This run took 33 seconds.
$ date
--- stdout ---
Mon Apr 20 00:07:58 UTC 2026
--- end ---
$ git clone file:///srv/git/design-codex.git /src/repo --depth=1 -b main
--- stderr ---
Cloning into '/src/repo'...
--- stdout ---
--- end ---
$ git config user.name libraryupgrader
--- stdout ---
--- end ---
$ git config user.email tools.libraryupgrader@tools.wmflabs.org
--- stdout ---
--- end ---
$ git submodule update --init
--- stdout ---
--- end ---
$ grr init
--- stdout ---
Installed commit-msg hook.
--- end ---
$ git show-ref refs/heads/main
--- stdout ---
126c72b4877be24d6b48d388a29213b27b4f1f7f refs/heads/main
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@babel/helpers": {
"name": "@babel/helpers",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1104001,
"name": "@babel/helpers",
"dependency": "@babel/helpers",
"title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
"node_modules/@babel/helpers"
],
"fixAvailable": true
},
"@cypress/request": {
"name": "@cypress/request",
"severity": "low",
"isDirect": false,
"via": [
"qs"
],
"effects": [],
"range": "2.88.11 - 3.0.9",
"nodes": [
"node_modules/@cypress/request"
],
"fixAvailable": true
},
"@isaacs/brace-expansion": {
"name": "@isaacs/brace-expansion",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1112954,
"name": "@isaacs/brace-expansion",
"dependency": "@isaacs/brace-expansion",
"title": "@isaacs/brace-expansion has Uncontrolled Resource Consumption",
"url": "https://github.com/advisories/GHSA-7h2j-956f-4vf2",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=5.0.0"
}
],
"effects": [],
"range": "5.0.0",
"nodes": [
"node_modules/@isaacs/brace-expansion"
],
"fixAvailable": true
},
"@mapbox/node-pre-gyp": {
"name": "@mapbox/node-pre-gyp",
"severity": "high",
"isDirect": false,
"via": [
"tar"
],
"effects": [
"@vercel/nft"
],
"range": "<=1.0.11",
"nodes": [
"node_modules/netlify-cli/node_modules/@mapbox/node-pre-gyp"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@netlify/build": {
"name": "@netlify/build",
"severity": "moderate",
"isDirect": false,
"via": [
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it"
],
"effects": [
"netlify-cli"
],
"range": "0.0.24 - 0.0.26 || 9.1.0 - 11.17.0 || 11.37.2 - 12.1.2 || 29.20.8 - 32.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@netlify/edge-bundler": {
"name": "@netlify/edge-bundler",
"severity": "high",
"isDirect": false,
"via": [
"@vercel/nft",
"esbuild"
],
"effects": [
"@netlify/build",
"netlify-cli"
],
"range": "8.20.0 - 11.4.0 || 12.0.0 - 13.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@netlify/functions-utils": {
"name": "@netlify/functions-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"@netlify/zip-it-and-ship-it"
],
"effects": [],
"range": "1.3.14 - 1.3.29 || 1.3.41 || 5.2.24 - 5.3.16",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/functions-utils"
],
"fixAvailable": true
},
"@netlify/zip-it-and-ship-it": {
"name": "@netlify/zip-it-and-ship-it",
"severity": "high",
"isDirect": false,
"via": [
"@vercel/nft",
"esbuild"
],
"effects": [
"@netlify/build",
"@netlify/functions-utils",
"netlify-cli"
],
"range": "2.2.0 - 4.2.7 || 4.25.0 - 12.0.3",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/zip-it-and-ship-it"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@octokit/endpoint": {
"name": "@octokit/endpoint",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113209,
"name": "@octokit/endpoint",
"dependency": "@octokit/endpoint",
"title": "@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-x4c5-c7rf-jjgv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=9.0.5 <9.0.6"
}
],
"effects": [],
"range": "9.0.5",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/endpoint"
],
"fixAvailable": true
},
"@octokit/plugin-paginate-rest": {
"name": "@octokit/plugin-paginate-rest",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102899,
"name": "@octokit/plugin-paginate-rest",
"dependency": "@octokit/plugin-paginate-rest",
"title": "@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-h5c3-5r3r-rr8q",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=9.3.0-beta.1 <11.4.1"
}
],
"effects": [
"@octokit/rest"
],
"range": "9.3.0-beta.1 - 11.4.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/plugin-paginate-rest"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@octokit/request": {
"name": "@octokit/request",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1112248,
"name": "@octokit/request",
"dependency": "@octokit/request",
"title": "@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-rmvr-2pp2-xj38",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <8.4.1"
}
],
"effects": [],
"range": "<=8.4.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/request"
],
"fixAvailable": true
},
"@octokit/request-error": {
"name": "@octokit/request-error",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102256,
"name": "@octokit/request-error",
"dependency": "@octokit/request-error",
"title": "@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-xx4v-prfh-6cgc",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <5.1.1"
}
],
"effects": [],
"range": "<=5.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/request-error"
],
"fixAvailable": true
},
"@octokit/rest": {
"name": "@octokit/rest",
"severity": "moderate",
"isDirect": false,
"via": [
"@octokit/plugin-paginate-rest"
],
"effects": [
"netlify-cli"
],
"range": "20.1.1 || 21.0.0-beta.1 - 21.0.0-beta.4",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/rest"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@tootallnate/once": {
"name": "@tootallnate/once",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1113977,
"name": "@tootallnate/once",
"dependency": "@tootallnate/once",
"title": "@tootallnate/once vulnerable to Incorrect Control Flow Scoping",
"url": "https://github.com/advisories/GHSA-vpq2-c234-7xj6",
"severity": "low",
"cwe": [
"CWE-705"
],
"cvss": {
"score": 3.3,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<3.0.1"
}
],
"effects": [
"http-proxy-agent"
],
"range": "<3.0.1",
"nodes": [
"node_modules/@tootallnate/once"
],
"fixAvailable": {
"name": "jest-environment-jsdom",
"version": "30.3.0",
"isSemVerMajor": true
}
},
"@vercel/nft": {
"name": "@vercel/nft",
"severity": "high",
"isDirect": false,
"via": [
"@mapbox/node-pre-gyp"
],
"effects": [
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it"
],
"range": "0.12.0 - 0.27.7",
"nodes": [
"node_modules/netlify-cli/node_modules/@vercel/nft"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@xhmikosr/archive-type": {
"name": "@xhmikosr/archive-type",
"severity": "moderate",
"isDirect": false,
"via": [
"file-type"
],
"effects": [
"@xhmikosr/downloader"
],
"range": "6.0.0 - 7.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/archive-type"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@xhmikosr/decompress": {
"name": "@xhmikosr/decompress",
"severity": "moderate",
"isDirect": false,
"via": [
"@xhmikosr/decompress-tar",
"@xhmikosr/decompress-tarbz2",
"@xhmikosr/decompress-targz",
"@xhmikosr/decompress-unzip"
],
"effects": [],
"range": "8.0.0 - 10.2.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/decompress"
],
"fixAvailable": true
},
"@xhmikosr/decompress-tar": {
"name": "@xhmikosr/decompress-tar",
"severity": "moderate",
"isDirect": false,
"via": [
"file-type"
],
"effects": [
"@xhmikosr/decompress-tarbz2",
"@xhmikosr/decompress-targz"
],
"range": "6.0.0 - 8.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/decompress-tar"
],
"fixAvailable": true
},
"@xhmikosr/decompress-tarbz2": {
"name": "@xhmikosr/decompress-tarbz2",
"severity": "moderate",
"isDirect": false,
"via": [
"@xhmikosr/decompress-tar",
"file-type"
],
"effects": [
"@xhmikosr/decompress"
],
"range": "6.0.0 - 9.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/decompress-tarbz2"
],
"fixAvailable": true
},
"@xhmikosr/decompress-targz": {
"name": "@xhmikosr/decompress-targz",
"severity": "moderate",
"isDirect": false,
"via": [
"@xhmikosr/decompress-tar",
"file-type"
],
"effects": [],
"range": "6.0.0 - 9.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/decompress-targz"
],
"fixAvailable": true
},
"@xhmikosr/decompress-unzip": {
"name": "@xhmikosr/decompress-unzip",
"severity": "moderate",
"isDirect": false,
"via": [
"file-type"
],
"effects": [],
"range": "6.0.0 - 7.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/decompress-unzip"
],
"fixAvailable": true
},
"@xhmikosr/downloader": {
"name": "@xhmikosr/downloader",
"severity": "moderate",
"isDirect": false,
"via": [
"@xhmikosr/archive-type",
"@xhmikosr/decompress",
"file-type"
],
"effects": [
"gh-release-fetch"
],
"range": "10.0.0 - 10.0.1 || 12.0.0 - 15.2.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/downloader"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"ajv": {
"name": "ajv",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113714,
"name": "ajv",
"dependency": "ajv",
"title": "ajv has ReDoS when using `$data` option",
"url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<6.14.0"
},
{
"source": 1113715,
"name": "ajv",
"dependency": "ajv",
"title": "ajv has ReDoS when using `$data` option",
"url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0-alpha.0 <8.18.0"
}
],
"effects": [],
