cfc/_run40_npm_audit_web.json

{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@babel/core": {
      "name": "@babel/core",
      "severity": "low",
      "isDirect": true,
      "via": [
        {
          "source": 1123528,
          "name": "@babel/core",
          "dependency": "@babel/core",
          "title": "@babel/core: Arbitrary File Read via sourceMappingURL Comment",
          "url": "https://github.com/advisories/GHSA-4x5r-pxfx-6jf8",
          "severity": "low",
          "cwe": [
            "CWE-22",
            "CWE-200"
          ],
          "cvss": {
            "score": 3.2,
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N"
          },
          "range": "<=7.29.0"
        }
      ],
      "effects": [],
      "range": "<=7.29.0",
      "nodes": [
        "node_modules/@babel/core"
      ],
      "fixAvailable": true
    },
    "@jest/core": {
      "name": "@jest/core",
      "severity": "low",
      "isDirect": false,
      "via": [
        "jest-config"
      ],
      "effects": [],
      "range": ">=25.2.0-alpha.86",
      "nodes": [
        "node_modules/@jest/core"
      ],
      "fixAvailable": true
    },
    "@vue/cli-plugin-router": {
      "name": "@vue/cli-plugin-router",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@vue/cli-service"
      ],
      "effects": [
        "@vue/cli-service"
      ],
      "range": "*",
      "nodes": [
        "node_modules/@vue/cli-plugin-router"
      ],
      "fixAvailable": false
    },
    "@vue/cli-plugin-vuex": {
      "name": "@vue/cli-plugin-vuex",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@vue/cli-service"
      ],
      "effects": [],
      "range": "*",
      "nodes": [
        "node_modules/@vue/cli-plugin-vuex"
      ],
      "fixAvailable": true
    },
    "@vue/cli-service": {
      "name": "@vue/cli-service",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "@vue/cli-plugin-router",
        "@vue/cli-plugin-vuex",
        "@vue/component-compiler-utils",
        "copy-webpack-plugin",
        "css-minimizer-webpack-plugin",
        "vue-loader",
        "vue-template-compiler",
        "webpack-dev-server"
      ],
      "effects": [
        "@vue/cli-plugin-router",
        "@vue/cli-plugin-vuex"
      ],
      "range": "*",
      "nodes": [
        "node_modules/@vue/cli-service"
      ],
      "fixAvailable": false
    },
    "@vue/component-compiler-utils": {
      "name": "@vue/component-compiler-utils",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "postcss"
      ],
      "effects": [
        "@vue/cli-service",
        "vue-loader"
      ],
      "range": "*",
      "nodes": [
        "node_modules/@vue/component-compiler-utils"
      ],
      "fixAvailable": false
    },
    "@vue/test-utils": {
      "name": "@vue/test-utils",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "vue",
        "vue-template-compiler"
      ],
      "effects": [],
      "range": "<=1.3.6",
      "nodes": [
        "node_modules/@vue/test-utils"
      ],
      "fixAvailable": {
        "name": "@vue/test-utils",
        "version": "2.5.1",
        "isSemVerMajor": true
      }
    },
    "@wangeditor/editor-for-vue": {
      "name": "@wangeditor/editor-for-vue",
      "severity": "low",
      "isDirect": true,
      "via": [
        "vue"
      ],
      "effects": [],
      "range": "<=1.0.2",
      "nodes": [
        "node_modules/@wangeditor/editor-for-vue"
      ],
      "fixAvailable": {
        "name": "@wangeditor/editor-for-vue",
        "version": "5.1.12",
        "isSemVerMajor": true
      }
    },
    "axios": {
      "name": "axios",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1138749,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Prototype pollution auth subfields can inject Basic auth",
          "url": "https://github.com/advisories/GHSA-xj6q-8x83-jv6g",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.2 <1.18.0"
        },
        {
          "source": 1147949,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Prototype pollution gadgets can alter axios request construction",
          "url": "https://github.com/advisories/GHSA-mmx7-hfxf-jppx",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.0.0 <1.18.0"
        },
        {
          "source": 1147950,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service",
          "url": "https://github.com/advisories/GHSA-pmv8-rq9r-6j72",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.0.0 <1.18.0"
        },
        {
          "source": 1153175,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: HTTP/2 streamed uploads bypass `maxBodyLength`",
          "url": "https://github.com/advisories/GHSA-mwf2-3pr3-8698",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.13.0 <1.18.0"
        },
        {
          "source": 1153178,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning",
          "url": "https://github.com/advisories/GHSA-gcfj-64vw-6mp9",
          "severity": "high",
          "cwe": [
            "CWE-200",
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.2 <1.18.0"
        },
        {
          "source": 1153180,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Nested axios option objects can consume polluted prototype values",
          "url": "https://github.com/advisories/GHSA-7q8q-rj6j-mhjq",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.0.0 <1.18.0"
        },
        {
          "source": 1153182,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`",
          "url": "https://github.com/advisories/GHSA-jqh4-m9w3-8hp9",
          "severity": "moderate",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.7.0 <1.18.0"
        },
        {
          "source": 1153184,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios",
          "url": "https://github.com/advisories/GHSA-f4gw-2p7v-4548",
          "severity": "moderate",
          "cwe": [
            "CWE-183",
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.0 <1.18.0"
        },
        {
          "source": 1153185,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Excessive recursion in formDataToJSON can cause denial of service",
          "url": "https://github.com/advisories/GHSA-42h9-826w-cgv3",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.0.0 <1.18.0"
        },
        {
          "source": 1193664,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios form serializer maxDepth bypass via {} metatoken",
          "url": "https://github.com/advisories/GHSA-hcpx-6fm6-wx23",
          "severity": "moderate",
          "cwe": [
            "CWE-674"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.1 <1.18.0"
        },
        {
          "source": 1240600,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Prototype pollution gadget in fetch adapter can alter outbound requests",
          "url": "https://github.com/advisories/GHSA-vh66-26gq-q6x8",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.7.0 <1.20.0"
        },
        {
          "source": 1240601,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method",
          "url": "https://github.com/advisories/GHSA-9fr6-4gfg-395g",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.0.0 <1.20.0"
        },
        {
          "source": 1240604,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location",
          "url": "https://github.com/advisories/GHSA-mghh-pgcx-3jjj",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.0 <1.20.0"
        },
        {
          "source": 1240605,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Prototype Pollution Gadget in axios toFormData Options",
          "url": "https://github.com/advisories/GHSA-x97p-jq2g-jp4f",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.1 <1.20.0"
        },
        {
          "source": 1240607,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls",
          "url": "https://github.com/advisories/GHSA-3pq3-5fj3-cg6v",
          "severity": "high",
          "cwe": [
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.13.0 <1.20.0"
        },
        {
          "source": 1240608,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization",
          "url": "https://github.com/advisories/GHSA-542g-h47m-68v8",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.13.0 <1.20.0"
        },
        {
          "source": 1240626,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Header Injection via Inherited headers After Minimal Interceptor",
          "url": "https://github.com/advisories/GHSA-j8rh-479h-cp32",
          "severity": "moderate",
          "cwe": [
            "CWE-74",
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.0.0 <1.20.0"
        },
        {
          "source": 1240627,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders",
          "url": "https://github.com/advisories/GHSA-4hqw-qxg8-jxx2",
          "severity": "moderate",
          "cwe": [
            "CWE-74",
            "CWE-693",
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.12.0 <1.20.0"
        },
        {
          "source": 1240628,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection",
