{ "auditReportVersion": 2, "vulnerabilities": { "@dcloudio/uni-template-compiler": { "name": "@dcloudio/uni-template-compiler", "severity": "moderate", "isDirect": true, "via": [ "vue-template-compiler" ], "effects": [], "range": "*", "nodes": [ "node_modules/@dcloudio/uni-template-compiler" ], "fixAvailable": false }, "@dcloudio/vue-cli-plugin-uni": { "name": "@dcloudio/vue-cli-plugin-uni", "severity": "moderate", "isDirect": true, "via": [ "postcss-import", "postcss-selector-parser" ], "effects": [], "range": "*", "nodes": [ "node_modules/@dcloudio/vue-cli-plugin-uni" ], "fixAvailable": false }, "@intervolga/optimize-cssnano-plugin": { "name": "@intervolga/optimize-cssnano-plugin", "severity": "moderate", "isDirect": false, "via": [ "cssnano", "cssnano-preset-default", "postcss" ], "effects": [], "range": "*", "nodes": [ "node_modules/@intervolga/optimize-cssnano-plugin" ], "fixAvailable": true }, "@jest/core": { "name": "@jest/core", "severity": "moderate", "isDirect": false, "via": [ "@jest/reporters", "@jest/transform", "jest-config", "jest-haste-map", "jest-resolve-dependencies", "jest-runner", "jest-runtime", "jest-snapshot" ], "effects": [ "jest" ], "range": "*", "nodes": [ "node_modules/@jest/core" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "@jest/reporters": { "name": "@jest/reporters", "severity": "moderate", "isDirect": false, "via": [ "@jest/transform", "jest-haste-map", "node-notifier" ], "effects": [ "@jest/core" ], "range": "*", "nodes": [ "node_modules/@jest/reporters" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "@jest/test-sequencer": { "name": "@jest/test-sequencer", "severity": "moderate", "isDirect": false, "via": [ "jest-haste-map", "jest-runner", "jest-runtime" ], "effects": [ "jest-config" ], "range": "<=26.6.3", "nodes": [ "node_modules/@jest/test-sequencer" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "@jest/transform": { "name": "@jest/transform", "severity": "moderate", "isDirect": false, "via": [ "jest-haste-map" ], "effects": [ "babel-jest", "jest-runtime" ], "range": "<=26.6.2", "nodes": [ "node_modules/@jest/transform" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "@tootallnate/once": { "name": "@tootallnate/once", "severity": "low", "isDirect": false, "via": [ { "source": 1119438, "name": "@tootallnate/once", "dependency": "@tootallnate/once", "title": "@tootallnate/once vulnerable to Incorrect Control Flow Scoping", "url": "https://github.com/advisories/GHSA-vpq2-c234-7xj6", "severity": "low", "cwe": [ "CWE-705" ], "cvss": { "score": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, "range": "<2.0.1" } ], "effects": [ "http-proxy-agent" ], "range": "<2.0.1", "nodes": [ "node_modules/@tootallnate/once" ], "fixAvailable": true }, "@types/webpack-dev-server": { "name": "@types/webpack-dev-server", "severity": "high", "isDirect": false, "via": [ "http-proxy-middleware" ], "effects": [], "range": "3.11.2 - 4.0.3", "nodes": [ "node_modules/@types/webpack-dev-server" ], "fixAvailable": true }, "@vue/babel-plugin-jsx": { "name": "@vue/babel-plugin-jsx", "severity": "moderate", "isDirect": false, "via": [ "@vue/babel-plugin-resolve-type" ], "effects": [], "range": "1.2.0-alpha.0 - 1.2.0 || 1.5.0", "nodes": [ "node_modules/@vue/babel-plugin-jsx" ], "fixAvailable": true }, "@vue/babel-plugin-resolve-type": { "name": "@vue/babel-plugin-resolve-type", "severity": "moderate", "isDirect": false, "via": [ "@vue/compiler-sfc" ], "effects": [ "@vue/babel-plugin-jsx" ], "range": "<=1.2.0-beta.0", "nodes": [ "node_modules/@vue/babel-plugin-resolve-type" ], "fixAvailable": true }, "@vue/cli-plugin-babel": { "name": "@vue/cli-plugin-babel", "severity": "moderate", "isDirect": true, "via": [ "@vue/cli-shared-utils", "webpack" ], "effects": [], "range": "3.4.0 - 4.5.19", "nodes": [ "node_modules/@vue/cli-plugin-babel" ], "fixAvailable": { "name": "@vue/cli-plugin-babel", "version": "5.0.9", "isSemVerMajor": true } }, "@vue/cli-plugin-router": { "name": "@vue/cli-plugin-router", "severity": "moderate", "isDirect": false, "via": [ "@vue/cli-shared-utils" ], "effects": [ "@vue/cli-service" ], "range": "<=4.5.19", "nodes": [ "node_modules/@vue/cli-plugin-router" ], "fixAvailable": false }, "@vue/cli-service": { "name": "@vue/cli-service", "severity": "critical", "isDirect": true, "via": [ "@intervolga/optimize-cssnano-plugin", "@vue/cli-plugin-router", "@vue/cli-shared-utils", "@vue/component-compiler-utils", "autoprefixer", "copy-webpack-plugin", "css-loader", "cssnano", "globby", "html-webpack-plugin", "postcss-loader", "terser-webpack-plugin", "vue-loader", "webpack", "webpack-dev-server" ], "effects": [], "range": "*", "nodes": [ "node_modules/@vue/cli-service" ], "fixAvailable": false }, "@vue/cli-shared-utils": { "name": "@vue/cli-shared-utils", "severity": "moderate", "isDirect": false, "via": [ "request" ], "effects": [ "@vue/cli-plugin-babel", "@vue/cli-plugin-router" ], "range": "<=4.5.19", "nodes": [ "node_modules/@vue/cli-shared-utils" ], "fixAvailable": false }, "@vue/compiler-sfc": { "name": "@vue/compiler-sfc", "severity": "moderate", "isDirect": true, "via": [ "postcss" ], "effects": [ "@vue/babel-plugin-resolve-type", "vue" ], "range": "3.0.0-alpha.0 - 3.0.5", "nodes": [ "node_modules/@vue/compiler-sfc" ], "fixAvailable": { "name": "vue", "version": "3.5.44", "isSemVerMajor": true } }, "@vue/component-compiler-utils": { "name": "@vue/component-compiler-utils", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-selector-parser" ], "effects": [ "@vue/cli-service", "vue-loader" ], "range": "*", "nodes": [ "node_modules/@vue/component-compiler-utils" ], "fixAvailable": false }, "anymatch": { "name": "anymatch", "severity": "moderate", "isDirect": false, "via": [ "micromatch" ], "effects": [ "chokidar", "sane" ], "range": "1.2.0 - 2.0.0", "nodes": [ "node_modules/sane/node_modules/anymatch", "node_modules/watchpack-chokidar2/node_modules/anymatch", "node_modules/webpack-dev-server/node_modules/anymatch" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "autoprefixer": { "name": "autoprefixer", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "1.0.20131222 - 9.8.8", "nodes": [ "node_modules/autoprefixer" ], "fixAvailable": true }, "babel-jest": { "name": "babel-jest", "severity": "moderate", "isDirect": true, "via": [ "@jest/transform" ], "effects": [ "jest-config" ], "range": "24.2.0-alpha.0 - 26.6.3", "nodes": [ "node_modules/babel-jest" ], "fixAvailable": { "name": "babel-jest", "version": "30.5.2", "isSemVerMajor": true } }, "body-parser": { "name": "body-parser", "severity": "high", "isDirect": false, "via": [ { "source": 1243073, "name": "body-parser", "dependency": "body-parser", "title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body", "url": "https://github.com/advisories/GHSA-27r3-jxmh-p828", "severity": "high", "cwe": [ "CWE-248" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.20.9" } ], "effects": [], "range": "<1.20.9", "nodes": [ "node_modules/body-parser" ], "fixAvailable": true }, "brace-expansion": { "name": "brace-expansion", "severity": "high", "isDirect": false, "via": [ { "source": 1240100, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service", "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr", "severity": "moderate", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<1.1.21" }, { "source": 1240101, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service", "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr", "severity": "moderate", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.0.0 <2.1.7" }, { "source": 1240104, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion", "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7", "severity": "high", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.1.20" }, { "source": 1240105, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion", "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7", "severity": "high", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=2.0.0 <2.1.6" }, { "source": 1240108, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion", "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p", "severity": "high", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.1.19" }, { "source": 1240109, "name": "brace-expansion", "dependency": "brace-expansion", "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion", "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p", "severity": "high", "cwe": [ "CWE-400", "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=2.0.0 <2.1.5" } ], "effects": [], "range": "<=1.1.20 || 2.0.0 - 2.1.6", "nodes": [ "node_modules/brace-expansion", "node_modules/filelist/node_modules/brace-expansion" ], "fixAvailable": true }, "braces": { "name": "braces", "severity": "high", "isDirect": false, "via": [ { "source": 1098094, "name": "braces", "dependency": "braces", "title": "Uncontrolled resource consumption in braces", "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg", "severity": "high", "cwe": [ "CWE-400", "CWE-1050" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<3.0.3" } ], "effects": [ "chokidar", "micromatch" ], "range": "<3.0.3", "nodes": [ "node_modules/globby/node_modules/braces", "node_modules/sane/node_modules/braces", "node_modules/watchpack-chokidar2/node_modules/braces", "node_modules/webpack-dev-server/node_modules/braces", "node_modules/webpack/node_modules/braces" ], "fixAvailable": false }, "browserify-sign": { "name": "browserify-sign", "severity": "low", "isDirect": false, "via": [ "elliptic" ], "effects": [ "crypto-browserify" ], "range": ">=2.4.0", "nodes": [ "node_modules/browserify-sign" ], "fixAvailable": false }, "chokidar": { "name": "chokidar", "severity": "high", "isDirect": false, "via": [ "anymatch", "braces", "readdirp" ], "effects": [ "watchpack-chokidar2", "webpack-dev-server" ], "range": "1.3.0 - 2.1.8", "nodes": [ "node_modules/watchpack-chokidar2/node_modules/chokidar", "node_modules/webpack-dev-server/node_modules/chokidar" ], "fixAvailable": false }, "compression": { "name": "compression", "severity": "high", "isDirect": false, "via": [ { "source": 1241221, "name": "compression", "dependency": "compression", "title": "compression vulnerable to Denial of Service via memory leak on premature response close", "url": "https://github.com/advisories/GHSA-vc2v-76pw-4v95", "severity": "high", "cwe": [ "CWE-401", "CWE-459" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.8.2" } ], "effects": [], "range": "<1.8.2", "nodes": [ "node_modules/compression" ], "fixAvailable": true }, "copy-webpack-plugin": { "name": "copy-webpack-plugin", "severity": "high", "isDirect": true, "via": [ "serialize-javascript", "webpack-log" ], "effects": [], "range": "4.3.0 - 13.0.1", "nodes": [ "node_modules/copy-webpack-plugin" ], "fixAvailable": { "name": "copy-webpack-plugin", "version": "14.0.0", "isSemVerMajor": true } }, "create-ecdh": { "name": "create-ecdh", "severity": "low", "isDirect": false, "via": [ "elliptic" ], "effects": [ "crypto-browserify" ], "range": "*", "nodes": [ "node_modules/create-ecdh" ], "fixAvailable": false }, "crypto-browserify": { "name": "crypto-browserify", "severity": "low", "isDirect": false, "via": [ "browserify-sign", "create-ecdh" ], "effects": [ "node-libs-browser" ], "range": ">=3.4.0", "nodes": [ "node_modules/crypto-browserify" ], "fixAvailable": false }, "css-declaration-sorter": { "name": "css-declaration-sorter", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=5.1.2", "nodes": [ "node_modules/css-declaration-sorter" ], "fixAvailable": true }, "css-loader": { "name": "css-loader", "severity": "moderate", "isDirect": false, "via": [ "icss-utils", "postcss", "postcss-modules-extract-imports", "postcss-modules-local-by-default", "postcss-modules-scope", "postcss-modules-values" ], "effects": [ "@vue/cli-service" ], "range": "0.15.0 - 4.3.0", "nodes": [ "node_modules/css-loader" ], "fixAvailable": false }, "css-select": { "name": "css-select", "severity": "high", "isDirect": false, "via": [ "nth-check" ], "effects": [ "svgo" ], "range": "<=3.1.0", "nodes": [ "node_modules/svgo/node_modules/css-select" ], "fixAvailable": true }, "cssnano": { "name": "cssnano", "severity": "moderate", "isDirect": false, "via": [ "cssnano-preset-default", "postcss" ], "effects": [ "@intervolga/optimize-cssnano-plugin", "@vue/cli-service" ], "range": "<=4.1.11", "nodes": [ "node_modules/cssnano" ], "fixAvailable": false }, "cssnano-preset-default": { "name": "cssnano-preset-default", "severity": "moderate", "isDirect": false, "via": [ "css-declaration-sorter", "cssnano-util-raw-cache", "postcss", "postcss-calc", "postcss-colormin", "postcss-convert-values", "postcss-discard-comments", "postcss-discard-duplicates", "postcss-discard-empty", "postcss-discard-overridden", "postcss-merge-longhand", "postcss-merge-rules", "postcss-minify-font-values", "postcss-minify-gradients", "postcss-minify-params", "postcss-minify-selectors", "postcss-normalize-charset", "postcss-normalize-display-values", "postcss-normalize-positions", "postcss-normalize-repeat-style", "postcss-normalize-string", "postcss-normalize-timing-functions", "postcss-normalize-unicode", "postcss-normalize-url", "postcss-normalize-whitespace", "postcss-ordered-values", "postcss-reduce-initial", "postcss-reduce-transforms", "postcss-svgo", "postcss-unique-selectors" ], "effects": [ "cssnano" ], "range": "<=4.0.8", "nodes": [ "node_modules/cssnano-preset-default" ], "fixAvailable": false }, "cssnano-util-raw-cache": { "name": "cssnano-util-raw-cache", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "*", "nodes": [ "node_modules/cssnano-util-raw-cache" ], "fixAvailable": true }, "decode-uri-component": { "name": "decode-uri-component", "severity": "high", "isDirect": false, "via": [ { "source": 1147955, "name": "decode-uri-component", "dependency": "decode-uri-component", "title": "decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input", "url": "https://github.com/advisories/GHSA-vcc3-ghjq-m6fr", "severity": "moderate", "cwe": [ "CWE-400", "CWE-405", "CWE-407", "CWE-1176" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=0.4.2" }, { "source": 1243857, "name": "decode-uri-component", "dependency": "decode-uri-component", "title": "decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs", "url": "https://github.com/advisories/GHSA-qr28-fpjm-wq7f", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=0.5.0" } ], "effects": [ "source-map-resolve" ], "range": "<=0.5.0", "nodes": [ "node_modules/decode-uri-component" ], "fixAvailable": true }, "deepmerge": { "name": "deepmerge", "severity": "low", "isDirect": false, "via": [ { "source": 1243505, "name": "deepmerge", "dependency": "deepmerge", "title": "deepmerge mergeObject() allows prototype poisoning of returned objects", "url": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4", "severity": "low", "cwe": [ "CWE-1321" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": ">=4.2.0 <=4.3.1" } ], "effects": [ "jest-config" ], "range": ">=4.2.0", "nodes": [ "node_modules/deepmerge" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "editorconfig": { "name": "editorconfig", "severity": "moderate", "isDirect": false, "via": [ "minimatch" ], "effects": [ "js-beautify" ], "range": ">=1.0.3", "nodes": [ "node_modules/editorconfig" ], "fixAvailable": true }, "elliptic": { "name": "elliptic", "severity": "low", "isDirect": false, "via": [ { "source": 1112030, "name": "elliptic", "dependency": "elliptic", "title": "Elliptic Uses a Cryptographic Primitive with a Risky Implementation", "url": "https://github.com/advisories/GHSA-848j-6mx2-7j84", "severity": "low", "cwe": [ "CWE-1240" ], "cvss": { "score": 5.