"range": "<6.14.0 || >=7.0.0-alpha.0 <8.18.0",
"nodes": [
"node_modules/ajv",
"node_modules/netlify-cli/node_modules/@fastify/ajv-compiler/node_modules/ajv",
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler/node_modules/ajv",
"node_modules/netlify-cli/node_modules/@netlify/framework-info/node_modules/ajv",
"node_modules/netlify-cli/node_modules/ajv",
"node_modules/netlify-cli/node_modules/ajv-formats/node_modules/ajv",
"node_modules/netlify-cli/node_modules/fast-json-stringify/node_modules/ajv",
"node_modules/table/node_modules/ajv"
],
"fixAvailable": true
},
"axios": {
"name": "axios",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097679,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=0.8.1 <0.28.0"
},
{
"source": 1111034,
"name": "axios",
"dependency": "axios",
"title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL",
"url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6",
"severity": "high",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.30.0"
},
{
"source": 1113274,
"name": "axios",
"dependency": "axios",
"title": "Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig",
"url": "https://github.com/advisories/GHSA-43fc-jf86-j433",
"severity": "high",
"cwe": [
"CWE-754"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<=0.30.2"
},
{
"source": 1116672,
"name": "axios",
"dependency": "axios",
"title": "Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"url": "https://github.com/advisories/GHSA-3p68-rc4w-qgx5",
"severity": "moderate",
"cwe": [
"CWE-441",
"CWE-918"
],
"cvss": {
"score": 4.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<0.31.0"
},
{
"source": 1116674,
"name": "axios",
"dependency": "axios",
"title": "Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain",
"url": "https://github.com/advisories/GHSA-fvcv-3m26-pcqx",
"severity": "moderate",
"cwe": [
"CWE-113",
"CWE-444",
"CWE-918"
],
"cvss": {
"score": 4.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<0.31.0"
}
],
"effects": [
"wait-on"
],
"range": "<=0.30.3",
"nodes": [
"node_modules/wait-on/node_modules/axios"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "3.0.2",
"isSemVerMajor": true
}
},
"body-parser": {
"name": "body-parser",
"severity": "low",
"isDirect": false,
"via": [
"qs"
],
"effects": [
"express"
],
"range": "1.19.0 - 1.20.3 || 2.0.0-beta.1 - 2.0.2",
"nodes": [
"node_modules/netlify-cli/node_modules/body-parser"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1105443,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <=1.1.11"
},
{
"source": 1105444,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0 <=2.0.1"
},
{
"source": 1115540,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<1.1.13"
},
{
"source": 1115541,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.3"
}
],
"effects": [],
"range": "<=1.1.12 || 2.0.0 - 2.0.2",
"nodes": [
"node_modules/@bundled-es-modules/glob/node_modules/brace-expansion",
"node_modules/brace-expansion",
"node_modules/editorconfig/node_modules/brace-expansion",
"node_modules/filelist/node_modules/brace-expansion",
"node_modules/js-beautify/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/@fastify/static/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/@netlify/build-info/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/@netlify/build/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/@netlify/zip-it-and-ship-it/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/archiver-utils/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/readdir-glob/node_modules/brace-expansion",
"packages/codex-design-tokens/node_modules/brace-expansion",
"packages/codex-icons/node_modules/brace-expansion"
],
"fixAvailable": true
},
"defu": {
"name": "defu",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1116102,
"name": "defu",
"dependency": "defu",
"title": "defu: Prototype pollution via `__proto__` key in defaults argument",
"url": "https://github.com/advisories/GHSA-737v-mqg7-c878",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<=6.1.4"
}
],
"effects": [],
"range": "<=6.1.4",
"nodes": [
"node_modules/netlify-cli/node_modules/defu"
],
"fixAvailable": true
},
"diff": {
"name": "diff",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1112704,
"name": "diff",
"dependency": "diff",
"title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
"severity": "low",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "4.0.0 - 4.0.3",
"nodes": [
"node_modules/netlify-cli/node_modules/ts-node/node_modules/diff"
],
"fixAvailable": true
},
"editorconfig": {
"name": "editorconfig",
"severity": "high",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [],
"range": "1.0.3 - 1.0.4 || 2.0.0",
"nodes": [
"node_modules/editorconfig"
],
"fixAvailable": true
},
"esbuild": {
"name": "esbuild",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102341,
"name": "esbuild",
"dependency": "esbuild",
"title": "esbuild enables any website to send any requests to the development server and read the response",
"url": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
"severity": "moderate",
"cwe": [
"CWE-346"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": "<=0.24.2"
}
],
"effects": [
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it",
"tsx",
"vite"
],
"range": "<=0.24.2",
"nodes": [
"node_modules/esbuild",
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler/node_modules/esbuild",
"node_modules/netlify-cli/node_modules/esbuild",
"node_modules/vite/node_modules/esbuild",
"node_modules/vitepress/node_modules/esbuild"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"express": {
"name": "express",
"severity": "high",
"isDirect": false,
"via": [
"body-parser",
"path-to-regexp",
"qs"
],
"effects": [
"netlify-cli"
],
"range": "4.0.0-rc1 - 4.21.2 || 5.0.0-alpha.1 - 5.0.1",
"nodes": [
"node_modules/netlify-cli/node_modules/express"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"external-editor": {
"name": "external-editor",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [
"inquirer"
],
"range": ">=1.1.1",
"nodes": [
"node_modules/netlify-cli/node_modules/external-editor"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"fastify": {
"name": "fastify",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1112876,
"name": "fastify",
"dependency": "fastify",
"title": "Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream",
"url": "https://github.com/advisories/GHSA-mrq3-vjjr-p77c",
"severity": "low",
"cwe": [
"CWE-770"
],
"cvss": {
"score": 3.7,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<=5.7.2"
},
{
"source": 1112877,
"name": "fastify",
"dependency": "fastify",
"title": "Fastify's Content-Type header tab character allows body validation bypass",
"url": "https://github.com/advisories/GHSA-jx2c-rxcm-jvmq",
"severity": "high",
"cwe": [
"CWE-436"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<5.7.2"
},
{
"source": 1115367,
"name": "fastify",
"dependency": "fastify",
"title": "fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections",
"url": "https://github.com/advisories/GHSA-444r-cwp2-x5xf",
"severity": "moderate",
"cwe": [
"CWE-348"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
},
"range": "<=5.8.2"
}
],
"effects": [
"netlify-cli"
],
"range": "<=5.8.2",
"nodes": [
"node_modules/netlify-cli/node_modules/fastify"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"file-type": {
"name": "file-type",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1114301,
"name": "file-type",
"dependency": "file-type",
"title": "file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
"url": "https://github.com/advisories/GHSA-5v7r-6r5c-r473",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=13.0.0 <21.3.1"
}
],
"effects": [
"@xhmikosr/archive-type",
"@xhmikosr/decompress-tar",
"@xhmikosr/decompress-tarbz2",
"@xhmikosr/decompress-targz",
"@xhmikosr/decompress-unzip",
"@xhmikosr/downloader"
],
"range": "13.0.0 - 21.3.0",
"nodes": [
"node_modules/netlify-cli/node_modules/file-type"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"follow-redirects": {
"name": "follow-redirects",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1116560,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"url": "https://github.com/advisories/GHSA-r4q5-vmmm-2653",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=1.15.11"
}
],
"effects": [],
"range": "<=1.15.11",
"nodes": [
"node_modules/follow-redirects",
"node_modules/netlify-cli/node_modules/follow-redirects"
],
"fixAvailable": true
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1109538,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "4.0.0 - 4.0.3",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": true
},
"gh-release-fetch": {
"name": "gh-release-fetch",
"severity": "moderate",
"isDirect": false,
"via": [
"@xhmikosr/downloader"
],
"effects": [
"netlify-cli"
],
"range": ">=4.0.2",
"nodes": [
"node_modules/netlify-cli/node_modules/gh-release-fetch"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"glob": {
"name": "glob",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1109842,
"name": "glob",
"dependency": "glob",
"title": "glob CLI: Command injection via -c/--cmd executes matches with shell:true",
"url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2",