          "url": "https://github.com/advisories/GHSA-m8m8-qj5v-23w3",
          "severity": "high",
          "cwe": [
            "CWE-441",
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.2 <1.20.0"
        },
        {
          "source": 1240629,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges",
          "url": "https://github.com/advisories/GHSA-44g4-m2mj-wpvx",
          "severity": "moderate",
          "cwe": [
            "CWE-693"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.0 <1.20.0"
        }
      ],
      "effects": [],
      "range": "1.0.0 - 1.19.0",
      "nodes": [
        "node_modules/axios"
      ],
      "fixAvailable": true
    },
    "babel-plugin-transform-es2015-modules-commonjs": {
      "name": "babel-plugin-transform-es2015-modules-commonjs",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "babel-template"
      ],
      "effects": [
        "vue-jest"
      ],
      "range": "<=7.0.0-beta.0",
      "nodes": [
        "node_modules/babel-plugin-transform-es2015-modules-commonjs"
      ],
      "fixAvailable": {
        "name": "vue-jest",
        "version": "0.6.1",
        "isSemVerMajor": true
      }
    },
    "babel-template": {
      "name": "babel-template",
      "severity": "critical",
      "isDirect": false,
      "via": [
        "babel-traverse"
      ],
      "effects": [
        "babel-plugin-transform-es2015-modules-commonjs"
      ],
      "range": "*",
      "nodes": [
        "node_modules/babel-template"
      ],
      "fixAvailable": {
        "name": "vue-jest",
        "version": "0.6.1",
        "isSemVerMajor": true
      }
    },
    "babel-traverse": {
      "name": "babel-traverse",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1117412,
          "name": "babel-traverse",
          "dependency": "babel-traverse",
          "title": "Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code",
          "url": "https://github.com/advisories/GHSA-67hx-6x53-jw92",
          "severity": "critical",
          "cwe": [
            "CWE-184",
            "CWE-697"
          ],
          "cvss": {
            "score": 9.3,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
          },
          "range": "<7.23.2"
        }
      ],
      "effects": [
        "babel-template"
      ],
      "range": "*",
      "nodes": [
        "node_modules/babel-traverse"
      ],
      "fixAvailable": {
        "name": "vue-jest",
        "version": "0.6.1",
        "isSemVerMajor": true
      }
    },
    "baseline-browser-mapping": {
      "name": "baseline-browser-mapping",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1193686,
          "name": "baseline-browser-mapping",
          "dependency": "baseline-browser-mapping",
          "title": "baseline-browser-mapping process termination on invalid input causes denial of service",
          "url": "https://github.com/advisories/GHSA-w5vr-8v7q-w6rv",
          "severity": "moderate",
          "cwe": [
            "CWE-705"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=2.0.0 <2.11.0"
        }
      ],
      "effects": [],
      "range": ">=2.0.0 <2.11.0",
      "nodes": [
        "node_modules/baseline-browser-mapping"
      ],
      "fixAvailable": true
    },
    "body-parser": {
      "name": "body-parser",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1123977,
          "name": "body-parser",
          "dependency": "body-parser",
          "title": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
          "url": "https://github.com/advisories/GHSA-v422-hmwv-36x6",
          "severity": "low",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<1.20.6"
        },
        {
          "source": 1243073,
          "name": "body-parser",
          "dependency": "body-parser",
          "title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body",
          "url": "https://github.com/advisories/GHSA-27r3-jxmh-p828",
          "severity": "high",
          "cwe": [
            "CWE-248"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.20.9"
        }
      ],
      "effects": [],
      "range": "<=1.20.8",
      "nodes": [
        "node_modules/body-parser"
      ],
      "fixAvailable": true
    },
    "brace-expansion": {
      "name": "brace-expansion",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1123896,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
          "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=2.0.0 <2.1.2"
        },
        {
          "source": 1123897,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
          "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<1.1.16"
        },
        {
          "source": 1130588,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
          "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.17"
        },
        {
          "source": 1130589,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
          "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=2.0.0 <2.1.3"
        },
        {
          "source": 1130736,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=2.0.0 <2.1.4"
        },
        {
          "source": 1130737,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.18"
        },
        {
          "source": 1240100,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
          "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<1.1.21"
        },
        {
          "source": 1240101,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
          "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=2.0.0 <2.1.7"
        },
        {
          "source": 1240104,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
          "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.20"
        },
        {
          "source": 1240105,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
          "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=2.0.0 <2.1.6"
        },
        {
          "source": 1240108,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
          "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.19"
        },
        {
          "source": 1240109,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
          "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=2.0.0 <2.1.5"
        }
      ],
      "effects": [],
      "range": "<=1.1.20 || 2.0.0 - 2.1.6",
      "nodes": [
        "node_modules/brace-expansion",
        "node_modules/editorconfig/node_modules/brace-expansion",
        "node_modules/js-beautify/node_modules/brace-expansion"
      ],
      "fixAvailable": true
    },
    "browserslist": {
      "name": "browserslist",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1153171,
          "name": "browserslist",
          "dependency": "browserslist",
          "title": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM",
          "url": "https://github.com/advisories/GHSA-c83g-rgw3-j3cx",
          "severity": "high",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=4.28.6"
        },
        {
          "source": 1153172,
          "name": "browserslist",
          "dependency": "browserslist",
          "title": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)",
          "url": "https://github.com/advisories/GHSA-73wf-gq98-2v4g",
          "severity": "high",
          "cwe": [
            "CWE-248",
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=4.28.6"
        }
      ],
      "effects": [],
      "range": "<=4.28.6",
      "nodes": [
        "node_modules/browserslist"
      ],
      "fixAvailable": true
    },
    "colord": {
      "name": "colord",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1193675,
          "name": "colord",
          "dependency": "colord",
          "title": "Colord: Slow rejection of oversized malformed color strings",
          "url": "https://github.com/advisories/GHSA-2wm5-q62r-hmrv",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.9.4"
        }
      ],
      "effects": [],
      "range": "<2.9.4",
      "nodes": [
        "node_modules/colord"
      ],
      "fixAvailable": true
    },
    "compression": {
      "name": "compression",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1241221,
          "name": "compression",
          "dependency": "compression",
          "title": "compression vulnerable to Denial of Service via memory leak on premature response close",
          "url": "https://github.com/advisories/GHSA-vc2v-76pw-4v95",
          "severity": "high",
          "cwe": [
            "CWE-401",
            "CWE-459"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.8.2"
        }
      ],
      "effects": [],
      "range": "<1.8.2",
      "nodes": [
        "node_modules/compression"
      ],
      "fixAvailable": true
    },
    "copy-webpack-plugin": {
      "name": "copy-webpack-plugin",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "serialize-javascript"
      ],
      "effects": [],
      "range": "6.1.1 - 13.0.1",
      "nodes": [