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, "range": "<=6.6.1" } ], "effects": [ "browserify-sign", "create-ecdh" ], "range": "*", "nodes": [ "node_modules/elliptic" ], "fixAvailable": false }, "fast-glob": { "name": "fast-glob", "severity": "moderate", "isDirect": false, "via": [ "micromatch" ], "effects": [ "globby" ], "range": "<=2.2.7", "nodes": [ "node_modules/globby/node_modules/fast-glob" ], "fixAvailable": true }, "follow-redirects": { "name": "follow-redirects", "severity": "high", "isDirect": false, "via": [ { "source": 1242604, "name": "follow-redirects", "dependency": "follow-redirects", "title": "follow-redirects array-form headers bypass cross-origin credential stripping", "url": "https://github.com/advisories/GHSA-q3jh-wrc6-jgq8", "severity": "high", "cwe": [ "CWE-200", "CWE-212" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.16.0 <1.16.1" }, { "source": 1242605, "name": "follow-redirects", "dependency": "follow-redirects", "title": "follow-redirects sensitiveHeaders regex escaping can expose credential headers", "url": "https://github.com/advisories/GHSA-8r9p-f939-6h3c", "severity": "high", "cwe": [ "CWE-185", "CWE-200" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=1.16.0 <1.16.1" }, { "source": 1244003, "name": "follow-redirects", "dependency": "follow-redirects", "title": "follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects", "url": "https://github.com/advisories/GHSA-mrwp-f3q8-3g9p", "severity": "high", "cwe": [ "CWE-201" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "range": ">=1.16.0 <=1.16.1" } ], "effects": [], "range": "1.16.0 - 1.16.1", "nodes": [ "node_modules/follow-redirects" ], "fixAvailable": true }, "form-data": { "name": "form-data", "severity": "critical", "isDirect": false, "via": [ { "source": 1109540, "name": "form-data", "dependency": "form-data", "title": "form-data uses unsafe random function in form-data for choosing boundary", "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4", "severity": "critical", "cwe": [ "CWE-330" ], "cvss": { "score": 0, "vectorString": null }, "range": "<2.5.4" }, { "source": 1120745, "name": "form-data", "dependency": "form-data", "title": "form-data: CRLF injection in form-data via unescaped multipart field names and filenames", "url": "https://github.com/advisories/GHSA-hmw2-7cc7-3qxx", "severity": "high", "cwe": [ "CWE-93" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<2.5.6" } ], "effects": [ "request" ], "range": "<=2.5.5", "nodes": [ "node_modules/request/node_modules/form-data" ], "fixAvailable": false }, "glob": { "name": "glob", "severity": "moderate", "isDirect": false, "via": [ { "source": 1244013, "name": "glob", "dependency": "glob", "title": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal", "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=9.0.0 <=14.0.1" }, "minimatch" ], "effects": [ "js-beautify" ], "range": "9.0.0 - 14.0.1", "nodes": [ "node_modules/js-beautify/node_modules/glob" ], "fixAvailable": true }, "globby": { "name": "globby", "severity": "moderate", "isDirect": false, "via": [ "fast-glob" ], "effects": [], "range": "8.0.0 - 9.2.0", "nodes": [ "node_modules/globby" ], "fixAvailable": true }, "html-minifier": { "name": "html-minifier", "severity": "high", "isDirect": false, "via": [ { "source": 1105440, "name": "html-minifier", "dependency": "html-minifier", "title": "kangax html-minifier REDoS vulnerability", "url": "https://github.com/advisories/GHSA-pfq8-rq6v-vf5m", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=4.0.0" } ], "effects": [ "html-webpack-plugin" ], "range": "<=4.0.0", "nodes": [ "node_modules/html-minifier" ], "fixAvailable": false }, "html-webpack-plugin": { "name": "html-webpack-plugin", "severity": "critical", "isDirect": false, "via": [ "html-minifier", "loader-utils" ], "effects": [ "@vue/cli-service" ], "range": "1.4.0 - 4.0.0-beta.14", "nodes": [ "node_modules/html-webpack-plugin" ], "fixAvailable": false }, "http-proxy-agent": { "name": "http-proxy-agent", "severity": "low", "isDirect": false, "via": [ "@tootallnate/once" ], "effects": [ "jsdom" ], "range": "4.0.1", "nodes": [ "node_modules/http-proxy-agent" ], "fixAvailable": true }, "http-proxy-middleware": { "name": "http-proxy-middleware", "severity": "high", "isDirect": false, "via": [ { "source": 1100223, "name": "http-proxy-middleware", "dependency": "http-proxy-middleware", "title": "Denial of service in http-proxy-middleware", "url": "https://github.com/advisories/GHSA-c7qv-q95q-8v27", "severity": "high", "cwe": [ "CWE-400" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<2.0.7" }, { "source": 1104105, "name": "http-proxy-middleware", "dependency": "http-proxy-middleware", "title": "http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed", "url": "https://github.com/advisories/GHSA-9gqv-wp59-fq42", "severity": "moderate", "cwe": [ "CWE-754" ], "cvss": { "score": 4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N" }, "range": ">=1.3.0 <2.0.9" }, { "source": 1104106, "name": "http-proxy-middleware", "dependency": "http-proxy-middleware", "title": "http-proxy-middleware can call writeBody twice because \"else if\" is not used", "url": "https://github.com/advisories/GHSA-4www-5p9h-95mh", "severity": "moderate", "cwe": [ "CWE-670" ], "cvss": { "score": 4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, "range": ">=1.3.0 <2.0.8" }, { "source": 1121360, "name": "http-proxy-middleware", "dependency": "http-proxy-middleware", "title": "http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass", "url": "https://github.com/advisories/GHSA-64mm-vxmg-q3vj", "severity": "moderate", "cwe": [ "CWE-20", "CWE-187" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=0.16.0 <2.0.10" }, "micromatch" ], "effects": [ "@types/webpack-dev-server", "webpack-dev-server" ], "range": "<=2.0.10-beta.0", "nodes": [ "node_modules/http-proxy-middleware", "node_modules/webpack-dev-server/node_modules/http-proxy-middleware" ], "fixAvailable": false }, "icss-utils": { "name": "icss-utils", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [ "css-loader", "postcss-modules-local-by-default", "postcss-modules-values" ], "range": "<=4.1.1", "nodes": [ "node_modules/icss-utils" ], "fixAvailable": false }, "ip": { "name": "ip", "severity": "high", "isDirect": false, "via": [ { "source": 1101851, "name": "ip", "dependency": "ip", "title": "ip SSRF improper categorization in isPublic", "url": "https://github.com/advisories/GHSA-2p57-rm9w-gvfp", "severity": "high", "cwe": [ "CWE-918" ], "cvss": { "score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<=2.0.1" } ], "effects": [ "webpack-dev-server" ], "range": "*", "nodes": [ "node_modules/ip" ], "fixAvailable": false }, "jest": { "name": "jest", "severity": "low", "isDirect": true, "via": [ "@jest/core", "jest-cli" ], "effects": [], "range": ">=25.2.0-alpha.86", "nodes": [ "node_modules/jest" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "jest-cli": { "name": "jest-cli", "severity": "low", "isDirect": false, "via": [ "@jest/core", "jest-config" ], "effects": [], "range": ">=25.2.0-alpha.86", "nodes": [ "node_modules/jest-cli" ], "fixAvailable": true }, "jest-config": { "name": "jest-config", "severity": "moderate", "isDirect": false, "via": [ "@jest/test-sequencer", "babel-jest", "deepmerge", "jest-jasmine2" ], "effects": [ "@jest/core", "jest-cli", "jest-runner", "jest-runtime" ], "range": ">=24.2.0-alpha.0", "nodes": [ "node_modules/jest-config" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "jest-haste-map": { "name": "jest-haste-map", "severity": "moderate", "isDirect": false, "via": [ "sane" ], "effects": [ "@jest/core", "@jest/reporters", "@jest/test-sequencer", "@jest/transform", "jest-runner", "jest-runtime", "jest-snapshot" ], "range": "24.0.0-alpha.0 - 26.6.2", "nodes": [ "node_modules/jest-haste-map" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "jest-jasmine2": { "name": "jest-jasmine2", "severity": "moderate", "isDirect": false, "via": [ "jest-runtime", "jest-snapshot" ], "effects": [], "range": "25.2.0-alpha.86 - 26.6.3", "nodes": [ "node_modules/jest-jasmine2" ], "fixAvailable": true }, "jest-resolve-dependencies": { "name": "jest-resolve-dependencies", "severity": "moderate", "isDirect": false, "via": [ "jest-snapshot" ], "effects": [], "range": "26.1.0 - 26.6.3", "nodes": [ "node_modules/jest-resolve-dependencies" ], "fixAvailable": true }, "jest-runner": { "name": "jest-runner", "severity": "moderate", "isDirect": false, "via": [ "jest-config", "jest-haste-map", "jest-runtime" ], "effects": [ "@jest/core", "@jest/test-sequencer" ], "range": "24.0.0-alpha.0 - 27.0.1", "nodes": [ "node_modules/jest-runner" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "jest-runtime": { "name": "jest-runtime", "severity": "moderate", "isDirect": false, "via": [ "@jest/transform", "jest-config", "jest-haste-map", "jest-snapshot" ], "effects": [ "jest-jasmine2", "jest-runner" ], "range": "24.0.0-alpha.0 - 26.6.3", "nodes": [ "node_modules/jest-runtime" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "jest-snapshot": { "name": "jest-snapshot", "severity": "moderate", "isDirect": false, "via": [ "jest-haste-map" ], "effects": [ "@jest/core", "jest-jasmine2", "jest-resolve-dependencies", "jest-runtime" ], "range": "24.2.0-alpha.0 - 24.5.0 || 26.1.0 - 26.6.2", "nodes": [ "node_modules/jest-snapshot" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "js-beautify": { "name": "js-beautify", "severity": "moderate", "isDirect": false, "via": [ "editorconfig", "glob" ], "effects": [], "range": ">=1.14.9", "nodes": [ "node_modules/js-beautify" ], "fixAvailable": true }, "js-yaml": { "name": "js-yaml", "severity": "high", "isDirect": false, "via": [ { "source": 1138114, "name": "js-yaml", "dependency": "js-yaml", "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported", "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj", "severity": "high", "cwe": [ "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=3.0.0 <3.15.1" }, { "source": 1193726, "name": "js-yaml", "dependency": "js-yaml", "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources", "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh", "severity": "high", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=3.0.0 <3.15.2" } ], "effects": [], "range": "3.0.0 - 3.15.1", "nodes": [ "node_modules/js-yaml" ], "fixAvailable": true }, "jsdom": { "name": "jsdom", "severity": "low", "isDirect": false, "via": [ "http-proxy-agent" ], "effects": [], "range": "16.6.0 - 17.0.0", "nodes": [ "node_modules/jsdom" ], "fixAvailable": true }, "json5": { "name": "json5", "severity": "high", "isDirect": false, "via": [ { "source": 1096543, "name": "json5", "dependency": "json5", "title": "Prototype Pollution in JSON5 via Parse Method", "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h", "severity": "high", "cwe": [ "CWE-1321" ], "cvss": { "score": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H" }, "range": "<1.0.2" } ], "effects": [ "loader-utils" ], "range": "<1.0.2", "nodes": [ "node_modules/html-webpack-plugin/node_modules/json5" ], "fixAvailable": false }, "launch-editor": { "name": "launch-editor", "severity": "high", "isDirect": false, "via": [ { "source": 1242627, "name": "launch-editor", "dependency": "launch-editor", "title": "launch-editor: escapeCmdArgs() omits % escaping on Windows", "url": "https://github.com/advisories/GHSA-698v-4r3x-3vcv", "severity": "moderate", "cwe": [ "CWE-78" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=2.14.1" }, { "source": 1242656, "name": "launch-editor", "dependency": "launch-editor", "title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors", "url": "https://github.com/advisories/GHSA-r825-w8mm-5pxw", "severity": "moderate", "cwe": [ "CWE-88" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=2.14.1" }, { "source": 1242663, "name": "launch-editor", "dependency": "launch-editor", "title": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows", "url": "https://github.com/advisories/GHSA-587h-7wmj-h5pm", "severity": "high", "cwe": [ "CWE-77" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=2.14.1" } ], "effects": [], "range": "<=2.14.1", "nodes": [ "node_modules/launch-editor" ], "fixAvailable": true }, "loader-utils": { "name": "loader-utils", "severity": "critical", "isDirect": false, "via": [ { "source": 1094088, "name": "loader-utils", "dependency": "loader-utils", "title": "Prototype pollution in webpack loader-utils", "url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq", "severity": "critical", "cwe": [ "CWE-1321" ], "cvss": { "score": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<1.4.1" }, "json5" ], "effects": [ "html-webpack-plugin" ], "range": "<=1.4.0", "nodes": [ "node_modules/html-webpack-plugin/node_modules/loader-utils" ], "fixAvailable": false }, "micromatch": { "name": "micromatch", "severity": "high", "isDirect": false, "via": [ { "source": 1098681, "name": "micromatch", "dependency": "micromatch", "title": "Regular Expression Denial of Service (ReDoS) in micromatch", "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv", "severity": "moderate", "cwe": [ "CWE-1333" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<4.0.8" }, "braces" ], "effects": [ "anymatch", "fast-glob", "http-proxy-middleware", "readdirp", "sane", "webpack" ], "range": "<=4.0.7", "nodes": [ "node_modules/globby/node_modules/micromatch", "node_modules/sane/node_modules/micromatch", "node_modules/watchpack-chokidar2/node_modules/micromatch", "node_modules/webpack-dev-server/node_modules/micromatch", "node_modules/webpack/node_modules/micromatch" ], "fixAvailable": false }, "minimatch": { "name": "minimatch", "severity": "moderate", "isDirect": false, "via": [ { "source": 1244623, "name": "minimatch", "dependency": "minimatch", "title": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "severity": "moderate", "cwe": [ "CWE-405" ], "cvss": { "score": 0, "vectorString": null }, "range": ">=7.0.0 <11.0.1" } ], "effects": [ "editorconfig", "glob" ], "range": "7.0.0 - 11.0.0", "nodes": [ "node_modules/editorconfig/node_modules/minimatch", "node_modules/js-beautify/node_modules/minimatch" ], "fixAvailable": true }, "node-forge": { "name": "node-forge", "severity": "high", "isDirect": false, "via": [ { "source": 1088227, "name": "node-forge", "dependency": "node-forge", "title": "Prototype Pollution in node-forge debug API.", "url": "https://github.com/advisories/GHSA-5rrq-pxf6-6jx5", "severity": "low", "cwe": [ "CWE-1321" ], "cvss": { "score": 0, "vectorString": null }, "range": "<1.0.0" }, { "source": 1088229, "name": "node-forge", "dependency": "node-forge", "title": "URL parsing in node-forge could lead to undesired behavior.", "url": "https://github.com/advisories/GHSA-gf8q-jrpm-jvxq", "severity": "low", "cwe": [ "CWE-601" ], "cvss": { "score": 0, "vectorString": null }, "range": "<1.0.0" }, { "source": 1088746, "name": "node-forge", "dependency": "node-forge", "title": "Improper Verification of Cryptographic Signature in `node-forge`", "url": "https://github.com/advisories/GHSA-2r2c-g63r-vccr", "severity": "moderate", "cwe": [ "CWE-347" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<1.3.0" }, { "source": 1093719, "name": "node-forge", "dependency": "node-forge", "title": "Open Redirect in node-forge", "url": "https://github.com/advisories/GHSA-8fr3-hfg3-gpgp", "severity": "moderate", "cwe": [ "CWE-601" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<1.0.0" }, { "source": 1102321, "name": "node-forge", "dependency": "node-forge", "title": "Improper Verification of Cryptographic Signature in node-forge", "url": "https://github.com/advisories/GHSA-x4jg-mjrx-434g", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<1.3.0" }, { "source": 1102322, "name": "node-forge", "dependency": "node-forge", "title": "Improper Verification of Cryptographic Signature in node-forge", "url": "https://github.com/advisories/GHSA-cfm4-qjh2-4765", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<1.3.0" }, { "source": 