"severity": "high",
"cwe": [
"CWE-78"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=10.2.0 <10.5.0"
},
{
"source": 1109843,
"name": "glob",
"dependency": "glob",
"title": "glob CLI: Command injection via -c/--cmd executes matches with shell:true",
"url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2",
"severity": "high",
"cwe": [
"CWE-78"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=11.0.0 <11.1.0"
}
],
"effects": [],
"range": "10.2.0 - 10.4.5 || 11.0.0 - 11.0.3",
"nodes": [
"node_modules/@bundled-es-modules/glob/node_modules/glob",
"node_modules/js-beautify/node_modules/glob",
"node_modules/netlify-cli/node_modules/@fastify/static/node_modules/glob",
"node_modules/netlify-cli/node_modules/archiver-utils/node_modules/glob",
"node_modules/svglint/node_modules/glob",
"packages/codex-design-tokens/node_modules/glob",
"packages/codex-docs/node_modules/glob",
"packages/codex-icons/node_modules/glob"
],
"fixAvailable": {
"name": "glob",
"version": "11.1.0",
"isSemVerMajor": false
}
},
"h3": {
"name": "h3",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1114875,
"name": "h3",
"dependency": "h3",
"title": "h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read",
"url": "https://github.com/advisories/GHSA-wr4h-v87w-p3r7",
"severity": "moderate",
"cwe": [
"CWE-22",
"CWE-116"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<1.15.6"
},
{
"source": 1115114,
"name": "h3",
"dependency": "h3",
"title": "h3: SSE Event Injection via Unsanitized Carriage Return (`\\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)",
"url": "https://github.com/advisories/GHSA-4hxc-9384-m385",
"severity": "moderate",
"cwe": [
"CWE-74"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<1.15.9"
},
{
"source": 1115117,
"name": "h3",
"dependency": "h3",
"title": "h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`",
"url": "https://github.com/advisories/GHSA-72gr-qfp7-vwhw",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=1.15.8"
},
{
"source": 1115161,
"name": "h3",
"dependency": "h3",
"title": "h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields",
"url": "https://github.com/advisories/GHSA-22cc-p3c6-wpvm",
"severity": "high",
"cwe": [
"CWE-93"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N"
},
"range": "<1.15.6"
},
{
"source": 1116543,
"name": "h3",
"dependency": "h3",
"title": "h3 v1 has Request Smuggling (TE.TE) issue",
"url": "https://github.com/advisories/GHSA-mp2g-9vg9-f4cg",
"severity": "high",
"cwe": [
"CWE-444"
],
"cvss": {
"score": 8.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L"
},
"range": "<=1.15.4"
}
],
"effects": [],
"range": "<=1.15.8",
"nodes": [
"node_modules/netlify-cli/node_modules/h3"
],
"fixAvailable": true
},
"http-proxy-agent": {
"name": "http-proxy-agent",
"severity": "low",
"isDirect": false,
"via": [
"@tootallnate/once"
],
"effects": [
"jsdom"
],
"range": "4.0.1 - 5.0.0",
"nodes": [
"node_modules/http-proxy-agent"
],
"fixAvailable": {
"name": "jest-environment-jsdom",
"version": "30.3.0",
"isSemVerMajor": true
}
},
"http-proxy-middleware": {
"name": "http-proxy-middleware",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1104105,
"name": "http-proxy-middleware",
"dependency": "http-proxy-middleware",
"title": "http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed",
"url": "https://github.com/advisories/GHSA-9gqv-wp59-fq42",
"severity": "moderate",
"cwe": [
"CWE-754"
],
"cvss": {
"score": 4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
},
"range": ">=1.3.0 <2.0.9"
},
{
"source": 1104106,
"name": "http-proxy-middleware",
"dependency": "http-proxy-middleware",
"title": "http-proxy-middleware can call writeBody twice because \"else if\" is not used",
"url": "https://github.com/advisories/GHSA-4www-5p9h-95mh",
"severity": "moderate",
"cwe": [
"CWE-670"
],
"cvss": {
"score": 4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
},
"range": ">=1.3.0 <2.0.8"
}
],
"effects": [
"netlify-cli"
],
"range": "1.3.0 - 2.0.8",
"nodes": [
"node_modules/netlify-cli/node_modules/http-proxy-middleware"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"inquirer": {
"name": "inquirer",
"severity": "low",
"isDirect": false,
"via": [
"external-editor"
],
"effects": [
"netlify-cli",
"tabtab"
],
"range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
"nodes": [
"node_modules/netlify-cli/node_modules/inquirer"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"ipx": {
"name": "ipx",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1106842,
"name": "ipx",
"dependency": "ipx",
"title": "IPX Allows Path Traversal via Prefix Matching Bypass",
"url": "https://github.com/advisories/GHSA-mm3p-j368-7jcr",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0-0 <2.1.1"
}
],
"effects": [
"netlify-cli"
],
"range": "2.0.0-0 - 2.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/ipx"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"jest-environment-jsdom": {
"name": "jest-environment-jsdom",
"severity": "low",
"isDirect": true,
"via": [
"jsdom"
],
"effects": [],
"range": "27.0.1 - 30.0.0-rc.1",
"nodes": [
"node_modules/jest-environment-jsdom"
],
"fixAvailable": {
"name": "jest-environment-jsdom",
"version": "30.3.0",
"isSemVerMajor": true
}
},
"js-yaml": {
"name": "js-yaml",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1112714,
"name": "js-yaml",
"dependency": "js-yaml",
"title": "js-yaml has prototype pollution in merge (<<)",
"url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.14.2"
},
{
"source": 1112715,
"name": "js-yaml",
"dependency": "js-yaml",
"title": "js-yaml has prototype pollution in merge (<<)",
"url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=4.0.0 <4.1.1"
}
],
"effects": [
"netlify-cli"
],
"range": "<3.14.2 || >=4.0.0 <4.1.1",
"nodes": [
"node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml",
"node_modules/js-yaml",
"node_modules/netlify-cli/node_modules/js-yaml"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"jsdom": {
"name": "jsdom",
"severity": "low",
"isDirect": false,
"via": [
"http-proxy-agent"
],
"effects": [
"jest-environment-jsdom"
],
"range": "16.6.0 - 22.1.0",
"nodes": [
"node_modules/jsdom"
],
"fixAvailable": {
"name": "jest-environment-jsdom",
"version": "30.3.0",
"isSemVerMajor": true
}
},
"jws": {
"name": "jws",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1111244,
"name": "jws",
"dependency": "jws",
"title": "auth0/node-jws Improperly Verifies HMAC Signature",
"url": "https://github.com/advisories/GHSA-869p-cjfg-cm3x",
"severity": "high",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<3.2.3"
}
],
"effects": [],
"range": "<3.2.3",
"nodes": [
"node_modules/netlify-cli/node_modules/jws"
],
"fixAvailable": true
},
"lodash": {
"name": "lodash",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1112455,
"name": "lodash",
"dependency": "lodash",
"title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
"url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": ">=4.0.0 <=4.17.22"
},
{
"source": 1115806,
"name": "lodash",
"dependency": "lodash",
"title": "lodash vulnerable to Code Injection via `_.template` imports key names",
"url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc",
"severity": "high",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=4.0.0 <=4.17.23"
},
{
"source": 1115810,
"name": "lodash",
"dependency": "lodash",
"title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
"url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<=4.17.23"
}
],
"effects": [
"netlify-cli"
],
"range": "<=4.17.23",
"nodes": [
"node_modules/lodash",
"node_modules/netlify-cli/node_modules/lodash"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"lodash-es": {
"name": "lodash-es",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1112453,
"name": "lodash-es",
"dependency": "lodash-es",
"title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
"url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": ">=4.0.0 <=4.17.22"
},
{
"source": 1115805,
"name": "lodash-es",
"dependency": "lodash-es",
"title": "lodash vulnerable to Code Injection via `_.template` imports key names",
"url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc",
"severity": "high",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=4.0.0 <=4.17.23"
},
{
"source": 1115809,
"name": "lodash-es",
"dependency": "lodash-es",
"title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
"url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<=4.17.23"
}
],
"effects": [],
"range": "<=4.17.23",
"nodes": [
"node_modules/netlify-cli/node_modules/lodash-es"
],
"fixAvailable": true
},
"mdast-util-to-hast": {
"name": "mdast-util-to-hast",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113048,
"name": "mdast-util-to-hast",
"dependency": "mdast-util-to-hast",
"title": "mdast-util-to-hast has unsanitized class attribute",
"url": "https://github.com/advisories/GHSA-4fh9-h7wg-q85m",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-915"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=13.0.0 <13.2.1"
}
],
"effects": [],
"range": "13.0.0 - 13.2.0",
"nodes": [
"node_modules/mdast-util-to-hast"
],
"fixAvailable": true
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113459,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.3"