        "node_modules/copy-webpack-plugin"
      ],
      "fixAvailable": true
    },
    "create-jest": {
      "name": "create-jest",
      "severity": "low",
      "isDirect": false,
      "via": [
        "jest-config"
      ],
      "effects": [
        "jest-cli"
      ],
      "range": ">=29.7.0",
      "nodes": [
        "node_modules/create-jest"
      ],
      "fixAvailable": {
        "name": "jest",
        "version": "25.1.0",
        "isSemVerMajor": true
      }
    },
    "css": {
      "name": "css",
      "severity": "high",
      "isDirect": false,
      "via": [
        "source-map-resolve"
      ],
      "effects": [],
      "range": ">=2.2.2",
      "nodes": [
        "node_modules/css"
      ],
      "fixAvailable": true
    },
    "css-minimizer-webpack-plugin": {
      "name": "css-minimizer-webpack-plugin",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "serialize-javascript"
      ],
      "effects": [
        "@vue/cli-service"
      ],
      "range": "1.1.4 - 7.0.4",
      "nodes": [
        "node_modules/css-minimizer-webpack-plugin"
      ],
      "fixAvailable": false
    },
    "decode-uri-component": {
      "name": "decode-uri-component",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1147955,
          "name": "decode-uri-component",
          "dependency": "decode-uri-component",
          "title": "decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input",
          "url": "https://github.com/advisories/GHSA-vcc3-ghjq-m6fr",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-405",
            "CWE-407",
            "CWE-1176"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=0.4.2"
        },
        {
          "source": 1243857,
          "name": "decode-uri-component",
          "dependency": "decode-uri-component",
          "title": "decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs",
          "url": "https://github.com/advisories/GHSA-qr28-fpjm-wq7f",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=0.5.0"
        }
      ],
      "effects": [
        "source-map-resolve"
      ],
      "range": "<=0.5.0",
      "nodes": [
        "node_modules/decode-uri-component"
      ],
      "fixAvailable": true
    },
    "deepmerge": {
      "name": "deepmerge",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1243505,
          "name": "deepmerge",
          "dependency": "deepmerge",
          "title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
          "url": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4",
          "severity": "low",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=4.2.0 <=4.3.1"
        }
      ],
      "effects": [
        "jest-config"
      ],
      "range": ">=4.2.0",
      "nodes": [
        "node_modules/jest-config/node_modules/deepmerge"
      ],
      "fixAvailable": {
        "name": "jest",
        "version": "25.1.0",
        "isSemVerMajor": true
      }
    },
    "editorconfig": {
      "name": "editorconfig",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "minimatch"
      ],
      "effects": [
        "js-beautify"
      ],
      "range": ">=1.0.3",
      "nodes": [
        "node_modules/editorconfig"
      ],
      "fixAvailable": true
    },
    "element-ui": {
      "name": "element-ui",
      "severity": "low",
      "isDirect": true,
      "via": [
        "vue"
      ],
      "effects": [],
      "range": ">=1.0.0-rc.1",
      "nodes": [
        "node_modules/element-ui"
      ],
      "fixAvailable": {
        "name": "element-ui",
        "version": "0.2.6",
        "isSemVerMajor": true
      }
    },
    "fast-uri": {
      "name": "fast-uri",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1124064,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to host confusion via literal backslash authority delimiter",
          "url": "https://github.com/advisories/GHSA-v2hh-gcrm-f6hx",
          "severity": "high",
          "cwe": [
            "CWE-436"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=3.0.0 <=3.1.3"
        },
        {
          "source": 1130720,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to host confusion via backslash authority introducer",
          "url": "https://github.com/advisories/GHSA-7p8r-x3mc-p8w7",
          "severity": "high",
          "cwe": [
            "CWE-436"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=3.0.0 <3.1.5"
        },
        {
          "source": 1158524,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization",
          "url": "https://github.com/advisories/GHSA-f65p-4m7j-42xc",
          "severity": "high",
          "cwe": [
            "CWE-20",
            "CWE-918"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=3.0.0 <3.1.6"
        },
        {
          "source": 1158527,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding",
          "url": "https://github.com/advisories/GHSA-fph4-wmhf-6fwf",
          "severity": "high",
          "cwe": [
            "CWE-174",
            "CWE-918"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=3.1.2 <3.1.6"
        },
        {
          "source": 1158530,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to host confusion via percent-encoded scheme normalization",
          "url": "https://github.com/advisories/GHSA-jqff-g426-hqxp",
          "severity": "high",
          "cwe": [
            "CWE-177"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=3.0.0 <3.1.6"
        },
        {
          "source": 1204921,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to host confusion via failed IDN canonicalization",
          "url": "https://github.com/advisories/GHSA-4c8g-83qw-93j6",
          "severity": "high",
          "cwe": [
            "CWE-436",
            "CWE-551"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=3.0.0 <3.1.3"
        },
        {
          "source": 1239943,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to authority injection via an unvalidated port in serialize",
          "url": "https://github.com/advisories/GHSA-qw65-cvwx-89v3",
          "severity": "high",
          "cwe": [
            "CWE-116"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=3.0.0 <3.1.7"
        },
        {
          "source": 1240091,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets",
          "url": "https://github.com/advisories/GHSA-hrr3-gc8f-f4qj",
          "severity": "moderate",
          "cwe": [
            "CWE-178"
          ],
          "cvss": {
            "score": 4.8,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": ">=3.0.0 <3.1.8"
        },
        {
          "source": 1243098,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding",
          "url": "https://github.com/advisories/GHSA-w74x-v6f9-j3xg",
          "severity": "moderate",
          "cwe": [
            "CWE-172",
            "CWE-180"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": ">=3.0.0 <3.1.9"
        },
        {
          "source": 1243101,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to improper path equivalence in relative reference normalization",
          "url": "https://github.com/advisories/GHSA-xhq7-xmqj-769h",
          "severity": "low",
          "cwe": [
            "CWE-41"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=3.0.0 <3.1.9"
        },
        {
          "source": 1243107,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references",
          "url": "https://github.com/advisories/GHSA-333x-w4r6-6crp",
          "severity": "low",
          "cwe": [
            "CWE-41",
            "CWE-116"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=3.0.0 <3.1.9"
        }
      ],
      "effects": [],
      "range": "3.0.0 - 3.1.8",
      "nodes": [
        "node_modules/fast-uri"
      ],
      "fixAvailable": true
    },
    "follow-redirects": {
      "name": "follow-redirects",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1242604,
          "name": "follow-redirects",
          "dependency": "follow-redirects",
          "title": "follow-redirects array-form headers bypass cross-origin credential stripping",
          "url": "https://github.com/advisories/GHSA-q3jh-wrc6-jgq8",
          "severity": "high",
          "cwe": [
            "CWE-200",
            "CWE-212"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.16.0 <1.16.1"
        },
        {
          "source": 1242605,
          "name": "follow-redirects",
          "dependency": "follow-redirects",
          "title": "follow-redirects sensitiveHeaders regex escaping can expose credential headers",
          "url": "https://github.com/advisories/GHSA-8r9p-f939-6h3c",
          "severity": "high",
          "cwe": [
            "CWE-185",
            "CWE-200"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.16.0 <1.16.1"
        },
        {
          "source": 1244003,
          "name": "follow-redirects",
          "dependency": "follow-redirects",
          "title": "follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects",
          "url": "https://github.com/advisories/GHSA-mrwp-f3q8-3g9p",