1110996, "name": "node-forge", "dependency": "node-forge", "title": "node-forge has ASN.1 Unbounded Recursion", "url": "https://github.com/advisories/GHSA-554w-wpv2-vw27", "severity": "high", "cwe": [ "CWE-674" ], "cvss": { "score": 0, "vectorString": null }, "range": "<1.3.2" }, { "source": 1110998, "name": "node-forge", "dependency": "node-forge", "title": "node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization", "url": "https://github.com/advisories/GHSA-5gfm-wpxj-wjgq", "severity": "high", "cwe": [ "CWE-436" ], "cvss": { "score": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N" }, "range": "<1.3.2" }, { "source": 1111068, "name": "node-forge", "dependency": "node-forge", "title": "node-forge is vulnerable to ASN.1 OID Integer Truncation", "url": "https://github.com/advisories/GHSA-65ch-62r8-g69g", "severity": "moderate", "cwe": [ "CWE-190" ], "cvss": { "score": 0, "vectorString": null }, "range": "<1.3.2" }, { "source": 1115545, "name": "node-forge", "dependency": "node-forge", "title": "Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)", "url": "https://github.com/advisories/GHSA-2328-f5f3-gj25", "severity": "high", "cwe": [ "CWE-295" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": "<=1.3.3" }, { "source": 1115546, "name": "node-forge", "dependency": "node-forge", "title": "Forge has signature forgery in Ed25519 due to missing S > L check", "url": "https://github.com/advisories/GHSA-q67f-28xg-22rw", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<1.4.0" }, { "source": 1115548, "name": "node-forge", "dependency": "node-forge", "title": "Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input", "url": "https://github.com/advisories/GHSA-5m6q-g25r-mvwx", "severity": "high", "cwe": [ "CWE-835" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<1.4.0" }, { "source": 1115612, "name": "node-forge", "dependency": "node-forge", "title": "Forge has signature forgery in RSA-PKCS due to ASN.1 extra field ", "url": "https://github.com/advisories/GHSA-ppp5-5v6c-4jwp", "severity": "high", "cwe": [ "CWE-20", "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<1.4.0" }, { "source": 1240912, "name": "node-forge", "dependency": "node-forge", "title": "node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements", "url": "https://github.com/advisories/GHSA-86w9-cpqp-85rv", "severity": "high", "cwe": [ "CWE-347" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<=1.4.0" }, { "source": 1244014, "name": "node-forge", "dependency": "node-forge", "title": "Forge: ASN.1 OID first arc truncation in asn1.oidToDer", "url": "https://github.com/advisories/GHSA-4642-5mcj-2rqw", "severity": "low", "cwe": [ "CWE-190" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<=1.4.0" }, { "source": 1244015, "name": "node-forge", "dependency": "node-forge", "title": "Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie", "url": "https://github.com/advisories/GHSA-6wvx-3r32-xmcg", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, "range": "<=1.4.0" }, { "source": 1244016, "name": "node-forge", "dependency": "node-forge", "title": "Forge: TLS client crash when the server sends no certificate", "url": "https://github.com/advisories/GHSA-525v-9gp9-w22h", "severity": "moderate", "cwe": [ "CWE-476" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=1.4.0" }, { "source": 1244017, "name": "node-forge", "dependency": "node-forge", "title": "Forge: Regular expression denial of service in PEM decoding (pem.decode)", "url": "https://github.com/advisories/GHSA-7wch-p9px-956x", "severity": "high", "cwe": [ "CWE-400", "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=1.4.0" }, { "source": 1244018, "name": "node-forge", "dependency": "node-forge", "title": "Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)", "url": "https://github.com/advisories/GHSA-h6cr-wjv9-3cpp", "severity": "low", "cwe": [ "CWE-835" ], "cvss": { "score": 2.9, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<=1.4.0" }, { "source": 1244019, "name": "node-forge", "dependency": "node-forge", "title": "Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store", "url": "https://github.com/advisories/GHSA-4487-j8r4-4g2f", "severity": "low", "cwe": [ "CWE-295", "CWE-471" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<=1.4.0" }, { "source": 1244020, "name": "node-forge", "dependency": "node-forge", "title": "Forge: AES-GCM authentication bypass via unvalidated tagLength option", "url": "https://github.com/advisories/GHSA-5cwg-6vw7-rj6p", "severity": "moderate", "cwe": [ "CWE-354", "CWE-1284" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<=1.4.0" }, { "source": 1244021, "name": "node-forge", "dependency": "node-forge", "title": "Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count", "url": "https://github.com/advisories/GHSA-jc66-7q78-782g", "severity": "high", "cwe": [ "CWE-354", "CWE-1284" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<=1.4.0" }, { "source": 1244022, "name": "node-forge", "dependency": "node-forge", "title": "Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message", "url": "https://github.com/advisories/GHSA-8hrf-8g6f-7xwp", "severity": "high", "cwe": [ "CWE-248", "CWE-476" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=1.4.0" }, { "source": 1244023, "name": "node-forge", "dependency": "node-forge", "title": "Forge: Denial of service in TLS record processing via call stack exhaustion", "url": "https://github.com/advisories/GHSA-hqq3-7jhf-c5jx", "severity": "high", "cwe": [ "CWE-674" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<=1.4.0" }, { "source": 1244024, "name": "node-forge", "dependency": "node-forge", "title": "Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13", "url": "https://github.com/advisories/GHSA-5x38-2vff-x55p", "severity": "high", "cwe": [ "CWE-295", "CWE-436" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": "<=1.4.0" } ], "effects": [ "selfsigned" ], "range": "<=1.4.0", "nodes": [ "node_modules/node-forge" ], "fixAvailable": false }, "node-libs-browser": { "name": "node-libs-browser", "severity": "low", "isDirect": false, "via": [ "crypto-browserify" ], "effects": [ "webpack" ], "range": "0.4.2 || >=1.0.0", "nodes": [ "node_modules/node-libs-browser" ], "fixAvailable": false }, "node-notifier": { "name": "node-notifier", "severity": "moderate", "isDirect": false, "via": [ "uuid" ], "effects": [ "@jest/reporters" ], "range": "7.0.0 - 10.0.1", "nodes": [ "node_modules/node-notifier" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "nth-check": { "name": "nth-check", "severity": "high", "isDirect": false, "via": [ { "source": 1095141, "name": "nth-check", "dependency": "nth-check", "title": "Inefficient Regular Expression Complexity in nth-check", "url": "https://github.com/advisories/GHSA-rp65-9cf3-cjxr", "severity": "high", "cwe": [ "CWE-1333" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<2.0.1" } ], "effects": [ "css-select" ], "range": "<2.0.1", "nodes": [ "node_modules/svgo/node_modules/nth-check" ], "fixAvailable": true }, "pbkdf2": { "name": "pbkdf2", "severity": "moderate", "isDirect": false, "via": [ { "source": 1241333, "name": "pbkdf2", "dependency": "pbkdf2", "title": "pbkdf2 rehashes long passwords on every iteration, enabling denial of service", "url": "https://github.com/advisories/GHSA-477h-4r7f-fvrx", "severity": "moderate", "cwe": [ "CWE-400" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<=3.1.6" } ], "effects": [], "range": "<=3.1.6", "nodes": [ "node_modules/pbkdf2" ], "fixAvailable": true }, "postcss": { "name": "postcss", "severity": "high", "isDirect": true, "via": [ { "source": 1109574, "name": "postcss", "dependency": "postcss", "title": "PostCSS line return parsing error", "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j", "severity": "moderate", "cwe": [ "CWE-74", "CWE-144" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, "range": "<8.4.31" }, { "source": 