},
{
"source": 1113461,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=5.0.0 <5.1.7"
},
{
"source": 1113465,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=9.0.0 <9.0.6"
},
{
"source": 1113466,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=10.0.0 <10.2.1"
},
{
"source": 1113538,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1113540,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=5.0.0 <5.1.8"
},
{
"source": 1113544,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=9.0.0 <9.0.7"
},
{
"source": 1113545,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=10.0.0 <10.2.3"
},
{
"source": 1113546,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.4"
},
{
"source": 1113548,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=5.0.0 <5.1.8"
},
{
"source": 1113552,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=9.0.0 <9.0.7"
},
{
"source": 1113553,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=10.0.0 <10.2.3"
}
],
"effects": [
"editorconfig"
],
"range": "<=3.1.3 || 5.0.0 - 5.1.7 || 9.0.0 - 9.0.6 || 10.0.0 - 10.2.2",
"nodes": [
"node_modules/@bundled-es-modules/glob/node_modules/minimatch",
"node_modules/@vue/language-core/node_modules/minimatch",
"node_modules/editorconfig/node_modules/minimatch",
"node_modules/filelist/node_modules/minimatch",
"node_modules/js-beautify/node_modules/minimatch",
"node_modules/minimatch",
"node_modules/netlify-cli/node_modules/@fastify/static/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/@netlify/build-info/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/@netlify/build/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/@netlify/zip-it-and-ship-it/node_modules/glob/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/@netlify/zip-it-and-ship-it/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/archiver-utils/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/readdir-glob/node_modules/minimatch",
"node_modules/svglint/node_modules/minimatch",
"packages/codex-design-tokens/node_modules/minimatch",
"packages/codex-icons/node_modules/minimatch"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "high",
"isDirect": true,
"via": [
"@netlify/build",
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it",
"@octokit/rest",
"express",
"fastify",
"gh-release-fetch",
"http-proxy-middleware",
"inquirer",
"ipx",
"js-yaml",
"lodash",
"tabtab"
],
"effects": [],
"range": "2.0.0-alpha.1 - 24.2.0",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"node-forge": {
"name": "node-forge",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1110996,
"name": "node-forge",
"dependency": "node-forge",
"title": "node-forge has ASN.1 Unbounded Recursion",
"url": "https://github.com/advisories/GHSA-554w-wpv2-vw27",
"severity": "high",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.3.2"
},
{
"source": 1110998,
"name": "node-forge",
"dependency": "node-forge",
"title": "node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization",
"url": "https://github.com/advisories/GHSA-5gfm-wpxj-wjgq",
"severity": "high",
"cwe": [
"CWE-436"
],
"cvss": {
"score": 8.6,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
},
"range": "<1.3.2"
},
{
"source": 1111068,
"name": "node-forge",
"dependency": "node-forge",
"title": "node-forge is vulnerable to ASN.1 OID Integer Truncation",
"url": "https://github.com/advisories/GHSA-65ch-62r8-g69g",
"severity": "moderate",
"cwe": [
"CWE-190"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.3.2"
},
{
"source": 1115545,
"name": "node-forge",
"dependency": "node-forge",
"title": "Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)",
"url": "https://github.com/advisories/GHSA-2328-f5f3-gj25",
"severity": "high",
"cwe": [
"CWE-295"
],
"cvss": {
"score": 7.4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
"range": "<=1.3.3"
},
{
"source": 1115546,
"name": "node-forge",
"dependency": "node-forge",
"title": "Forge has signature forgery in Ed25519 due to missing S > L check",
"url": "https://github.com/advisories/GHSA-q67f-28xg-22rw",
"severity": "high",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<1.4.0"
},
{
"source": 1115548,
"name": "node-forge",
"dependency": "node-forge",
"title": "Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input",
"url": "https://github.com/advisories/GHSA-5m6q-g25r-mvwx",
"severity": "high",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<1.4.0"
},
{
"source": 1115612,
"name": "node-forge",
"dependency": "node-forge",
"title": "Forge has signature forgery in RSA-PKCS due to ASN.1 extra field ",
"url": "https://github.com/advisories/GHSA-ppp5-5v6c-4jwp",
"severity": "high",
"cwe": [
"CWE-20",
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<1.4.0"
}
],
"effects": [],
"range": "<=1.3.3",
"nodes": [
"node_modules/netlify-cli/node_modules/node-forge"
],
"fixAvailable": true
},
"on-headers": {
"name": "on-headers",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1106812,
"name": "on-headers",
"dependency": "on-headers",
"title": "on-headers is vulnerable to http response header manipulation",
"url": "https://github.com/advisories/GHSA-76c9-3jph-rj3q",
"severity": "low",
"cwe": [
"CWE-241"
],
"cvss": {
"score": 3.4,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<1.1.0"
}
],
"effects": [],
"range": "<1.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/on-headers"
],
"fixAvailable": true
},
"patch-package": {
"name": "patch-package",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [],
"range": "<=8.0.0 || >=8.1.0-canary",
"nodes": [
"node_modules/patch-package"
],
"fixAvailable": true
},
"path-to-regexp": {
"name": "path-to-regexp",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115527,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
"url": "https://github.com/advisories/GHSA-37ch-88jc-xwx2",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.1.13"
}
],
"effects": [
"express"
],
"range": "<0.1.13",
"nodes": [
"node_modules/netlify-cli/node_modules/express/node_modules/path-to-regexp"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"picomatch": {
"name": "picomatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115549,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<2.3.2"
},
{
"source": 1115551,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=4.0.0 <4.0.4"
},
{
"source": 1115552,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<2.3.2"
},
{
"source": 1115554,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "<=2.3.1 || 4.0.0 - 4.0.3",
"nodes": [
"node_modules/@rollup/pluginutils/node_modules/picomatch",
"node_modules/@stylistic/eslint-plugin/node_modules/picomatch",
"node_modules/netlify-cli/node_modules/@rollup/pluginutils/node_modules/picomatch",
"node_modules/netlify-cli/node_modules/picomatch",
"node_modules/picomatch",
"packages/codex-docs/node_modules/picomatch",
"packages/codex-icons/node_modules/picomatch",
"packages/codex/node_modules/picomatch"
],
"fixAvailable": true
},
"preact": {
"name": "preact",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1111984,
"name": "preact",
"dependency": "preact",
"title": "Preact has JSON VNode Injection issue",
"url": "https://github.com/advisories/GHSA-36hm-qxxp-pg3m",
"severity": "high",
"cwe": [
"CWE-843"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=10.26.5 <10.26.10"
}
],
"effects": [],
"range": "10.26.5 - 10.26.9",
"nodes": [
"node_modules/preact"
],
"fixAvailable": true
},
"prismjs": {
"name": "prismjs",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1105770,
"name": "prismjs",
"dependency": "prismjs",
"title": "PrismJS DOM Clobbering vulnerability",
"url": "https://github.com/advisories/GHSA-x7hr-w5r2-h6wg",
"severity": "moderate",
"cwe": [
"CWE-79",
"CWE-94"
],
"cvss": {
"score": 4.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
},
"range": "<1.30.0"
}
],
"effects": [],
"range": "<1.30.0",
"nodes": [
"node_modules/prismjs"
],
"fixAvailable": {
"name": "prismjs",
"version": "1.30.0",
"isSemVerMajor": false
}
},
"qs": {
"name": "qs",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113161,
"name": "qs",
"dependency": "qs",
"title": "qs's arrayLimit bypass in comma parsing allows denial of service",
"url": "https://github.com/advisories/GHSA-w7fw-mjwx-w883",
"severity": "low",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 3.7,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=6.7.0 <=6.14.1"
},
{
"source": 1113719,
"name": "qs",
"dependency": "qs",
"title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
"url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
"severity": "moderate",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 3.7,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<6.14.1"
}
],
"effects": [
"@cypress/request",
"body-parser",
"express"
],
"range": "<=6.14.1",
"nodes": [
"node_modules/netlify-cli/node_modules/qs",
"node_modules/qs"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"rollup": {
"name": "rollup",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113515,
"name": "rollup",
"dependency": "rollup",
"title": "Rollup 4 has Arbitrary File Write via Path Traversal",
"url": "https://github.com/advisories/GHSA-mw96-cpmx-2vgc",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=4.0.0 <4.59.0"