          "severity": "high",
          "cwe": [
            "CWE-201"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
          },
          "range": ">=1.16.0 <=1.16.1"
        }
      ],
      "effects": [],
      "range": "1.16.0 - 1.16.1",
      "nodes": [
        "node_modules/follow-redirects"
      ],
      "fixAvailable": true
    },
    "form-data": {
      "name": "form-data",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1120743,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
          "url": "https://github.com/advisories/GHSA-hmw2-7cc7-3qxx",
          "severity": "high",
          "cwe": [
            "CWE-93"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=4.0.0 <4.0.6"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.0.5",
      "nodes": [
        "node_modules/form-data"
      ],
      "fixAvailable": true
    },
    "glob": {
      "name": "glob",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109842,
          "name": "glob",
          "dependency": "glob",
          "title": "glob CLI: Command injection via -c/--cmd executes matches with shell:true",
          "url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2",
          "severity": "high",
          "cwe": [
            "CWE-78"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=10.2.0 <10.5.0"
        },
        {
          "source": 1244013,
          "name": "glob",
          "dependency": "glob",
          "title": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal",
          "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=9.0.0 <=14.0.1"
        },
        "minimatch"
      ],
      "effects": [],
      "range": "9.0.0 - 14.0.1",
      "nodes": [
        "node_modules/js-beautify/node_modules/glob"
      ],
      "fixAvailable": true
    },
    "http-proxy-middleware": {
      "name": "http-proxy-middleware",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1121360,
          "name": "http-proxy-middleware",
          "dependency": "http-proxy-middleware",
          "title": "http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",
          "url": "https://github.com/advisories/GHSA-64mm-vxmg-q3vj",
          "severity": "moderate",
          "cwe": [
            "CWE-20",
            "CWE-187"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=0.16.0 <2.0.10"
        }
      ],
      "effects": [],
      "range": ">=0.16.0 <2.0.10",
      "nodes": [
        "node_modules/http-proxy-middleware"
      ],
      "fixAvailable": true
    },
    "jest": {
      "name": "jest",
      "severity": "low",
      "isDirect": true,
      "via": [
        "@jest/core",
        "jest-cli"
      ],
      "effects": [],
      "range": ">=25.2.0-alpha.86",
      "nodes": [
        "node_modules/jest"
      ],
      "fixAvailable": {
        "name": "jest",
        "version": "25.1.0",
        "isSemVerMajor": true
      }
    },
    "jest-cli": {
      "name": "jest-cli",
      "severity": "low",
      "isDirect": false,
      "via": [
        "@jest/core",
        "create-jest",
        "jest-config"
      ],
      "effects": [
        "jest"
      ],
      "range": ">=25.2.0-alpha.86",
      "nodes": [
        "node_modules/jest-cli"
      ],
      "fixAvailable": {
        "name": "jest",
        "version": "25.1.0",
        "isSemVerMajor": true
      }
    },
    "jest-config": {
      "name": "jest-config",
      "severity": "low",
      "isDirect": false,
      "via": [
        "deepmerge"
      ],
      "effects": [
        "@jest/core",
        "create-jest",
        "jest-cli"
      ],
      "range": ">=25.2.0-alpha.86",
      "nodes": [
        "node_modules/jest-config"
      ],
      "fixAvailable": {
        "name": "jest",
        "version": "25.1.0",
        "isSemVerMajor": true
      }
    },
    "joi": {
      "name": "joi",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1120656,
          "name": "joi",
          "dependency": "joi",
          "title": "joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas",
          "url": "https://github.com/advisories/GHSA-q7cg-457f-vx79",
          "severity": "moderate",
          "cwe": [
            "CWE-248",
            "CWE-400"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<17.13.4"
        },
        {
          "source": 1193674,
          "name": "joi",
          "dependency": "joi",
          "title": "joi: Prototype pollution via a `__proto__` language key in custom messages",
          "url": "https://github.com/advisories/GHSA-6w3j-5fw6-r9vr",
          "severity": "low",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=17.2.0 <17.13.6"
        },
        {
          "source": 1193679,
          "name": "joi",
          "dependency": "joi",
          "title": "joi: object().rename() with a template target can set the validated object's prototype",
          "url": "https://github.com/advisories/GHSA-gg4h-3hg2-grpc",
          "severity": "low",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=16.0.0 <17.13.5"
        },
        {
          "source": 1241212,
          "name": "joi",
          "dependency": "joi",
          "title": "joi messages compilation allows prototype replacement through __proto__ error codes",
          "url": "https://github.com/advisories/GHSA-wr44-6hxh-3jwq",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<17.13.8"
        },
        {
          "source": 1241279,
          "name": "joi",
          "dependency": "joi",
          "title": "joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`",
          "url": "https://github.com/advisories/GHSA-6h2x-m376-mqjq",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=17.2.0 <17.13.7"
        },
        {
          "source": 1244009,
          "name": "joi",
          "dependency": "joi",
          "title": "joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service",
          "url": "https://github.com/advisories/GHSA-4528-x5fx-h6hg",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=17.1.1 <17.13.9"
        }
      ],
      "effects": [],
      "range": "<=17.13.8",
      "nodes": [
        "node_modules/joi"
      ],
      "fixAvailable": true
    },
    "js-beautify": {
      "name": "js-beautify",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "editorconfig"
      ],
      "effects": [],
      "range": ">=1.14.9",
      "nodes": [
        "node_modules/js-beautify"
      ],
      "fixAvailable": true
    },
    "js-cookie": {
      "name": "js-cookie",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1120607,
          "name": "js-cookie",
          "dependency": "js-cookie",
          "title": "JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection",
          "url": "https://github.com/advisories/GHSA-qjx8-664m-686j",
          "severity": "high",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<=3.0.5"
        }
      ],
      "effects": [],
      "range": "<=3.0.5",
      "nodes": [
        "node_modules/js-cookie"
      ],
      "fixAvailable": true
    },
    "js-yaml": {
      "name": "js-yaml",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1121859,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
          "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68",
          "severity": "moderate",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<3.15.0"
        },
        {
          "source": 1123912,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption",
          "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=3.0.0 <3.15.0"
        },
        {
          "source": 1138114,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported",
          "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=3.0.0 <3.15.1"
        },
        {
          "source": 1193726,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
          "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=3.0.0 <3.15.2"
        }
      ],
      "effects": [],
      "range": "<=3.15.1",
      "nodes": [
        "node_modules/js-yaml"
      ],
      "fixAvailable": true
    },
    "launch-editor": {
      "name": "launch-editor",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1120787,
          "name": "launch-editor",
          "dependency": "launch-editor",
          "title": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
          "url": "https://github.com/advisories/GHSA-v6wh-96g9-6wx3",
          "severity": "moderate",
          "cwe": [
            "CWE-73",
            "CWE-522"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=2.14.0"
        },
        {
          "source": 1242627,
          "name": "launch-editor",
          "dependency": "launch-editor",
          "title": "launch-editor: escapeCmdArgs() omits % escaping on Windows",
          "url": "https://github.com/advisories/GHSA-698v-4r3x-3vcv",
          "severity": "moderate",
          "cwe": [
            "CWE-78"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=2.14.1"
        },
        {
          "source": 1242656,
          "name": "launch-editor",
          "dependency": "launch-editor",