1117015, "name": "postcss", "dependency": "postcss", "title": "PostCSS has XSS via Unescaped in its CSS Stringify Output", "url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<8.5.10" }, { "source": 1124252, "name": "postcss", "dependency": "postcss", "title": "PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments", "url": "https://github.com/advisories/GHSA-6g55-p6wh-862q", "severity": "high", "cwe": [ "CWE-22", "CWE-200" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "range": "<=8.5.11" }, { "source": 1130709, "name": "postcss", "dependency": "postcss", "title": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset", "url": "https://github.com/advisories/GHSA-fxqj-rqcc-2cmp", "severity": "moderate", "cwe": [ "CWE-22", "CWE-200" ], "cvss": { "score": 0, "vectorString": null }, "range": "<=8.5.22" }, { "source": 1139510, "name": "postcss", "dependency": "postcss", "title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure", "url": "https://github.com/advisories/GHSA-r28c-9q8g-f849", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, "range": "<=8.5.17" } ], "effects": [ "@intervolga/optimize-cssnano-plugin", "@vue/compiler-sfc", "@vue/component-compiler-utils", "autoprefixer", "css-declaration-sorter", "css-loader", "cssnano", "cssnano-preset-default", "cssnano-util-raw-cache", "icss-utils", "postcss-calc", "postcss-colormin", "postcss-convert-values", "postcss-discard-comments", "postcss-discard-duplicates", "postcss-discard-empty", "postcss-discard-overridden", "postcss-import", "postcss-loader", "postcss-merge-longhand", "postcss-merge-rules", "postcss-minify-font-values", "postcss-minify-gradients", "postcss-minify-params", "postcss-minify-selectors", "postcss-modules-extract-imports", "postcss-modules-local-by-default", "postcss-modules-scope", "postcss-modules-values", "postcss-normalize-charset", "postcss-normalize-display-values", "postcss-normalize-positions", "postcss-normalize-repeat-style", "postcss-normalize-string", "postcss-normalize-timing-functions", "postcss-normalize-unicode", "postcss-normalize-url", "postcss-normalize-whitespace", "postcss-ordered-values", "postcss-reduce-initial", "postcss-reduce-transforms", "postcss-svgo", "postcss-unique-selectors", "stylehacks" ], "range": "<=8.5.22", "nodes": [ "node_modules/postcss" ], "fixAvailable": false }, "postcss-calc": { "name": "postcss-calc", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-selector-parser" ], "effects": [], "range": "4.1.0 - 7.0.5", "nodes": [ "node_modules/postcss-calc" ], "fixAvailable": true }, "postcss-colormin": { "name": "postcss-colormin", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.3", "nodes": [ "node_modules/postcss-colormin" ], "fixAvailable": true }, "postcss-convert-values": { "name": "postcss-convert-values", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.1", "nodes": [ "node_modules/postcss-convert-values" ], "fixAvailable": true }, "postcss-discard-comments": { "name": "postcss-discard-comments", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-discard-comments" ], "fixAvailable": true }, "postcss-discard-duplicates": { "name": "postcss-discard-duplicates", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "1.1.0 - 4.0.2", "nodes": [ "node_modules/postcss-discard-duplicates" ], "fixAvailable": true }, "postcss-discard-empty": { "name": "postcss-discard-empty", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "1.1.0 - 4.0.1", "nodes": [ "node_modules/postcss-discard-empty" ], "fixAvailable": true }, "postcss-discard-overridden": { "name": "postcss-discard-overridden", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.1", "nodes": [ "node_modules/postcss-discard-overridden" ], "fixAvailable": true }, "postcss-import": { "name": "postcss-import", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [ "@dcloudio/vue-cli-plugin-uni" ], "range": "<=12.0.1", "nodes": [ "node_modules/postcss-import" ], "fixAvailable": false }, "postcss-loader": { "name": "postcss-loader", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.1", "nodes": [ "node_modules/postcss-loader" ], "fixAvailable": true }, "postcss-merge-longhand": { "name": "postcss-merge-longhand", "severity": "moderate", "isDirect": false, "via": [ "postcss", "stylehacks" ], "effects": [], "range": "<=4.0.11", "nodes": [ "node_modules/postcss-merge-longhand" ], "fixAvailable": true }, "postcss-merge-rules": { "name": "postcss-merge-rules", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-selector-parser" ], "effects": [], "range": "<=4.0.3", "nodes": [ "node_modules/postcss-merge-rules" ], "fixAvailable": true }, "postcss-minify-font-values": { "name": "postcss-minify-font-values", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-minify-font-values" ], "fixAvailable": true }, "postcss-minify-gradients": { "name": "postcss-minify-gradients", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-minify-gradients" ], "fixAvailable": true }, "postcss-minify-params": { "name": "postcss-minify-params", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-minify-params" ], "fixAvailable": true }, "postcss-minify-selectors": { "name": "postcss-minify-selectors", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-selector-parser" ], "effects": [], "range": "<=5.0.0", "nodes": [ "node_modules/postcss-minify-selectors" ], "fixAvailable": true }, "postcss-modules-extract-imports": { "name": "postcss-modules-extract-imports", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=2.0.0", "nodes": [ "node_modules/postcss-modules-extract-imports" ], "fixAvailable": true }, "postcss-modules-local-by-default": { "name": "postcss-modules-local-by-default", "severity": "moderate", "isDirect": false, "via": [ "icss-utils", "postcss", "postcss-selector-parser" ], "effects": [], "range": "<=4.0.0-rc.4", "nodes": [ "node_modules/postcss-modules-local-by-default" ], "fixAvailable": true }, "postcss-modules-scope": { "name": "postcss-modules-scope", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-selector-parser" ], "effects": [], "range": "<=2.2.0", "nodes": [ "node_modules/postcss-modules-scope" ], "fixAvailable": true }, "postcss-modules-values": { "name": "postcss-modules-values", "severity": "moderate", "isDirect": false, "via": [ "icss-utils", "postcss" ], "effects": [ "css-loader" ], "range": "<=4.0.0-rc.5", "nodes": [ "node_modules/postcss-modules-values" ], "fixAvailable": false }, "postcss-normalize-charset": { "name": "postcss-normalize-charset", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.1", "nodes": [ "node_modules/postcss-normalize-charset" ], "fixAvailable": true }, "postcss-normalize-display-values": { "name": "postcss-normalize-display-values", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-display-values" ], "fixAvailable": true }, "postcss-normalize-positions": { "name": "postcss-normalize-positions", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-positions" ], "fixAvailable": true }, "postcss-normalize-repeat-style": { "name": "postcss-normalize-repeat-style", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-repeat-style" ], "fixAvailable": true }, "postcss-normalize-string": { "name": "postcss-normalize-string", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-string" ], "fixAvailable": true }, "postcss-normalize-timing-functions": { "name": "postcss-normalize-timing-functions", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-timing-functions" ], "fixAvailable": true }, "postcss-normalize-unicode": { "name": "postcss-normalize-unicode", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.1", "nodes": [ "node_modules/postcss-normalize-unicode" ], "fixAvailable": true }, "postcss-normalize-url": { "name": "postcss-normalize-url", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "1.1.0 - 4.0.1", "nodes": [ "node_modules/postcss-normalize-url" ], "fixAvailable": true }, "postcss-normalize-whitespace": { "name": "postcss-normalize-whitespace", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-normalize-whitespace" ], "fixAvailable": true }, "postcss-ordered-values": { "name": "postcss-ordered-values", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.1.2", "nodes": [ "node_modules/postcss-ordered-values" ], "fixAvailable": true }, "postcss-reduce-initial": { "name": "postcss-reduce-initial", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.3", "nodes": [ "node_modules/postcss-reduce-initial" ], "fixAvailable": true }, "postcss-reduce-transforms": { "name": "postcss-reduce-transforms", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.2", "nodes": [ "node_modules/postcss-reduce-transforms" ], "fixAvailable": true }, "postcss-selector-parser": { "name": "postcss-selector-parser", "severity": "moderate", "isDirect": false, "via": [ { "source": 1243379, "name": "postcss-selector-parser", "dependency": "postcss-selector-parser", "title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion", "url": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf", "severity": "moderate", "cwe": [ "CWE-400", "CWE-407" ], "cvss": { "score": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": "<6.1.5" } ], "effects": [ "@dcloudio/vue-cli-plugin-uni", "@vue/component-compiler-utils", "postcss-calc", "postcss-merge-rules", "postcss-minify-selectors", "postcss-modules-local-by-default", "postcss-modules-scope" ], "range": "<6.1.5", "nodes": [ "node_modules/postcss-selector-parser" ], "fixAvailable": false }, "postcss-svgo": { "name": "postcss-svgo", "severity": "high", "isDirect": false, "via": [ "postcss", "svgo" ], "effects": [], "range": "<=5.0.0-rc.2", "nodes": [ "node_modules/postcss-svgo" ], "fixAvailable": true }, "postcss-unique-selectors": { "name": "postcss-unique-selectors", "severity": "moderate", "isDirect": false, "via": [ "postcss" ], "effects": [], "range": "<=4.0.1", "nodes": [ "node_modules/postcss-unique-selectors" ], "fixAvailable": true }, "proxy-addr": { "name": "proxy-addr", "severity": "critical", "isDirect": false, "via": [ { "source": 1241210, "name": "proxy-addr", "dependency": "proxy-addr", "title": "proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet", "url": "https://github.com/advisories/GHSA-jqcg-44mw-7w3h", "severity": "critical", "cwe": [ "CWE-290", "CWE-348", "CWE-697" ], "cvss": { "score": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, "range": ">=1.1.0 <2.0.8" } ], "effects": [], "range": "1.1.0 - 2.0.7", "nodes": [ "node_modules/proxy-addr" ], "fixAvailable": true }, "qs": { "name": "qs", "severity": "moderate", "isDirect": false, "via": [ { "source": 1113719, "name": "qs", "dependency": "qs", "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion", "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p", "severity": "moderate", "cwe": [ "CWE-20" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<6.14.1" }, { "source": 1158506, "name": "qs", "dependency": "qs", "title": "qs array-limit bypass via bracket-key comma parsing", "url": "https://github.com/advisories/GHSA-x5fp-wj9c-mxmx", "severity": "moderate", "cwe": [ "CWE-770" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.14.2 <=6.15.3" }, { "source": 1158507, "name": "qs", "dependency": "qs", "title": "qs: Denial of Service via Attacker Controlled isBuffer", "url": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g", "severity": "moderate", "cwe": [ "CWE-248", "CWE-703" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.2.5 <6.16.0" }, { "source": 1243687, "name": "qs", "dependency": "qs", "title": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)", "url": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw", "severity": "moderate", "cwe": [ "CWE-248", "CWE-704" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=6.7.0 <=6.16.0" } ], "effects": [ "request" ], "range": "<=6.16.0", "nodes": [ "node_modules/body-parser/node_modules/qs", "node_modules/express/node_modules/qs", "node_modules/qs", "node_modules/url/node_modules/qs" ], "fixAvailable": false }, "readdirp": { "name": "readdirp", "severity": "moderate", "isDirect": false, "via": [ "micromatch" ], "effects": [ "chokidar" ], "range": "2.2.0 - 2.2.1", "nodes": [ "node_modules/watchpack-chokidar2/node_modules/readdirp", "node_modules/webpack-dev-server/node_modules/readdirp" ], "fixAvailable": false }, "request": { "name": "request", "severity": "critical", "isDirect": false, "via": [ { "source": 1096727, "name": "request", "dependency": "request", "title": "Server-Side Request Forgery in Request", "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6", "severity": "moderate", "cwe": [ "CWE-918" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": "<=2.88.2" }, "form-data", "qs", "tough-cookie", "uuid" ], "effects": [ "@vue/cli-shared-utils" ], "range": "*", "nodes": [ "node_modules/request" ], "fixAvailable": false }, "sane": { "name": "sane", "severity": "moderate", "isDirect": false, "via": [ "anymatch", "micromatch" ], "effects": [ "jest-haste-map" ], "range": "1.5.0 - 4.1.0", "nodes": [ "node_modules/sane" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "selfsigned": { "name": "selfsigned", "severity": "high", "isDirect": false, "via": [ "node-forge" ], "effects": [ "webpack-dev-server" ], "range": "1.1.1 - 1.10.14", "nodes": [ "node_modules/selfsigned" ], "fixAvailable": false }, "serialize-javascript": { "name": "serialize-javascript", "severity": "high", "isDirect": false, "via": [ { "source": 1113686, "name": "serialize-javascript", "dependency": "serialize-javascript", "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()", "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq", "severity": "high", "cwe": [ "CWE-96" ], "cvss": { "score": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, "range": "<=7.0.2" }, { "source": 1243082, "name": "serialize-javascript", "dependency": "serialize-javascript", "title": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped =1.8.4 <1.11.0" } ], "effects": [], "range": "1.8.4 - 1.10.0", "nodes": [ "node_modules/shell-quote" ], "fixAvailable": true }, "sockjs": { "name": "sockjs", "severity": "moderate", "isDirect": false, "via": [ "uuid" ], "effects": [ "webpack-dev-server" ], "range": ">=0.3.17", "nodes": [ "node_modules/sockjs" ], "fixAvailable": false }, "source-map-js": { "name": "source-map-js", "severity": "high", "isDirect": false, "via": [ { "source": 1241209, "name": "source-map-js", "dependency": "source-map-js", "title": "source-map-js allows event-loop denial of service through indexed source-map section offsets", "url": "https://github.com/advisories/GHSA-68fv-2mgg-jv7q", "severity": "high", "cwe": [ "CWE-1284" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, "range": ">=1.0.0 <1.2.2" } ], "effects": [], "range": "1.0.0 - 1.2.1", "nodes": [ "node_modules/source-map-js" ], "fixAvailable": true }, "source-map-resolve": { "name": "source-map-resolve", "severity": "high", "isDirect": false, "via": [ "decode-uri-component" ], "effects": [], "range": ">=0.5.1", "nodes": [ "node_modules/source-map-resolve" ], "fixAvailable": true }, "stylehacks": { "name": "stylehacks", "severity": "moderate", "isDirect": false, "via": [ "postcss", "postcss-selector-parser" ], "effects": [ "postcss-merge-longhand" ], "range": "<=4.0.3", "nodes": [ "node_modules/stylehacks" ], "fixAvailable": true }, "svgo": { "name": "svgo", "severity": "high", "isDirect": false, "via": [ { "source": 1139520, "name": "svgo", "dependency": "svgo", "title": "SVGO removeScripts plugin leaves some executable scripts intact", "url": "https://github.com/advisories/GHSA-2p49-hgcm-8545", "severity": "high", "cwe": [ "CWE-79", "CWE-184" ], "cvss": { "score": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, "range": ">=1.0.0 <2.8.3" }, { "source": 1193740, "name": "svgo", "dependency": "svgo", "title": "SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements", "url": "https://github.com/advisories/GHSA-4vpr-x523-8j87", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, "range": ">=1.0.0 <2.8.4" }, { "source": 1243426, "name": "svgo", "dependency": "svgo", "title": "SVGO: removeScripts allows executable links through namespace and control-character bypasses", "url": "https://github.com/advisories/GHSA-w27v-7q3p-w38r", "severity": "high", "cwe": [ "CWE-79", "CWE-184" ], "cvss": { "score": 8.