}
],
"effects": [],
"range": "4.0.0 - 4.58.0",
"nodes": [
"node_modules/netlify-cli/node_modules/rollup",
"node_modules/rollup"
],
"fixAvailable": true
},
"start-server-and-test": {
"name": "start-server-and-test",
"severity": "high",
"isDirect": true,
"via": [
"wait-on"
],
"effects": [],
"range": "1.11.1 - 2.0.2",
"nodes": [
"node_modules/start-server-and-test"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "3.0.2",
"isSemVerMajor": true
}
},
"svgo": {
"name": "svgo",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1114151,
"name": "svgo",
"dependency": "svgo",
"title": "SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)",
"url": "https://github.com/advisories/GHSA-xpqw-6gx7-v673",
"severity": "high",
"cwe": [
"CWE-776"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=3.0.0 <3.3.3"
}
],
"effects": [],
"range": "3.0.0 - 3.3.2",
"nodes": [
"node_modules/netlify-cli/node_modules/svgo"
],
"fixAvailable": true
},
"tabtab": {
"name": "tabtab",
"severity": "low",
"isDirect": false,
"via": [
"inquirer"
],
"effects": [
"netlify-cli"
],
"range": ">=3.0.0-beta",
"nodes": [
"node_modules/netlify-cli/node_modules/tabtab"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"tar": {
"name": "tar",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1112659,
"name": "tar",
"dependency": "tar",
"title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
"url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
},
"range": "<7.5.7"
},
{
"source": 1113300,
"name": "tar",
"dependency": "tar",
"title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization",
"url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.2"
},
{
"source": 1113375,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction",
"url": "https://github.com/advisories/GHSA-83g3-92jg-28cx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
"range": "<7.5.8"
},
{
"source": 1114200,
"name": "tar",
"dependency": "tar",
"title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.9"
},
{
"source": 1114302,
"name": "tar",
"dependency": "tar",
"title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.10"
},
{
"source": 1114680,
"name": "tar",
"dependency": "tar",
"title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS",
"url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w",
"severity": "high",
"cwe": [
"CWE-176",
"CWE-367"
],
"cvss": {
"score": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
},
"range": "<=7.5.3"
}
],
"effects": [
"@mapbox/node-pre-gyp"
],
"range": "<=7.5.10",
"nodes": [
"node_modules/netlify-cli/node_modules/tar"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1109532,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.4"
},
{
"source": 1109534,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.1.1"
},
{
"source": 1109542,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs can extract outside the specified dir with a specific tarball",
"url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.0.9"
},
{
"source": 1109543,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs can extract outside the specified dir with a specific tarball",
"url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.3"
},
{
"source": 1109551,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
"url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=3.0.0 <3.0.7"
},
{
"source": 1109552,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
"url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=2.0.0 <2.1.2"
}
],
"effects": [],
"range": "2.0.0 - 2.1.3 || 3.0.0 - 3.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/prebuild-install/node_modules/tar-fs",
"node_modules/netlify-cli/node_modules/tar-fs"
],
"fixAvailable": true
},
"tmp": {
"name": "tmp",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1109537,
"name": "tmp",
"dependency": "tmp",
"title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
"severity": "low",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 2.5,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<=0.2.3"
}
],
"effects": [
"external-editor",
"patch-package"
],
"range": "<=0.2.3",
"nodes": [
"node_modules/netlify-cli/node_modules/tmp",
"node_modules/netlify-cli/node_modules/tmp-promise/node_modules/tmp",
"node_modules/patch-package/node_modules/tmp",
"node_modules/tmp"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"tsx": {
"name": "tsx",
"severity": "moderate",
"isDirect": true,
"via": [
"esbuild"
],
"effects": [],
"range": "3.13.0 - 4.19.2",
"nodes": [
"node_modules/tsx"
],
"fixAvailable": {
"name": "tsx",
"version": "4.21.0",
"isSemVerMajor": false
}
},
"undici": {
"name": "undici",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101609,
"name": "undici",
"dependency": "undici",
"title": "Use of Insufficiently Random Values in undici",
"url": "https://github.com/advisories/GHSA-c76h-2ccp-4975",
"severity": "moderate",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 6.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
"range": ">=6.0.0 <6.21.1"
},
{
"source": 1112496,
"name": "undici",
"dependency": "undici",
"title": "Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
"url": "https://github.com/advisories/GHSA-g9mf-h72j-4rw9",
"severity": "moderate",
"cwe": [
"CWE-770"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.23.0"
},
{
"source": 1113068,
"name": "undici",
"dependency": "undici",
"title": "undici Denial of Service attack via bad certificate data",
"url": "https://github.com/advisories/GHSA-cxrh-j4jr-qwg3",
"severity": "low",
"cwe": [
"CWE-401"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=6.0.0 <6.21.2"
},
{
"source": 1114592,
"name": "undici",
"dependency": "undici",
"title": "Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
"url": "https://github.com/advisories/GHSA-f269-vfmq-vjvj",
"severity": "high",
"cwe": [
"CWE-248",
"CWE-1284"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.0.0 <6.24.0"
},
{
"source": 1114594,
"name": "undici",
"dependency": "undici",
"title": "Undici has an HTTP Request/Response Smuggling issue",
"url": "https://github.com/advisories/GHSA-2mjp-6q6p-2qxm",
"severity": "moderate",
"cwe": [
"CWE-444"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<6.24.0"
},
{
"source": 1114638,
"name": "undici",
"dependency": "undici",
"title": "Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression",
"url": "https://github.com/advisories/GHSA-vrm6-8vpv-qv8q",
"severity": "high",
"cwe": [
"CWE-409"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.24.0"
},
{
"source": 1114640,
"name": "undici",
"dependency": "undici",
"title": "Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation",
"url": "https://github.com/advisories/GHSA-v9p9-hfj2-hcw8",
"severity": "high",
"cwe": [
"CWE-248"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.24.0"
},
{
"source": 1114642,
"name": "undici",
"dependency": "undici",
"title": "Undici has CRLF Injection in undici via `upgrade` option",
"url": "https://github.com/advisories/GHSA-4992-7rv2-5pvq",
"severity": "moderate",
"cwe": [
"CWE-93"
],
"cvss": {
"score": 4.6,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
},
"range": "<6.24.0"
}
],
"effects": [],
"range": "<=6.23.0",
"nodes": [
"node_modules/undici"
],
"fixAvailable": true
},
"vite": {
"name": "vite",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1102438,
"name": "vite",
"dependency": "vite",
"title": "Websites were able to send any requests to the development server and read the response in vite",
"url": "https://github.com/advisories/GHSA-vg6x-rcgg-rjx6",
"severity": "moderate",
"cwe": [
"CWE-346",
"CWE-350",
"CWE-1385"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <=6.0.8"
},
{
"source": 1103518,
"name": "vite",
"dependency": "vite",
"title": "Vite bypasses server.fs.deny when using ?raw??",
"url": "https://github.com/advisories/GHSA-x574-m823-4x7w",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <6.0.12"
},
{
"source": 1103885,
"name": "vite",
"dependency": "vite",
"title": "Vite has an `server.fs.deny` bypass with an invalid `request-target`",
"url": "https://github.com/advisories/GHSA-356w-63v5-8wf4",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <6.0.15"
},
{
"source": 1104174,
"name": "vite",
"dependency": "vite",
"title": "Vite's server.fs.deny bypassed with /. for files under project root",
"url": "https://github.com/advisories/GHSA-859w-5945-r5v3",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <=6.1.5"
},
{
"source": 1104203,
"name": "vite",
"dependency": "vite",
"title": "Vite allows server.fs.deny to be bypassed with .svg or relative paths",
"url": "https://github.com/advisories/GHSA-xcj6-pq6g-qj4x",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <6.0.14"
},
{
"source": 1107323,
"name": "vite",
"dependency": "vite",
"title": "Vite middleware may serve files starting with the same name with the public directory",
"url": "https://github.com/advisories/GHSA-g4jq-h2w9-997c",
"severity": "low",
"cwe": [
"CWE-22",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=5.4.19"
},
{
"source": 1107324,
"name": "vite",
"dependency": "vite",
"title": "Vite middleware may serve files starting with the same name with the public directory",
"url": "https://github.com/advisories/GHSA-g4jq-h2w9-997c",