          "title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors",
          "url": "https://github.com/advisories/GHSA-r825-w8mm-5pxw",
          "severity": "moderate",
          "cwe": [
            "CWE-88"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=2.14.1"
        },
        {
          "source": 1242663,
          "name": "launch-editor",
          "dependency": "launch-editor",
          "title": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows",
          "url": "https://github.com/advisories/GHSA-587h-7wmj-h5pm",
          "severity": "high",
          "cwe": [
            "CWE-77"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=2.14.1"
        }
      ],
      "effects": [],
      "range": "<=2.14.1",
      "nodes": [
        "node_modules/launch-editor"
      ],
      "fixAvailable": true
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1244623,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has potential denial of service via globparts amplification",
          "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249",
          "severity": "moderate",
          "cwe": [
            "CWE-405"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=7.0.0 <11.0.1"
        }
      ],
      "effects": [
        "editorconfig",
        "glob"
      ],
      "range": "7.0.0 - 11.0.0",
      "nodes": [
        "node_modules/editorconfig/node_modules/minimatch",
        "node_modules/js-beautify/node_modules/minimatch"
      ],
      "fixAvailable": true
    },
    "nanoid": {
      "name": "nanoid",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1138811,
          "name": "nanoid",
          "dependency": "nanoid",
          "title": "nanoid: non-secure generators can loop indefinitely with negative size",
          "url": "https://github.com/advisories/GHSA-28wg-ghj8-5hjv",
          "severity": "high",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.3.16"
        },
        {
          "source": 1139427,
          "name": "nanoid",
          "dependency": "nanoid",
          "title": "nanoid: custom generators can loop indefinitely when size is zero",
          "url": "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
          "severity": "high",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.3.18"
        }
      ],
      "effects": [],
      "range": "<=3.3.17",
      "nodes": [
        "node_modules/nanoid"
      ],
      "fixAvailable": true
    },
    "node-forge": {
      "name": "node-forge",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1240912,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements",
          "url": "https://github.com/advisories/GHSA-86w9-cpqp-85rv",
          "severity": "high",
          "cwe": [
            "CWE-347"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<=1.4.0"
        },
        {
          "source": 1244014,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge: ASN.1 OID first arc truncation in asn1.oidToDer",
          "url": "https://github.com/advisories/GHSA-4642-5mcj-2rqw",
          "severity": "low",
          "cwe": [
            "CWE-190"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<=1.4.0"
        },
        {
          "source": 1244015,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie",
          "url": "https://github.com/advisories/GHSA-6wvx-3r32-xmcg",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 4.8,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
          },
          "range": "<=1.4.0"
        },
        {
          "source": 1244016,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge: TLS client crash when the server sends no certificate",
          "url": "https://github.com/advisories/GHSA-525v-9gp9-w22h",
          "severity": "moderate",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=1.4.0"
        },
        {
          "source": 1244017,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge: Regular expression denial of service in PEM decoding (pem.decode)",
          "url": "https://github.com/advisories/GHSA-7wch-p9px-956x",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=1.4.0"
        },
        {
          "source": 1244018,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)",
          "url": "https://github.com/advisories/GHSA-h6cr-wjv9-3cpp",
          "severity": "low",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 2.9,
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<=1.4.0"
        },
        {
          "source": 1244019,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store",
          "url": "https://github.com/advisories/GHSA-4487-j8r4-4g2f",
          "severity": "low",
          "cwe": [
            "CWE-295",
            "CWE-471"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<=1.4.0"
        },
        {
          "source": 1244020,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge: AES-GCM authentication bypass via unvalidated tagLength option",
          "url": "https://github.com/advisories/GHSA-5cwg-6vw7-rj6p",
          "severity": "moderate",
          "cwe": [
            "CWE-354",
            "CWE-1284"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<=1.4.0"
        },
        {
          "source": 1244021,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count",
          "url": "https://github.com/advisories/GHSA-jc66-7q78-782g",
          "severity": "high",
          "cwe": [
            "CWE-354",
            "CWE-1284"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<=1.4.0"
        },
        {
          "source": 1244022,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message",
          "url": "https://github.com/advisories/GHSA-8hrf-8g6f-7xwp",
          "severity": "high",
          "cwe": [
            "CWE-248",
            "CWE-476"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=1.4.0"
        },
        {
          "source": 1244023,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge: Denial of service in TLS record processing via call stack exhaustion",
          "url": "https://github.com/advisories/GHSA-hqq3-7jhf-c5jx",
          "severity": "high",
          "cwe": [
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=1.4.0"
        },
        {
          "source": 1244024,
          "name": "node-forge",
          "dependency": "node-forge",
          "title": "Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13",
          "url": "https://github.com/advisories/GHSA-5x38-2vff-x55p",
          "severity": "high",
          "cwe": [
            "CWE-295",
            "CWE-436"
          ],
          "cvss": {
            "score": 7.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
          },
          "range": "<=1.4.0"
        }
      ],
      "effects": [],
      "range": "<=1.4.0",
      "nodes": [
        "node_modules/node-forge"
      ],
      "fixAvailable": true
    },
    "pnpm": {
      "name": "pnpm",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1121808,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)",
          "url": "https://github.com/advisories/GHSA-rxhj-4m44-96r4",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H"
          },
          "range": ">=11.0.0 <11.4.0"
        },
        {
          "source": 1121810,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm binds unscoped user-level npm auth credentials to a repository-selected registry",
          "url": "https://github.com/advisories/GHSA-cjhr-43r9-cfmw",
          "severity": "moderate",
          "cwe": [
            "CWE-200",
            "CWE-522"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=11.0.0 <11.4.0"
        },
        {
          "source": 1121812,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement",
          "url": "https://github.com/advisories/GHSA-hwx4-2j3j-g496",
          "severity": "high",
          "cwe": [
            "CWE-23"
          ],
          "cvss": {
            "score": 8.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
          },
          "range": ">=11.0.0 <11.4.0"
        },
        {
          "source": 1121814,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Git Fetch Argument Injection via Lockfile resolution.commit",
          "url": "https://github.com/advisories/GHSA-p4xf-rf54-rj3x",
          "severity": "moderate",
          "cwe": [
            "CWE-88"
          ],
          "cvss": {
            "score": 6.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
          },
          "range": ">=11.0.0 <11.4.0"
        },
        {
          "source": 1121817,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field",
          "url": "https://github.com/advisories/GHSA-q6j5-fjx5-2mc3",
          "severity": "moderate",
          "cwe": [
            "CWE-354"
          ],
          "cvss": {
            "score": 6.8,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
          },
          "range": ">=11.0.0 <11.4.0"
        },
        {
          "source": 1121818,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Unsafe default behavior breaks integrity check",
