets into registry requests before scripts run", "url": "https://github.com/advisories/GHSA-3qhv-2rgh-x77r", "severity": "moderate", "cwe": [ "CWE-200", "CWE-201", "CWE-522" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, "range": ">=11.0.0 <11.5.3" }, { "source": 1121828, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Reserved bin name deletes PNPM_HOME during global remove", "url": "https://github.com/advisories/GHSA-4gxm-v5v7-fqc4", "severity": "moderate", "cwe": [ "CWE-22", "CWE-73" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, "range": ">=11.0.0 <11.5.3" }, { "source": 1121830, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes", "url": "https://github.com/advisories/GHSA-w466-c33r-3gjp", "severity": "high", "cwe": [ "CWE-345", "CWE-494", "CWE-829" ], "cvss": { "score": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, "range": ">=11.0.0 <11.5.3" }, { "source": 1121832, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: `patch-remove` could delete project-selected files outside the patches directory", "url": "https://github.com/advisories/GHSA-72r4-9c5j-mj57", "severity": "high", "cwe": [ "CWE-22", "CWE-73" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" }, "range": ">=11.0.0 <11.7.0" }, { "source": 1121834, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Hoisted install imports lockfile alias outside node_modules", "url": "https://github.com/advisories/GHSA-fr4h-3cph-29xv", "severity": "high", "cwe": [ "CWE-22", "CWE-73" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" }, "range": ">=11.0.0 <11.7.0" }, { "source": 1121836, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config", "url": "https://github.com/advisories/GHSA-qrv3-253h-g69c", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L" }, "range": ">=11.0.0 <11.8.0" }, { "source": 1139461, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Repository-controlled configDependencies can select a pacquet native install engine", "url": "https://github.com/advisories/GHSA-gj8w-mvpf-x27x", "severity": "high", "cwe": [ "CWE-78", "CWE-494", "CWE-829" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, "range": ">=11.0.0 <11.5.3" }, { "source": 1153191, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml", "url": "https://github.com/advisories/GHSA-vx52-2968-3vc6", "severity": "high", "cwe": [ "CWE-201", "CWE-319", "CWE-522" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N" }, "range": ">=11.0.0 <11.11.0" }, { "source": 1158509, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph", "url": "https://github.com/advisories/GHSA-c59q-g84q-2gj5", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L" }, "range": ">=11.0.0 <11.11.0" }, { "source": 1158511, "name": "pnpm", "dependency": "pnpm", "title": "pnpm: A tarball dependency's manifest `name` escapes node_modules ā†’ arbitrary file write/overwrite on install", "url": "https://github.com/advisories/GHSA-vq4v-j7r6-jq4m", "severity": "high", "cwe": [ "CWE-22", "CWE-73", "CWE-94" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, "range": ">=11.0.0 <11.11.0" } ], "effects": [], "range": "11.0.0 - 11.10.0", "nodes": [ "node_modules/pnpm" ], "fixAvailable": true }, "postcss": { "name": "postcss", "severity": "high", "isDirect": false, "via": [ { "source": 1109574, "name": "postcss", "dependency": "postcss", "title": "PostCSS line return parsing error", "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j", "severity": "moderate", "cwe": [ "CWE-74", "CWE-144" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<8.4.31" }, { "source": 1117015, "name": "postcss", "dependency": "postcss", "title": "PostCSS has XSS via Unescaped in its CSS Stringify Output", "url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<8.5.10" }, { "source": 1124252, "name": "postcss", "dependency": "postcss", "title": "PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments", "url": "https://github.com/advisories/GHSA-6g55-p6wh-862q", "severity": "high", "cwe": [ "CWE-22", "CWE-200" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "range": "<=8.5.11" }, { "source": 1130709, "name": "postcss", "dependency": "postcss", "title": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q ā€” attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset", "url": "https://github.com/advisories/GHSA-fxqj-rqcc-2cmp", "severity": "moderate", "cwe": [ "CWE-22", "CWE-200" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=8.5.22" }, { "source": 1139510, "name": "postcss", "dependency": "postcss", "title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure", "url": "https://github.com/advisories/GHSA-r28c-9q8g-f849", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "range": "<=8.5.17" } ], "effects": [ "@vue/component-compiler-utils" ], "range": "<=8.5.22", "nodes": [ "node_modules/@vue/component-compiler-utils/node_modules/postcss", "node_modules/postcss" ], "fixAvailable": false }, "postcss-selector-parser": { "name": "postcss-selector-parser", "severity": "moderate", "isDirect": false, "via": [ { "source": 1153169, "name": "postcss-selector-parser", "dependency": "postcss-selector-parser", "title": "postcss-selector-parser allows denial of service through uncontrolled AST recursion", "url": "https://github.com/advisories/GHSA-w9m9-85wc-3x92", "severity": "low", "cwe": [ "CWE-404" ], "cvss": { "score": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, "range": ">=7.1.0 <7.1.3" }, { "source": 1153170, "name": "postcss-selector-parser", "dependency": "postcss-selector-parser", "title": "postcss-selector-parser allows denial of service through uncontrolled AST recursion", "url": "https://github.com/advisories/GHSA-w9m9-85wc-3x92", "severity": "low", "cwe": [ "CWE-404" ], "cvss": { "score": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, "range": ">=6.1.0 <6.1.3" }, { "source": 1243379, "name": "postcss-selector-parser", "dependency": "postcss-selector-parser", "title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion", "url": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf", "severity": "moderate", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<6.1.5" }, { "source": 1243380, "name": "postcss-selector-parser", "dependency": "postcss-selector-parser", "title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion", "url": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf", "severity": "moderate", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=7.0.0 <7.1.6" } ], "effects": [], "range": "<=6.1.4 || 7.0.0 - 7.1.5", "nodes": [ "node_modules/postcss-modules-local-by-default/node_modules/postcss-selector-parser", "node_modules/postcss-modules-scope/node_modules/postcss-selector-parser", "node_modules/postcss-selector-parser" ], "fixAvailable": true }, "proxy-addr": { "name": "proxy-addr", "severity": "critical", "isDirect": false, "via": [ { "source": 1241210, "name": "proxy-addr", "dependency": "proxy-addr", "title": "proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet", "url": "https://github.com/advisories/GHSA-jqcg-44mw-7w3h", "severity": "critical", "cwe": [ "CWE-290", "CWE-348", "CWE-697" ], "cvss": { "score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": ">=1.1.0 <2.0.8" } ], "effects": [], "range": "1.1.0 - 2.0.7", "nodes": [ "node_modules/proxy-addr" ], "fixAvailable": true }, "qs": { "name": "qs", "severity": "moderate", "isDirect": false, "via": [ { "source": 1119502, "name": "qs", "dependency": "qs", "title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set", "url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26", "severity": "moderate", "cwe": [ "CWE-476" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.11.1 <=6.15.1" }, { "source": 1158506, "name": "qs", "dependency": "qs", "title": "qs array-limit bypass via bracket-key comma parsing", "url": "https://github.com/advisories/GHSA-x5fp-wj9c-mxmx", "severity": "moderate", "cwe": [ "CWE-770" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.14.2 <=6.15.3" }, { "source": 1158507, "name": "qs", "dependency": "qs", "title": "qs: Denial of Service via Attacker Controlled isBuffer", "url": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g", "severity": "moderate", "cwe": [ "CWE-248", "CWE-703" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.2.5 <6.16.0" }, { "source": 1243687, "name": "qs", "dependency": "qs", "title": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)", "url": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw", "severity": "moderate", "cwe": [ "CWE-248", "CWE-704" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.7.0 <=6.16.0" } ], "effects": [], "range": "2.2.5 - 6.16.0", "nodes": [ "node_modules/body-parser/node_modules/qs", "node_modules/qs" ], "fixAvailable": true }, "serialize-javascript": { "name": "serialize-javascript", "severity": "high", "isDirect": false, "via": [ { "source": 1113686, "name": "serialize-javascript", "dependency": "serialize-javascript", "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()", "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq", "severity": "high", "cwe": [ "CWE-96" ], "cvss": { "score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<=7.0.2" }, { "source": 1119440, "name": "serialize-javascript", "dependency": "serialize-javascript", "title": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects", "url": "https://github.com/advisories/GHSA-qj8w-gfj5-8c6v", "severity": "moderate", "cwe": [ "CWE-400", "CWE-834" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=5.0.0 <7.0.5" }, { "source": 1243082, "name": "serialize-javascript", "dependency": "serialize-javascript", "title": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped =1.1.0 <=1.8.3" }, { "source": 1123944, "name": "shell-quote", "dependency": "shell-quote", "title": "shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)", "url": "https://github.com/advisories/GHSA-395f-4hp3-45gv", "severity": "high", "cwe": [ "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=1.8.4" } ], "effects": [], "range": "<=1.8.4", "nodes": [ "node_modules/shell-quote" ], "fixAvailable": true }, "sockjs": { "name": "sockjs", "severity": "moderate", "isDirect": false, "via": [ "uuid" ], "effects": [ "webpack-dev-server" ], "range": ">=0.3.17", "nodes": [ "node_modules/sockjs" ], "fixAvailable": true }, "source-map-js": { "name": "source-map-js", "severity": "high", "isDirect": false, "via": [ { "source": 1241209, "name": "source-map-js", "dependency": "source-map-js", "title": "source-map-js allows event-loop denial of service through indexed source-map section offsets", "url": "https://github.com/advisories/GHSA-68fv-2mgg-jv7q", "severity": "high", "cwe": [ "CWE-1284" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.0.0 <1.2.2" } ], "effects": [], "range": "1.0.0 - 1.2.1", "nodes": [ "node_modules/source-map-js" ], "fixAvailable": true }, "source-map-resolve": { "name": "source-map-resolve", "severity": "high", "isDirect": false, "via": [ "decode-uri-component" ], "effects": [ "css" ], "range": ">=0.5.1", "nodes": [ "node_modules/source-map-resolve" ], "fixAvailable": true }, "svgo": { "name": "svgo", "severity": "high", "isDirect": false, "via": [ { "source": 1139520, "name": "svgo", "dependency": "svgo", "title": "SVGO removeScripts plugin leaves some executable scripts intact", "url": "https://github.com/advisories/GHSA-2p49-hgcm-8545", "severity": "high", "cwe": [ "CWE-79", "CWE-184" ], "cvss": { "score": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, "range": ">=1.0.0 <2.8.3" }, { "source": 1193740, "name": "svgo", "dependency": "svgo", "title": "SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements", "url": "https://github.com/advisories/GHSA-4vpr-x523-8j87", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": ">=1.0.0 <2.8.4" }, { "source": 1243426, "name": "svgo", "dependency": "svgo", "title": "SVGO: removeScripts allows executable links through namespace and control-character bypasses", "url": "https://github.com/advisories/GHSA-w27v-7q3p-w38r", "severity": "high", "cwe": [ "CWE-79", "CWE-184" ], "cvss": { "score": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, "range": ">=1.0.0 <2.8.4" } ], "effects": [], "range": "1.0.0 - 2.8.3", "nodes": [ "node_modules/svgo" ], "fixAvailable": true }, "uuid": { "name": "uuid", "severity": "moderate", "isDirect": false, "via": [ { "source": 1119441, "name": "uuid", "dependency": "uuid", "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided", "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq", "severity": "moderate", "cwe": [ "CWE-787", "CWE-1285" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<11.1.1" } ], "effects": [ "sockjs" ], "range": "<11.1.1", "nodes": [ "node_modules/uuid" ], "fixAvailable": true }, "vue": { "name": "vue", "severity": "low", "isDirect": true, "via": [ { "source": 1100238, "name": "vue", "dependency": "vue", "title": "ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function", "url": "https://github.com/advisories/GHSA-5j4c-8p2g-v4jx", "severity": "low", "cwe": [ "CWE-1333" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.0.0-alpha.1 <3.0.0-alpha.0" } ], "effects": [ "@vue/test-utils", "@wangeditor/editor-for-vue", "element-ui", "vue-jest", "vuex" ], "range": "2.0.0-alpha.1 - 2.7.16", "nodes": [ "node_modules/vue" ], "fixAvailable": { "name": "vue", "version": "3.5.44", "isSemVerMajor": true } }, "vue-jest": { "name": "vue-jest", "severity": "critical", "isDirect": true, "via": [ "babel-plugin-transform-es2015-modules-commonjs", "vue", "vue-template-compiler" ], "effects": [], "range": "1.0.0 - 5.0.0-alpha.1", "nodes": [ "node_modules/vue-jest" ], "fixAvailable": { "name": "vue-jest", "version": "0.6.1", "isSemVerMajor": true } }, "vue-loader": { "name": "vue-loader", "severity": "moderate", "isDirect": false, "via": [ "@vue/component-compiler-utils" ], "effects": [ "@vue/cli-service" ], "range": "15.0.0-beta.1 - 15.11.1", "nodes": [ "node_modules/@vue/vue-loader-v15" ], "fixAvailable": false }, "vue-template-compiler": { "name": "vue-template-compiler", "severity": "moderate", "isDirect": true, "via": [ { "source": 1111772, "name": "vue-template-compiler", "dependency": "vue-template-compiler", "title": "vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)", "url": "https://github.com/advisories/GHSA-g3ch-rx76-35fx", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 4.2, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N" }, "range": ">=2.0.0 <3.0.0" } ], "effects": [ "@vue/cli-service", "@vue/test-utils", "vue-jest" ], "range": ">=2.0.0", "nodes": [ "node_modules/vue-template-compiler" ], "fixAvailable": false }, "vuex": { "name": "vuex", "severity": "low", "isDirect": true, "via": [ "vue" ], "effects": [], "range": "3.1.3 - 3.6.2", "nodes": [ "node_modules/vuex" ], "fixAvailable": { "name": "vuex", "version": "4.1.0", "isSemVerMajor": true } }, "webpack-dev-middleware": { "name": "webpack-dev-middleware", "severity": "high", "isDirect": false, "via": [ { "source": 1240027, "name": "webpack-dev-middleware", "dependency": "webpack-dev-middleware", "title": "webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath", "url": "https://github.com/advisories/GHSA-g84c-rxfj-3j2c", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N" }, "range": "<7.4.5" } ], "effects": [ "webpack-dev-server" ], "range": "<7.4.5", "nodes": [ "node_modules/webpack-dev-middleware" ], "fixAvailable": true }, "webpack-dev-server": { "name": "webpack-dev-server", "severity": "high", "isDirect": false, "via": [ { "source": 1108429, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser", "url": "https://github.com/advisories/GHSA-9jgg-88mc-972h", "severity": "moderate", "cwe": [ "CWE-346" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, "range": "<=5.2.0" }, { "source": 1108430, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server users' source code may be stolen when they access a malicious web site", "url": "https://github.com/advisories/GHSA-4v9v-hfq4-rm2v", "severity": "moderate", "cwe": [ "CWE-749" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" }, "range": "<=5.2.0" }, { "source": 1119074, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins", "url": "https://github.com/advisories/GHSA-79cf-xcqc-c78w", "severity": "moderate", "cwe": [ "CWE-749" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" }, "range": "<=5.2.3" }, { "source": 1121087, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies", "url": "https://github.com/advisories/GHSA-mx8g-39q3-5c79", "severity": "moderate", "cwe": [ "CWE-346", "CWE-441" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<5.2.5" }, { "source": 1123965, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints", "url": "https://github.com/advisories/GHSA-f5vj-f2hx-8m93", "severity": "moderate", "cwe": [ "CWE-352", "CWE-749" ], "cvss": { "score": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L" }, "range": "<=5.2.5" }, { "source": 1123966, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header", "url": "https://github.com/advisories/GHSA-m28w-2pqf-7qgj", "severity": "moderate", "cwe": [ "CWE-20", "CWE-248" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<=5.2.5" }, "sockjs", "webpack-dev-middleware" ], "effects": [], "range": "<=5.2.7", "nodes": [ "node_modules/webpack-dev-server" ], "fixAvailable": true }, "websocket-driver": { "name": "websocket-driver", "severity": "critical", "isDirect": false, "via": [ { "source": 1123482, "name": "websocket-driver", "dependency": "websocket-driver", "title": "websocket-driver: Resource limit bypass via message compression", "url": "https://github.com/advisories/GHSA-mp7j-qc5w-4988", "severity": "moderate", "cwe": [ "CWE-770" ], "cvss": { "score": 0, "vectorString": null }, "range": "<0.7.5" }, { "source": 1123483, "name": "websocket-driver", "dependency": "websocket-driver", "title": "websocket-driver: Message corruption via abuse of protocol length headers", "url": "https://github.com/advisories/GHSA-xv26-6w52-cph6", "severity": "critical", "cwe": [ "CWE-130" ], "cvss": { "score": 0, "vectorString": null }, "range": "<0.7.5" } ], "effects": [], "range": "<=0.7.4", "nodes": [ "node_modules/websocket-driver" ], "fixAvailable": true }, "ws": { "name": "ws", "severity": "high", "isDirect": false, "via": [ { "source": 1119108, "name": "ws", "dependency": "ws", "title": "ws: Uninitialized memory disclosure", "url": "https://github.com/advisories/GHSA-58qx-3vcg-4xpx", "severity": "moderate", "cwe": [ "CWE-908" ], "cvss": { "score": 4.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" }, "range": ">=8.0.0 <8.20.1" }, { "source": 1123259, "name": "ws", "dependency": "ws", "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks", "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p", "severity": "high", "cwe": [ "CWE-400", "CWE-770", "CWE-1050" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=8.0.0 <8.21.0" }, { "source": 1123260, "name": "ws", "dependency": "ws", "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks", "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p", "severity": "high", "cwe": [ "CWE-400", "CWE-770", "CWE-1050" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=7.0.0 <7.5.11" } ], "effects": [], "range": "7.0.0 - 7.5.10 || 8.0.0 - 8.20.1", "nodes": [ "node_modules/jsdom/node_modules/ws", "node_modules/webpack-dev-server/node_modules/ws", "node_modules/ws" ], "fixAvailable": true } }, "metadata": { "vulnerabilities": { "info": 0, "low": 11, "moderate": 19, "high": 26, "critical": 7, "total": 63 }, "dependencies": { "prod": 108, "dev": 1115, "optional": 4, "peer": 0, "peerOptional": 0, "total": 1223 } } }