"severity": "low",
"cwe": [
"CWE-22",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <=6.3.5"
},
{
"source": 1107325,
"name": "vite",
"dependency": "vite",
"title": "Vite middleware may serve files starting with the same name with the public directory",
"url": "https://github.com/advisories/GHSA-g4jq-h2w9-997c",
"severity": "low",
"cwe": [
"CWE-22",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0 <=7.0.6"
},
{
"source": 1107327,
"name": "vite",
"dependency": "vite",
"title": "Vite's `server.fs` settings were not applied to HTML files",
"url": "https://github.com/advisories/GHSA-jqfw-vq24-v9c3",
"severity": "low",
"cwe": [
"CWE-23",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=5.4.19"
},
{
"source": 1107328,
"name": "vite",
"dependency": "vite",
"title": "Vite's `server.fs` settings were not applied to HTML files",
"url": "https://github.com/advisories/GHSA-jqfw-vq24-v9c3",
"severity": "low",
"cwe": [
"CWE-23",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <=6.3.5"
},
{
"source": 1107329,
"name": "vite",
"dependency": "vite",
"title": "Vite's `server.fs` settings were not applied to HTML files",
"url": "https://github.com/advisories/GHSA-jqfw-vq24-v9c3",
"severity": "low",
"cwe": [
"CWE-23",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0 <=7.0.6"
},
{
"source": 1109131,
"name": "vite",
"dependency": "vite",
"title": "vite allows server.fs.deny bypass via backslash on Windows",
"url": "https://github.com/advisories/GHSA-93m4-6634-74q7",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=5.2.6 <=5.4.20"
},
{
"source": 1109135,
"name": "vite",
"dependency": "vite",
"title": "vite allows server.fs.deny bypass via backslash on Windows",
"url": "https://github.com/advisories/GHSA-93m4-6634-74q7",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <=6.4.0"
},
{
"source": 1109136,
"name": "vite",
"dependency": "vite",
"title": "vite allows server.fs.deny bypass via backslash on Windows",
"url": "https://github.com/advisories/GHSA-93m4-6634-74q7",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0 <=7.0.7"
},
{
"source": 1112512,
"name": "vite",
"dependency": "vite",
"title": "Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query",
"url": "https://github.com/advisories/GHSA-4r4m-qw57-chr8",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <6.0.13"
},
{
"source": 1116229,
"name": "vite",
"dependency": "vite",
"title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"url": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
"severity": "moderate",
"cwe": [
"CWE-22",
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=6.4.1"
},
{
"source": 1116230,
"name": "vite",
"dependency": "vite",
"title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"url": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
"severity": "moderate",
"cwe": [
"CWE-22",
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0 <=7.3.1"
},
{
"source": 1116234,
"name": "vite",
"dependency": "vite",
"title": "Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket",
"url": "https://github.com/advisories/GHSA-p9ff-h696-f583",
"severity": "high",
"cwe": [
"CWE-200",
"CWE-306"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <=6.4.1"
},
{
"source": 1116235,
"name": "vite",
"dependency": "vite",
"title": "Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket",
"url": "https://github.com/advisories/GHSA-p9ff-h696-f583",
"severity": "high",
"cwe": [
"CWE-200",
"CWE-306"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0 <=7.3.1"
},
"esbuild"
],
"effects": [],
"range": "<=6.4.1 || 7.0.0 - 7.3.1",
"nodes": [
"node_modules/vite",
"node_modules/vitepress/node_modules/vite",
"packages/codex-docs/node_modules/vite",
"packages/codex-icons/node_modules/vite",
"packages/codex/node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "7.3.2",
"isSemVerMajor": false
}
},
"wait-on": {
"name": "wait-on",
"severity": "high",
"isDirect": false,
"via": [
"axios"
],
"effects": [
"start-server-and-test"
],
"range": "5.0.0-rc.0 - 7.1.0",
"nodes": [
"node_modules/wait-on"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "3.0.2",
"isSemVerMajor": true
}
},
"yaml": {
"name": "yaml",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115556,
"name": "yaml",
"dependency": "yaml",
"title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp",
"severity": "moderate",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0 <2.8.3"
}
],
"effects": [],
"range": "2.0.0 - 2.8.2",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build-info/node_modules/yaml",
"node_modules/yaml"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 13,
"moderate": 29,
"high": 29,
"critical": 1,
"total": 72
},
"dependencies": {
"prod": 143,
"dev": 2633,
"optional": 282,
"peer": 103,
"peerOptional": 0,
"total": 2775
}
}
}
--- end ---
$ /usr/bin/npm audit --json
--- stdout ---
{
"auditReportVersion": 2,
"vulnerabilities": {
"@babel/helpers": {
"name": "@babel/helpers",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1104001,
"name": "@babel/helpers",
"dependency": "@babel/helpers",
"title": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups",
"url": "https://github.com/advisories/GHSA-968p-4wvh-cqc8",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 6.2,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<7.26.10"
}
],
"effects": [],
"range": "<7.26.10",
"nodes": [
"node_modules/@babel/helpers"
],
"fixAvailable": true
},
"@cypress/request": {
"name": "@cypress/request",
"severity": "low",
"isDirect": false,
"via": [
"qs"
],
"effects": [],
"range": "2.88.11 - 3.0.9",
"nodes": [
"node_modules/@cypress/request"
],
"fixAvailable": true
},
"@isaacs/brace-expansion": {
"name": "@isaacs/brace-expansion",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1112954,
"name": "@isaacs/brace-expansion",
"dependency": "@isaacs/brace-expansion",
"title": "@isaacs/brace-expansion has Uncontrolled Resource Consumption",
"url": "https://github.com/advisories/GHSA-7h2j-956f-4vf2",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=5.0.0"
}
],
"effects": [],
"range": "5.0.0",
"nodes": [
"node_modules/@isaacs/brace-expansion"
],
"fixAvailable": true
},
"@mapbox/node-pre-gyp": {
"name": "@mapbox/node-pre-gyp",
"severity": "high",
"isDirect": false,
"via": [
"tar"
],
"effects": [
"@vercel/nft"
],
"range": "<=1.0.11",
"nodes": [
"node_modules/netlify-cli/node_modules/@mapbox/node-pre-gyp"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@netlify/build": {
"name": "@netlify/build",
"severity": "moderate",
"isDirect": false,
"via": [
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it"
],
"effects": [
"netlify-cli"
],
"range": "0.0.24 - 0.0.26 || 9.1.0 - 11.17.0 || 11.37.2 - 12.1.2 || 29.20.8 - 32.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@netlify/edge-bundler": {
"name": "@netlify/edge-bundler",
"severity": "high",
"isDirect": false,
"via": [
"@vercel/nft",
"esbuild"
],
"effects": [
"@netlify/build",
"netlify-cli"
],
"range": "8.20.0 - 11.4.0 || 12.0.0 - 13.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@netlify/functions-utils": {
"name": "@netlify/functions-utils",
"severity": "moderate",
"isDirect": false,
"via": [
"@netlify/zip-it-and-ship-it"
],
"effects": [],
"range": "1.3.14 - 1.3.29 || 1.3.41 || 5.2.24 - 5.3.16",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/functions-utils"
],
"fixAvailable": true
},
"@netlify/zip-it-and-ship-it": {
"name": "@netlify/zip-it-and-ship-it",
"severity": "high",
"isDirect": false,
"via": [
"@vercel/nft",
"esbuild"
],
"effects": [
"@netlify/build",
"@netlify/functions-utils",
"netlify-cli"
],
"range": "2.2.0 - 4.2.7 || 4.25.0 - 12.0.3",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/zip-it-and-ship-it"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@octokit/endpoint": {
"name": "@octokit/endpoint",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113209,
"name": "@octokit/endpoint",
"dependency": "@octokit/endpoint",
"title": "@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-x4c5-c7rf-jjgv",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=9.0.5 <9.0.6"
}
],
"effects": [],
"range": "9.0.5",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/endpoint"
],
"fixAvailable": true
},
"@octokit/plugin-paginate-rest": {
"name": "@octokit/plugin-paginate-rest",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102899,
"name": "@octokit/plugin-paginate-rest",
"dependency": "@octokit/plugin-paginate-rest",
"title": "@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-h5c3-5r3r-rr8q",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=9.3.0-beta.1 <11.4.1"
}
],
"effects": [
"@octokit/rest"
],
"range": "9.3.0-beta.1 - 11.4.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/plugin-paginate-rest"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@octokit/request": {
"name": "@octokit/request",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1112248,
"name": "@octokit/request",
"dependency": "@octokit/request",
"title": "@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-rmvr-2pp2-xj38",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <8.4.1"
}
],
"effects": [],
"range": "<=8.4.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/request"
],
"fixAvailable": true
},
"@octokit/request-error": {