          "url": "https://github.com/advisories/GHSA-54hh-g5mx-jqcp",
          "severity": "moderate",
          "cwe": [
            "CWE-345"
          ],
          "cvss": {
            "score": 6.8,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
          },
          "range": ">=11.0.0 <11.4.0"
        },
        {
          "source": 1121823,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle",
          "url": "https://github.com/advisories/GHSA-5wx6-mg75-v57r",
          "severity": "high",
          "cwe": [
            "CWE-346",
            "CWE-693",
            "CWE-829"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
          },
          "range": ">=11.0.0 <11.5.3"
        },
        {
          "source": 1121825,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Repository config can expand victim environment secrets into registry requests before scripts run",
          "url": "https://github.com/advisories/GHSA-3qhv-2rgh-x77r",
          "severity": "moderate",
          "cwe": [
            "CWE-200",
            "CWE-201",
            "CWE-522"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
          },
          "range": ">=11.0.0 <11.5.3"
        },
        {
          "source": 1121828,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Reserved bin name deletes PNPM_HOME during global remove",
          "url": "https://github.com/advisories/GHSA-4gxm-v5v7-fqc4",
          "severity": "moderate",
          "cwe": [
            "CWE-22",
            "CWE-73"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
          },
          "range": ">=11.0.0 <11.5.3"
        },
        {
          "source": 1121830,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes",
          "url": "https://github.com/advisories/GHSA-w466-c33r-3gjp",
          "severity": "high",
          "cwe": [
            "CWE-345",
            "CWE-494",
            "CWE-829"
          ],
          "cvss": {
            "score": 8.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
          },
          "range": ">=11.0.0 <11.5.3"
        },
        {
          "source": 1121832,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: `patch-remove` could delete project-selected files outside the patches directory",
          "url": "https://github.com/advisories/GHSA-72r4-9c5j-mj57",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-73"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
          },
          "range": ">=11.0.0 <11.7.0"
        },
        {
          "source": 1121834,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Hoisted install imports lockfile alias outside node_modules",
          "url": "https://github.com/advisories/GHSA-fr4h-3cph-29xv",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-73"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
          },
          "range": ">=11.0.0 <11.7.0"
        },
        {
          "source": 1121836,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config",
          "url": "https://github.com/advisories/GHSA-qrv3-253h-g69c",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L"
          },
          "range": ">=11.0.0 <11.8.0"
        },
        {
          "source": 1139461,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Repository-controlled configDependencies can select a pacquet native install engine",
          "url": "https://github.com/advisories/GHSA-gj8w-mvpf-x27x",
          "severity": "high",
          "cwe": [
            "CWE-78",
            "CWE-494",
            "CWE-829"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
          },
          "range": ">=11.0.0 <11.5.3"
        },
        {
          "source": 1153191,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml",
          "url": "https://github.com/advisories/GHSA-vx52-2968-3vc6",
          "severity": "high",
          "cwe": [
            "CWE-201",
            "CWE-319",
            "CWE-522"
          ],
          "cvss": {
            "score": 7.4,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
          },
          "range": ">=11.0.0 <11.11.0"
        },
        {
          "source": 1158509,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph",
          "url": "https://github.com/advisories/GHSA-c59q-g84q-2gj5",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"
          },
          "range": ">=11.0.0 <11.11.0"
        },
        {
          "source": 1158511,
          "name": "pnpm",
          "dependency": "pnpm",
          "title": "pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install",
          "url": "https://github.com/advisories/GHSA-vq4v-j7r6-jq4m",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-73",
            "CWE-94"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
          },
          "range": ">=11.0.0 <11.11.0"
        }
      ],
      "effects": [],
      "range": "11.0.0 - 11.10.0",
      "nodes": [
        "node_modules/pnpm"
      ],
      "fixAvailable": true
    },
    "postcss": {
      "name": "postcss",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109574,
          "name": "postcss",
          "dependency": "postcss",
          "title": "PostCSS line return parsing error",
          "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
          "severity": "moderate",
          "cwe": [
            "CWE-74",
            "CWE-144"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<8.4.31"
        },
        {
          "source": 1117015,
          "name": "postcss",
          "dependency": "postcss",
          "title": "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
          "url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<8.5.10"
        },
        {
          "source": 1124252,
          "name": "postcss",
          "dependency": "postcss",
          "title": "PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments",
          "url": "https://github.com/advisories/GHSA-6g55-p6wh-862q",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-200"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
          },
          "range": "<=8.5.11"
        },
        {
          "source": 1130709,
          "name": "postcss",
          "dependency": "postcss",
          "title": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
          "url": "https://github.com/advisories/GHSA-fxqj-rqcc-2cmp",
          "severity": "moderate",
          "cwe": [
            "CWE-22",
            "CWE-200"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=8.5.22"
        },
        {
          "source": 1139510,
          "name": "postcss",
          "dependency": "postcss",
          "title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",
          "url": "https://github.com/advisories/GHSA-r28c-9q8g-f849",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
          },
          "range": "<=8.5.17"
        }
      ],
      "effects": [
        "@vue/component-compiler-utils"
      ],
      "range": "<=8.5.22",
      "nodes": [
        "node_modules/@vue/component-compiler-utils/node_modules/postcss",
        "node_modules/postcss"
      ],
      "fixAvailable": false
    },
    "postcss-selector-parser": {
      "name": "postcss-selector-parser",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1153169,
          "name": "postcss-selector-parser",
          "dependency": "postcss-selector-parser",
          "title": "postcss-selector-parser allows denial of service through uncontrolled AST recursion",
          "url": "https://github.com/advisories/GHSA-w9m9-85wc-3x92",
          "severity": "low",
          "cwe": [
            "CWE-404"
          ],
          "cvss": {
            "score": 4.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
          },
          "range": ">=7.1.0 <7.1.3"
        },
        {
          "source": 1153170,
          "name": "postcss-selector-parser",
          "dependency": "postcss-selector-parser",
          "title": "postcss-selector-parser allows denial of service through uncontrolled AST recursion",
          "url": "https://github.com/advisories/GHSA-w9m9-85wc-3x92",
          "severity": "low",
          "cwe": [
            "CWE-404"
          ],
          "cvss": {
            "score": 4.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
          },
          "range": ">=6.1.0 <6.1.3"
        },
        {
          "source": 1243379,
          "name": "postcss-selector-parser",
          "dependency": "postcss-selector-parser",
          "title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion",
          "url": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.1.5"
        },
        {
          "source": 1243380,
          "name": "postcss-selector-parser",
          "dependency": "postcss-selector-parser",
          "title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion",
          "url": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.0.0 <7.1.6"
        }
      ],
      "effects": [],
      "range": "<=6.1.4 || 7.0.0 - 7.1.5",
      "nodes": [