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N" }, "range": ">=1.0.0 <2.8.4" }, "css-select" ], "effects": [ "postcss-svgo" ], "range": "1.0.0 - 2.8.3", "nodes": [ "node_modules/svgo" ], "fixAvailable": true }, "terser-webpack-plugin": { "name": "terser-webpack-plugin", "severity": "high", "isDirect": false, "via": [ "serialize-javascript" ], "effects": [ "@vue/cli-service", "webpack" ], "range": "<=5.3.16", "nodes": [ "node_modules/terser-webpack-plugin" ], "fixAvailable": false }, "tough-cookie": { "name": "tough-cookie", "severity": "moderate", "isDirect": false, "via": [ { "source": 1097682, "name": "tough-cookie", "dependency": "tough-cookie", "title": "tough-cookie Prototype Pollution vulnerability", "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3", "severity": "moderate", "cwe": [ "CWE-1321" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, "range": "<4.1.3" } ], "effects": [ "request" ], "range": "<4.1.3", "nodes": [ "node_modules/request/node_modules/tough-cookie" ], "fixAvailable": false }, "uuid": { "name": "uuid", "severity": "moderate", "isDirect": false, "via": [ { "source": 1119441, "name": "uuid", "dependency": "uuid", "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided", "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq", "severity": "moderate", "cwe": [ "CWE-787", "CWE-1285" ], "cvss": { "score": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, "range": "<11.1.1" } ], "effects": [ "node-notifier", "request", "sockjs", "webpack-log" ], "range": "<11.1.1", "nodes": [ "node_modules/request/node_modules/uuid", "node_modules/uuid", "node_modules/webpack-log/node_modules/uuid" ], "fixAvailable": { "name": "jest", "version": "25.1.0", "isSemVerMajor": true } }, "vue": { "name": "vue", "severity": "moderate", "isDirect": true, "via": [ "@vue/compiler-sfc", { "source": 1100238, "name": "vue", "dependency": "vue", "title": "ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function", "url": "https://github.com/advisories/GHSA-5j4c-8p2g-v4jx", "severity": "low", "cwe": [ "CWE-1333" ], "cvss": { "score": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": ">=2.0.0-alpha.1 <3.0.0-alpha.0" } ], "effects": [], "range": "2.0.0-alpha.1 - 2.7.16 || 3.5.36", "nodes": [ "node_modules/vue" ], "fixAvailable": { "name": "vue", "version": "3.5.44", "isSemVerMajor": true } }, "vue-loader": { "name": "vue-loader", "severity": "moderate", "isDirect": false, "via": [ "@vue/component-compiler-utils" ], "effects": [], "range": "15.0.0-beta.1 - 15.11.1", "nodes": [ "node_modules/vue-loader" ], "fixAvailable": true }, "vue-template-compiler": { "name": "vue-template-compiler", "severity": "moderate", "isDirect": false, "via": [ { "source": 1111772, "name": "vue-template-compiler", "dependency": "vue-template-compiler", "title": "vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)", "url": "https://github.com/advisories/GHSA-g3ch-rx76-35fx", "severity": "moderate", "cwe": [ "CWE-79" ], "cvss": { "score": 4.2, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N" }, "range": ">=2.0.0 <3.0.0" } ], "effects": [ "@dcloudio/uni-template-compiler" ], "range": ">=2.0.0", "nodes": [ "node_modules/vue-template-compiler" ], "fixAvailable": false }, "watchpack": { "name": "watchpack", "severity": "high", "isDirect": false, "via": [ "watchpack-chokidar2" ], "effects": [ "webpack" ], "range": "1.7.2 - 1.7.5", "nodes": [ "node_modules/watchpack" ], "fixAvailable": false }, "watchpack-chokidar2": { "name": "watchpack-chokidar2", "severity": "high", "isDirect": false, "via": [ "chokidar" ], "effects": [ "watchpack" ], "range": "*", "nodes": [ "node_modules/watchpack-chokidar2" ], "fixAvailable": false }, "webpack": { "name": "webpack", "severity": "high", "isDirect": false, "via": [ "micromatch", "node-libs-browser", "terser-webpack-plugin", "watchpack" ], "effects": [ "@vue/cli-plugin-babel", "@vue/cli-service" ], "range": "2.0.0-beta - 5.1.0", "nodes": [ "node_modules/webpack" ], "fixAvailable": false }, "webpack-dev-middleware": { "name": "webpack-dev-middleware", "severity": "high", "isDirect": false, "via": [ { "source": 1096729, "name": "webpack-dev-middleware", "dependency": "webpack-dev-middleware", "title": "Path traversal in webpack-dev-middleware", "url": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N" }, "range": "<=5.3.3" }, { "source": 1240027, "name": "webpack-dev-middleware", "dependency": "webpack-dev-middleware", "title": "webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath", "url": "https://github.com/advisories/GHSA-g84c-rxfj-3j2c", "severity": "high", "cwe": [ "CWE-22" ], "cvss": { "score": 7.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N" }, "range": "<7.4.5" }, "webpack-log" ], "effects": [ "webpack-dev-server" ], "range": "<=7.4.4", "nodes": [ "node_modules/webpack-dev-middleware" ], "fixAvailable": false }, "webpack-dev-server": { "name": "webpack-dev-server", "severity": "high", "isDirect": false, "via": [ { "source": 1108429, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser", "url": "https://github.com/advisories/GHSA-9jgg-88mc-972h", "severity": "moderate", "cwe": [ "CWE-346" ], "cvss": { "score": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, "range": "<=5.2.0" }, { "source": 1108430, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server users' source code may be stolen when they access a malicious web site", "url": "https://github.com/advisories/GHSA-4v9v-hfq4-rm2v", "severity": "moderate", "cwe": [ "CWE-749" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" }, "range": "<=5.2.0" }, { "source": 1119074, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins", "url": "https://github.com/advisories/GHSA-79cf-xcqc-c78w", "severity": "moderate", "cwe": [ "CWE-749" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" }, "range": "<=5.2.3" }, { "source": 1121087, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies", "url": "https://github.com/advisories/GHSA-mx8g-39q3-5c79", "severity": "moderate", "cwe": [ "CWE-346", "CWE-441" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<5.2.5" }, { "source": 1123965, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints", "url": "https://github.com/advisories/GHSA-f5vj-f2hx-8m93", "severity": "moderate", "cwe": [ "CWE-352", "CWE-749" ], "cvss": { "score": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L" }, "range": "<=5.2.5" }, { "source": 1123966, "name": "webpack-dev-server", "dependency": "webpack-dev-server", "title": "webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header", "url": "https://github.com/advisories/GHSA-m28w-2pqf-7qgj", "severity": "moderate", "cwe": [ "CWE-20", "CWE-248" ], "cvss": { "score": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, "range": "<=5.2.5" }, "chokidar", "http-proxy-middleware", "ip", "selfsigned", "sockjs", "webpack-dev-middleware", "webpack-log" ], "effects": [ "@vue/cli-service" ], "range": "<=5.2.7", "nodes": [ "node_modules/webpack-dev-server" ], "fixAvailable": false }, "webpack-log": { "name": "webpack-log", "severity": "moderate", "isDirect": false, "via": [ "uuid" ], "effects": [ "copy-webpack-plugin", "webpack-dev-middleware", "webpack-dev-server" ], "range": "1.1.0 - 2.0.0", "nodes": [ "node_modules/webpack-log" ], "fixAvailable": false } }, "metadata": { "vulnerabilities": { "info": 0, "low": 11, "moderate": 82, "high": 32, "critical": 7, "total": 132 }, "dependencies": { "prod": 64, "dev": 1633, "optional": 31, "peer": 0, "peerOptional": 0, "total": 1696 } } }