"name": "@octokit/request-error",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102256,
"name": "@octokit/request-error",
"dependency": "@octokit/request-error",
"title": "@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking",
"url": "https://github.com/advisories/GHSA-xx4v-prfh-6cgc",
"severity": "moderate",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <5.1.1"
}
],
"effects": [],
"range": "<=5.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/request-error"
],
"fixAvailable": true
},
"@octokit/rest": {
"name": "@octokit/rest",
"severity": "moderate",
"isDirect": false,
"via": [
"@octokit/plugin-paginate-rest"
],
"effects": [
"netlify-cli"
],
"range": "20.1.1 || 21.0.0-beta.1 - 21.0.0-beta.4",
"nodes": [
"node_modules/netlify-cli/node_modules/@octokit/rest"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@tootallnate/once": {
"name": "@tootallnate/once",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1113977,
"name": "@tootallnate/once",
"dependency": "@tootallnate/once",
"title": "@tootallnate/once vulnerable to Incorrect Control Flow Scoping",
"url": "https://github.com/advisories/GHSA-vpq2-c234-7xj6",
"severity": "low",
"cwe": [
"CWE-705"
],
"cvss": {
"score": 3.3,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<3.0.1"
}
],
"effects": [
"http-proxy-agent"
],
"range": "<3.0.1",
"nodes": [
"node_modules/@tootallnate/once"
],
"fixAvailable": {
"name": "jest-environment-jsdom",
"version": "30.3.0",
"isSemVerMajor": true
}
},
"@vercel/nft": {
"name": "@vercel/nft",
"severity": "high",
"isDirect": false,
"via": [
"@mapbox/node-pre-gyp"
],
"effects": [
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it"
],
"range": "0.12.0 - 0.27.7",
"nodes": [
"node_modules/netlify-cli/node_modules/@vercel/nft"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@xhmikosr/archive-type": {
"name": "@xhmikosr/archive-type",
"severity": "moderate",
"isDirect": false,
"via": [
"file-type"
],
"effects": [
"@xhmikosr/downloader"
],
"range": "6.0.0 - 7.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/archive-type"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"@xhmikosr/decompress": {
"name": "@xhmikosr/decompress",
"severity": "moderate",
"isDirect": false,
"via": [
"@xhmikosr/decompress-tar",
"@xhmikosr/decompress-tarbz2",
"@xhmikosr/decompress-targz",
"@xhmikosr/decompress-unzip"
],
"effects": [],
"range": "8.0.0 - 10.2.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/decompress"
],
"fixAvailable": true
},
"@xhmikosr/decompress-tar": {
"name": "@xhmikosr/decompress-tar",
"severity": "moderate",
"isDirect": false,
"via": [
"file-type"
],
"effects": [
"@xhmikosr/decompress-tarbz2",
"@xhmikosr/decompress-targz"
],
"range": "6.0.0 - 8.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/decompress-tar"
],
"fixAvailable": true
},
"@xhmikosr/decompress-tarbz2": {
"name": "@xhmikosr/decompress-tarbz2",
"severity": "moderate",
"isDirect": false,
"via": [
"@xhmikosr/decompress-tar",
"file-type"
],
"effects": [
"@xhmikosr/decompress"
],
"range": "6.0.0 - 9.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/decompress-tarbz2"
],
"fixAvailable": true
},
"@xhmikosr/decompress-targz": {
"name": "@xhmikosr/decompress-targz",
"severity": "moderate",
"isDirect": false,
"via": [
"@xhmikosr/decompress-tar",
"file-type"
],
"effects": [],
"range": "6.0.0 - 9.0.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/decompress-targz"
],
"fixAvailable": true
},
"@xhmikosr/decompress-unzip": {
"name": "@xhmikosr/decompress-unzip",
"severity": "moderate",
"isDirect": false,
"via": [
"file-type"
],
"effects": [],
"range": "6.0.0 - 7.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/decompress-unzip"
],
"fixAvailable": true
},
"@xhmikosr/downloader": {
"name": "@xhmikosr/downloader",
"severity": "moderate",
"isDirect": false,
"via": [
"@xhmikosr/archive-type",
"@xhmikosr/decompress",
"file-type"
],
"effects": [
"gh-release-fetch"
],
"range": "10.0.0 - 10.0.1 || 12.0.0 - 15.2.0",
"nodes": [
"node_modules/netlify-cli/node_modules/@xhmikosr/downloader"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"ajv": {
"name": "ajv",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113714,
"name": "ajv",
"dependency": "ajv",
"title": "ajv has ReDoS when using `$data` option",
"url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<6.14.0"
},
{
"source": 1113715,
"name": "ajv",
"dependency": "ajv",
"title": "ajv has ReDoS when using `$data` option",
"url": "https://github.com/advisories/GHSA-2g4f-4pwh-qvx6",
"severity": "moderate",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0-alpha.0 <8.18.0"
}
],
"effects": [],
"range": "<6.14.0 || >=7.0.0-alpha.0 <8.18.0",
"nodes": [
"node_modules/ajv",
"node_modules/netlify-cli/node_modules/@fastify/ajv-compiler/node_modules/ajv",
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler/node_modules/ajv",
"node_modules/netlify-cli/node_modules/@netlify/framework-info/node_modules/ajv",
"node_modules/netlify-cli/node_modules/ajv",
"node_modules/netlify-cli/node_modules/ajv-formats/node_modules/ajv",
"node_modules/netlify-cli/node_modules/fast-json-stringify/node_modules/ajv",
"node_modules/table/node_modules/ajv"
],
"fixAvailable": true
},
"axios": {
"name": "axios",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1097679,
"name": "axios",
"dependency": "axios",
"title": "Axios Cross-Site Request Forgery Vulnerability",
"url": "https://github.com/advisories/GHSA-wf5p-g6vw-rhxx",
"severity": "moderate",
"cwe": [
"CWE-352"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=0.8.1 <0.28.0"
},
{
"source": 1111034,
"name": "axios",
"dependency": "axios",
"title": "axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL",
"url": "https://github.com/advisories/GHSA-jr5f-v2jv-69x6",
"severity": "high",
"cwe": [
"CWE-918"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<0.30.0"
},
{
"source": 1113274,
"name": "axios",
"dependency": "axios",
"title": "Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig",
"url": "https://github.com/advisories/GHSA-43fc-jf86-j433",
"severity": "high",
"cwe": [
"CWE-754"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<=0.30.2"
},
{
"source": 1116672,
"name": "axios",
"dependency": "axios",
"title": "Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"url": "https://github.com/advisories/GHSA-3p68-rc4w-qgx5",
"severity": "moderate",
"cwe": [
"CWE-441",
"CWE-918"
],
"cvss": {
"score": 4.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<0.31.0"
},
{
"source": 1116674,
"name": "axios",
"dependency": "axios",
"title": "Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain",
"url": "https://github.com/advisories/GHSA-fvcv-3m26-pcqx",
"severity": "moderate",
"cwe": [
"CWE-113",
"CWE-444",
"CWE-918"
],
"cvss": {
"score": 4.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<0.31.0"
}
],
"effects": [
"wait-on"
],
"range": "<=0.30.3",
"nodes": [
"node_modules/wait-on/node_modules/axios"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "3.0.2",
"isSemVerMajor": true
}
},
"body-parser": {
"name": "body-parser",
"severity": "low",
"isDirect": false,
"via": [
"qs"
],
"effects": [
"express"
],
"range": "1.19.0 - 1.20.3 || 2.0.0-beta.1 - 2.0.2",
"nodes": [
"node_modules/netlify-cli/node_modules/body-parser"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"brace-expansion": {
"name": "brace-expansion",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1105443,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=1.0.0 <=1.1.11"
},
{
"source": 1105444,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion Regular Expression Denial of Service vulnerability",
"url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
"severity": "low",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0 <=2.0.1"
},
{
"source": 1115540,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": "<1.1.13"
},
{
"source": 1115541,
"name": "brace-expansion",
"dependency": "brace-expansion",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"severity": "moderate",
"cwe": [
"CWE-400"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
"range": ">=2.0.0 <2.0.3"
}
],
"effects": [],
"range": "<=1.1.12 || 2.0.0 - 2.0.2",
"nodes": [
"node_modules/@bundled-es-modules/glob/node_modules/brace-expansion",
"node_modules/brace-expansion",
"node_modules/editorconfig/node_modules/brace-expansion",
"node_modules/filelist/node_modules/brace-expansion",
"node_modules/js-beautify/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/@fastify/static/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/@netlify/build-info/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/@netlify/build/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/@netlify/zip-it-and-ship-it/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/archiver-utils/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/brace-expansion",
"node_modules/netlify-cli/node_modules/readdir-glob/node_modules/brace-expansion",
"packages/codex-design-tokens/node_modules/brace-expansion",
"packages/codex-icons/node_modules/brace-expansion"
],
"fixAvailable": true
},
"defu": {
"name": "defu",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1116102,
"name": "defu",
"dependency": "defu",