        "node_modules/postcss-modules-local-by-default/node_modules/postcss-selector-parser",
        "node_modules/postcss-modules-scope/node_modules/postcss-selector-parser",
        "node_modules/postcss-selector-parser"
      ],
      "fixAvailable": true
    },
    "proxy-addr": {
      "name": "proxy-addr",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1241210,
          "name": "proxy-addr",
          "dependency": "proxy-addr",
          "title": "proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet",
          "url": "https://github.com/advisories/GHSA-jqcg-44mw-7w3h",
          "severity": "critical",
          "cwe": [
            "CWE-290",
            "CWE-348",
            "CWE-697"
          ],
          "cvss": {
            "score": 9.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
          },
          "range": ">=1.1.0 <2.0.8"
        }
      ],
      "effects": [],
      "range": "1.1.0 - 2.0.7",
      "nodes": [
        "node_modules/proxy-addr"
      ],
      "fixAvailable": true
    },
    "qs": {
      "name": "qs",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1119502,
          "name": "qs",
          "dependency": "qs",
          "title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
          "url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
          "severity": "moderate",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=6.11.1 <=6.15.1"
        },
        {
          "source": 1158506,
          "name": "qs",
          "dependency": "qs",
          "title": "qs array-limit bypass via bracket-key comma parsing",
          "url": "https://github.com/advisories/GHSA-x5fp-wj9c-mxmx",
          "severity": "moderate",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=6.14.2 <=6.15.3"
        },
        {
          "source": 1158507,
          "name": "qs",
          "dependency": "qs",
          "title": "qs: Denial of Service via Attacker Controlled isBuffer",
          "url": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g",
          "severity": "moderate",
          "cwe": [
            "CWE-248",
            "CWE-703"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=2.2.5 <6.16.0"
        },
        {
          "source": 1243687,
          "name": "qs",
          "dependency": "qs",
          "title": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)",
          "url": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw",
          "severity": "moderate",
          "cwe": [
            "CWE-248",
            "CWE-704"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=6.7.0 <=6.16.0"
        }
      ],
      "effects": [],
      "range": "2.2.5 - 6.16.0",
      "nodes": [
        "node_modules/body-parser/node_modules/qs",
        "node_modules/qs"
      ],
      "fixAvailable": true
    },
    "serialize-javascript": {
      "name": "serialize-javascript",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113686,
          "name": "serialize-javascript",
          "dependency": "serialize-javascript",
          "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
          "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
          "severity": "high",
          "cwe": [
            "CWE-96"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": "<=7.0.2"
        },
        {
          "source": 1119440,
          "name": "serialize-javascript",
          "dependency": "serialize-javascript",
          "title": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects",
          "url": "https://github.com/advisories/GHSA-qj8w-gfj5-8c6v",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-834"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=5.0.0 <7.0.5"
        },
        {
          "source": 1243082,
          "name": "serialize-javascript",
          "dependency": "serialize-javascript",
          "title": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body",
          "url": "https://github.com/advisories/GHSA-m5mm-p8h7-m29v",
          "severity": "low",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<7.1.3"
        }
      ],
      "effects": [
        "copy-webpack-plugin",
        "css-minimizer-webpack-plugin"
      ],
      "range": "<=7.1.2",
      "nodes": [
        "node_modules/serialize-javascript"
      ],
      "fixAvailable": false
    },
    "shell-quote": {
      "name": "shell-quote",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1120422,
          "name": "shell-quote",
          "dependency": "shell-quote",
          "title": "shell-quote quote() does not escape newlines in object .op values",
          "url": "https://github.com/advisories/GHSA-w7jw-789q-3m8p",
          "severity": "critical",
          "cwe": [
            "CWE-77",
            "CWE-78"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
          },
          "range": ">=1.1.0 <=1.8.3"
        },
        {
          "source": 1123944,
          "name": "shell-quote",
          "dependency": "shell-quote",
          "title": "shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)",
          "url": "https://github.com/advisories/GHSA-395f-4hp3-45gv",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=1.8.4"
        }
      ],
      "effects": [],
      "range": "<=1.8.4",
      "nodes": [
        "node_modules/shell-quote"
      ],
      "fixAvailable": true
    },
    "sockjs": {
      "name": "sockjs",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "uuid"
      ],
      "effects": [
        "webpack-dev-server"
      ],
      "range": ">=0.3.17",
      "nodes": [
        "node_modules/sockjs"
      ],
      "fixAvailable": true
    },
    "source-map-js": {
      "name": "source-map-js",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1241209,
          "name": "source-map-js",
          "dependency": "source-map-js",
          "title": "source-map-js allows event-loop denial of service through indexed source-map section offsets",
          "url": "https://github.com/advisories/GHSA-68fv-2mgg-jv7q",
          "severity": "high",
          "cwe": [
            "CWE-1284"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=1.0.0 <1.2.2"
        }
      ],
      "effects": [],
      "range": "1.0.0 - 1.2.1",
      "nodes": [
        "node_modules/source-map-js"
      ],
      "fixAvailable": true
    },
    "source-map-resolve": {
      "name": "source-map-resolve",
      "severity": "high",
      "isDirect": false,
      "via": [
        "decode-uri-component"
      ],
      "effects": [
        "css"
      ],
      "range": ">=0.5.1",
      "nodes": [
        "node_modules/source-map-resolve"
      ],
      "fixAvailable": true
    },
    "svgo": {
      "name": "svgo",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1139520,
          "name": "svgo",
          "dependency": "svgo",
          "title": "SVGO removeScripts plugin leaves some executable scripts intact",
          "url": "https://github.com/advisories/GHSA-2p49-hgcm-8545",
          "severity": "high",
          "cwe": [
            "CWE-79",
            "CWE-184"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
          },
          "range": ">=1.0.0 <2.8.3"
        },
        {
          "source": 1193740,
          "name": "svgo",
          "dependency": "svgo",
          "title": "SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements",
          "url": "https://github.com/advisories/GHSA-4vpr-x523-8j87",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": ">=1.0.0 <2.8.4"
        },
        {
          "source": 1243426,
          "name": "svgo",
          "dependency": "svgo",
          "title": "SVGO: removeScripts allows executable links through namespace and control-character bypasses",
          "url": "https://github.com/advisories/GHSA-w27v-7q3p-w38r",
          "severity": "high",
          "cwe": [
            "CWE-79",
            "CWE-184"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
          },
          "range": ">=1.0.0 <2.8.4"
        }
      ],
      "effects": [],
      "range": "1.0.0 - 2.8.3",
      "nodes": [
        "node_modules/svgo"
      ],
      "fixAvailable": true
    },
    "uuid": {
      "name": "uuid",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1119441,
          "name": "uuid",
          "dependency": "uuid",
          "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
          "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
          "severity": "moderate",
          "cwe": [
            "CWE-787",
            "CWE-1285"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<11.1.1"
        }
      ],
      "effects": [
        "sockjs"
      ],
      "range": "<11.1.1",
      "nodes": [
        "node_modules/uuid"
      ],
      "fixAvailable": true
    },
    "vue": {
      "name": "vue",
      "severity": "low",
      "isDirect": true,
      "via": [
        {
          "source": 1100238,
          "name": "vue",
          "dependency": "vue",
          "title": "ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function",
          "url": "https://github.com/advisories/GHSA-5j4c-8p2g-v4jx",
          "severity": "low",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=2.0.0-alpha.1 <3.0.0-alpha.0"
        }
      ],
      "effects": [
        "@vue/test-utils",
        "@wangeditor/editor-for-vue",
        "element-ui",
        "vue-jest",
        "vuex"
      ],
      "range": "2.0.0-alpha.1 - 2.7.16",
      "nodes": [
        "node_modules/vue"
      ],
      "fixAvailable": {
        "name": "vue",
        "version": "3.5.44",
        "isSemVerMajor": true
      }
    },
    "vue-jest": {
      "name": "vue-jest",
      "severity": "critical",
      "isDirect": true,
      "via": [
        "babel-plugin-transform-es2015-modules-commonjs",
        "vue",
        "vue-template-compiler"
      ],
      "effects": [],
      "range": "1.0.0 - 5.0.0-alpha.1",
      "nodes": [
        "node_modules/vue-jest"
      ],
      "fixAvailable": {
        "name": "vue-jest",
        "version": "0.6.1",
        "isSemVerMajor": true
      }
    },
    "vue-loader": {
      "name": "vue-loader",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@vue/component-compiler-utils"
      ],
      "effects": [
        "@vue/cli-service"
      ],
      "range": "15.0.0-beta.1 - 15.11.1",
      "nodes": [
        "node_modules/@vue/vue-loader-v15"
      ],
      "fixAvailable": false
    },
    "vue-template-compiler": {
      "name": "vue-template-compiler",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        {
          "source": 1111772,
          "name": "vue-template-compiler",
          "dependency": "vue-template-compiler",
          "title": "vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)",
          "url": "https://github.com/advisories/GHSA-g3ch-rx76-35fx",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 4.2,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": ">=2.0.0 <3.0.0"
        }
      ],
      "effects": [
        "@vue/cli-service",
        "@vue/test-utils",
        "vue-jest"
      ],
      "range": ">=2.0.0",
      "nodes": [
        "node_modules/vue-template-compiler"
      ],
      "fixAvailable": false
    },
    "vuex": {
      "name": "vuex",
      "severity": "low",
      "isDirect": true,
      "via": [
        "vue"
      ],
      "effects": [],
      "range": "3.1.3 - 3.6.2",
      "nodes": [
        "node_modules/vuex"
      ],
      "fixAvailable": {
        "name": "vuex",
        "version": "4.1.0",
        "isSemVerMajor": true
      }
    },
    "webpack-dev-middleware": {
      "name": "webpack-dev-middleware",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1240027,
          "name": "webpack-dev-middleware",
          "dependency": "webpack-dev-middleware",
          "title": "webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath",
          "url": "https://github.com/advisories/GHSA-g84c-rxfj-3j2c",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.4,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
          },
          "range": "<7.4.5"
        }
      ],
      "effects": [
        "webpack-dev-server"
      ],
      "range": "<7.4.5",
      "nodes": [
        "node_modules/webpack-dev-middleware"
      ],
      "fixAvailable": true
    },
    "webpack-dev-server": {
      "name": "webpack-dev-server",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1108429,
          "name": "webpack-dev-server",
          "dependency": "webpack-dev-server",
          "title": "webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser",
          "url": "https://github.com/advisories/GHSA-9jgg-88mc-972h",
          "severity": "moderate",
          "cwe": [
            "CWE-346"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
          },
          "range": "<=5.2.0"
        },
        {
          "source": 1108430,
          "name": "webpack-dev-server",
          "dependency": "webpack-dev-server",
          "title": "webpack-dev-server users' source code may be stolen when they access a malicious web site",
          "url": "https://github.com/advisories/GHSA-4v9v-hfq4-rm2v",
          "severity": "moderate",
          "cwe": [
            "CWE-749"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
          },
          "range": "<=5.2.0"
        },
        {
          "source": 1119074,
          "name": "webpack-dev-server",
          "dependency": "webpack-dev-server",
          "title": "webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins",
          "url": "https://github.com/advisories/GHSA-79cf-xcqc-c78w",
          "severity": "moderate",
          "cwe": [
            "CWE-749"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
          },
          "range": "<=5.2.3"
        },
        {
          "source": 1121087,
          "name": "webpack-dev-server",
          "dependency": "webpack-dev-server",
          "title": "webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies",
          "url": "https://github.com/advisories/GHSA-mx8g-39q3-5c79",
          "severity": "moderate",
          "cwe": [
            "CWE-346",
            "CWE-441"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<5.2.5"
        },
        {
          "source": 1123965,
          "name": "webpack-dev-server",
          "dependency": "webpack-dev-server",
          "title": "webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints",
          "url": "https://github.com/advisories/GHSA-f5vj-f2hx-8m93",
          "severity": "moderate",
          "cwe": [
            "CWE-352",
            "CWE-749"
          ],
          "cvss": {
            "score": 4.7,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L"
          },
          "range": "<=5.2.5"
        },
        {
          "source": 1123966,
          "name": "webpack-dev-server",
          "dependency": "webpack-dev-server",
          "title": "webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header",
          "url": "https://github.com/advisories/GHSA-m28w-2pqf-7qgj",
          "severity": "moderate",
          "cwe": [
            "CWE-20",
            "CWE-248"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<=5.2.5"
        },
        "sockjs",
        "webpack-dev-middleware"
      ],
      "effects": [],
      "range": "<=5.2.7",
      "nodes": [
        "node_modules/webpack-dev-server"
      ],
      "fixAvailable": true
    },
    "websocket-driver": {
      "name": "websocket-driver",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1123482,
          "name": "websocket-driver",
          "dependency": "websocket-driver",
          "title": "websocket-driver: Resource limit bypass via message compression",
          "url": "https://github.com/advisories/GHSA-mp7j-qc5w-4988",
          "severity": "moderate",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<0.7.5"
        },
        {
          "source": 1123483,
          "name": "websocket-driver",
          "dependency": "websocket-driver",
          "title": "websocket-driver: Message corruption via abuse of protocol length headers",
          "url": "https://github.com/advisories/GHSA-xv26-6w52-cph6",
          "severity": "critical",
          "cwe": [
            "CWE-130"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<0.7.5"
        }
      ],
      "effects": [],
      "range": "<=0.7.4",
      "nodes": [
        "node_modules/websocket-driver"
      ],
      "fixAvailable": true
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1119108,
          "name": "ws",
          "dependency": "ws",
          "title": "ws: Uninitialized memory disclosure",
          "url": "https://github.com/advisories/GHSA-58qx-3vcg-4xpx",
          "severity": "moderate",
          "cwe": [
            "CWE-908"
          ],
          "cvss": {
            "score": 4.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
          },
          "range": ">=8.0.0 <8.20.1"
        },
        {
          "source": 1123259,
          "name": "ws",
          "dependency": "ws",
          "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks",
          "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770",
            "CWE-1050"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=8.0.0 <8.21.0"
        },
        {
          "source": 1123260,
          "name": "ws",
          "dependency": "ws",
          "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks",
          "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770",
            "CWE-1050"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.0.0 <7.5.11"
        }
      ],
      "effects": [],
      "range": "7.0.0 - 7.5.10 || 8.0.0 - 8.20.1",
      "nodes": [
        "node_modules/jsdom/node_modules/ws",
        "node_modules/webpack-dev-server/node_modules/ws",
        "node_modules/ws"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 11,
      "moderate": 19,
      "high": 26,
      "critical": 7,
      "total": 63
    },
    "dependencies": {
      "prod": 108,
      "dev": 1115,
      "optional": 4,
      "peer": 0,
      "peerOptional": 0,
      "total": 1223
    }
  }
}