"title": "defu: Prototype pollution via `__proto__` key in defaults argument",
"url": "https://github.com/advisories/GHSA-737v-mqg7-c878",
"severity": "high",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<=6.1.4"
}
],
"effects": [],
"range": "<=6.1.4",
"nodes": [
"node_modules/netlify-cli/node_modules/defu"
],
"fixAvailable": true
},
"diff": {
"name": "diff",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1112704,
"name": "diff",
"dependency": "diff",
"title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx",
"severity": "low",
"cwe": [
"CWE-400",
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "4.0.0 - 4.0.3",
"nodes": [
"node_modules/netlify-cli/node_modules/ts-node/node_modules/diff"
],
"fixAvailable": true
},
"editorconfig": {
"name": "editorconfig",
"severity": "high",
"isDirect": false,
"via": [
"minimatch"
],
"effects": [],
"range": "1.0.3 - 1.0.4 || 2.0.0",
"nodes": [
"node_modules/editorconfig"
],
"fixAvailable": true
},
"esbuild": {
"name": "esbuild",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1102341,
"name": "esbuild",
"dependency": "esbuild",
"title": "esbuild enables any website to send any requests to the development server and read the response",
"url": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
"severity": "moderate",
"cwe": [
"CWE-346"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": "<=0.24.2"
}
],
"effects": [
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it",
"tsx",
"vite"
],
"range": "<=0.24.2",
"nodes": [
"node_modules/esbuild",
"node_modules/netlify-cli/node_modules/@netlify/edge-bundler/node_modules/esbuild",
"node_modules/netlify-cli/node_modules/esbuild",
"node_modules/vite/node_modules/esbuild",
"node_modules/vitepress/node_modules/esbuild"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"express": {
"name": "express",
"severity": "high",
"isDirect": false,
"via": [
"body-parser",
"path-to-regexp",
"qs"
],
"effects": [
"netlify-cli"
],
"range": "4.0.0-rc1 - 4.21.2 || 5.0.0-alpha.1 - 5.0.1",
"nodes": [
"node_modules/netlify-cli/node_modules/express"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"external-editor": {
"name": "external-editor",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [
"inquirer"
],
"range": ">=1.1.1",
"nodes": [
"node_modules/netlify-cli/node_modules/external-editor"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"fastify": {
"name": "fastify",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1112876,
"name": "fastify",
"dependency": "fastify",
"title": "Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream",
"url": "https://github.com/advisories/GHSA-mrq3-vjjr-p77c",
"severity": "low",
"cwe": [
"CWE-770"
],
"cvss": {
"score": 3.7,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<=5.7.2"
},
{
"source": 1112877,
"name": "fastify",
"dependency": "fastify",
"title": "Fastify's Content-Type header tab character allows body validation bypass",
"url": "https://github.com/advisories/GHSA-jx2c-rxcm-jvmq",
"severity": "high",
"cwe": [
"CWE-436"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<5.7.2"
},
{
"source": 1115367,
"name": "fastify",
"dependency": "fastify",
"title": "fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections",
"url": "https://github.com/advisories/GHSA-444r-cwp2-x5xf",
"severity": "moderate",
"cwe": [
"CWE-348"
],
"cvss": {
"score": 6.1,
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
},
"range": "<=5.8.2"
}
],
"effects": [
"netlify-cli"
],
"range": "<=5.8.2",
"nodes": [
"node_modules/netlify-cli/node_modules/fastify"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"file-type": {
"name": "file-type",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1114301,
"name": "file-type",
"dependency": "file-type",
"title": "file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
"url": "https://github.com/advisories/GHSA-5v7r-6r5c-r473",
"severity": "moderate",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=13.0.0 <21.3.1"
}
],
"effects": [
"@xhmikosr/archive-type",
"@xhmikosr/decompress-tar",
"@xhmikosr/decompress-tarbz2",
"@xhmikosr/decompress-targz",
"@xhmikosr/decompress-unzip",
"@xhmikosr/downloader"
],
"range": "13.0.0 - 21.3.0",
"nodes": [
"node_modules/netlify-cli/node_modules/file-type"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"follow-redirects": {
"name": "follow-redirects",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1116560,
"name": "follow-redirects",
"dependency": "follow-redirects",
"title": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"url": "https://github.com/advisories/GHSA-r4q5-vmmm-2653",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=1.15.11"
}
],
"effects": [],
"range": "<=1.15.11",
"nodes": [
"node_modules/follow-redirects",
"node_modules/netlify-cli/node_modules/follow-redirects"
],
"fixAvailable": true
},
"form-data": {
"name": "form-data",
"severity": "critical",
"isDirect": false,
"via": [
{
"source": 1109538,
"name": "form-data",
"dependency": "form-data",
"title": "form-data uses unsafe random function in form-data for choosing boundary",
"url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
"severity": "critical",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "4.0.0 - 4.0.3",
"nodes": [
"node_modules/form-data"
],
"fixAvailable": true
},
"gh-release-fetch": {
"name": "gh-release-fetch",
"severity": "moderate",
"isDirect": false,
"via": [
"@xhmikosr/downloader"
],
"effects": [
"netlify-cli"
],
"range": ">=4.0.2",
"nodes": [
"node_modules/netlify-cli/node_modules/gh-release-fetch"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"glob": {
"name": "glob",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1109842,
"name": "glob",
"dependency": "glob",
"title": "glob CLI: Command injection via -c/--cmd executes matches with shell:true",
"url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2",
"severity": "high",
"cwe": [
"CWE-78"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=10.2.0 <10.5.0"
},
{
"source": 1109843,
"name": "glob",
"dependency": "glob",
"title": "glob CLI: Command injection via -c/--cmd executes matches with shell:true",
"url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2",
"severity": "high",
"cwe": [
"CWE-78"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=11.0.0 <11.1.0"
}
],
"effects": [],
"range": "10.2.0 - 10.4.5 || 11.0.0 - 11.0.3",
"nodes": [
"node_modules/@bundled-es-modules/glob/node_modules/glob",
"node_modules/js-beautify/node_modules/glob",
"node_modules/netlify-cli/node_modules/@fastify/static/node_modules/glob",
"node_modules/netlify-cli/node_modules/archiver-utils/node_modules/glob",
"node_modules/svglint/node_modules/glob",
"packages/codex-design-tokens/node_modules/glob",
"packages/codex-docs/node_modules/glob",
"packages/codex-icons/node_modules/glob"
],
"fixAvailable": {
"name": "glob",
"version": "11.1.0",
"isSemVerMajor": false
}
},
"h3": {
"name": "h3",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1114875,
"name": "h3",
"dependency": "h3",
"title": "h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read",
"url": "https://github.com/advisories/GHSA-wr4h-v87w-p3r7",
"severity": "moderate",
"cwe": [
"CWE-22",
"CWE-116"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<1.15.6"
},
{
"source": 1115114,
"name": "h3",
"dependency": "h3",
"title": "h3: SSE Event Injection via Unsanitized Carriage Return (`\\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)",
"url": "https://github.com/advisories/GHSA-4hxc-9384-m385",
"severity": "moderate",
"cwe": [
"CWE-74"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<1.15.9"
},
{
"source": 1115117,
"name": "h3",
"dependency": "h3",
"title": "h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`",
"url": "https://github.com/advisories/GHSA-72gr-qfp7-vwhw",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
"range": "<=1.15.8"
},
{
"source": 1115161,
"name": "h3",
"dependency": "h3",
"title": "h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields",
"url": "https://github.com/advisories/GHSA-22cc-p3c6-wpvm",
"severity": "high",
"cwe": [
"CWE-93"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N"
},
"range": "<1.15.6"
},
{
"source": 1116543,
"name": "h3",
"dependency": "h3",
"title": "h3 v1 has Request Smuggling (TE.TE) issue",
"url": "https://github.com/advisories/GHSA-mp2g-9vg9-f4cg",
"severity": "high",
"cwe": [
"CWE-444"
],
"cvss": {
"score": 8.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L"
},
"range": "<=1.15.4"
}
],
"effects": [],
"range": "<=1.15.8",
"nodes": [
"node_modules/netlify-cli/node_modules/h3"
],
"fixAvailable": true
},
"http-proxy-agent": {
"name": "http-proxy-agent",
"severity": "low",
"isDirect": false,
"via": [
"@tootallnate/once"
],
"effects": [
"jsdom"
],
"range": "4.0.1 - 5.0.0",
"nodes": [
"node_modules/http-proxy-agent"
],
"fixAvailable": {
"name": "jest-environment-jsdom",
"version": "30.3.0",
"isSemVerMajor": true
}
},
"http-proxy-middleware": {
"name": "http-proxy-middleware",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1104105,
"name": "http-proxy-middleware",
"dependency": "http-proxy-middleware",
"title": "http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed",
"url": "https://github.com/advisories/GHSA-9gqv-wp59-fq42",
"severity": "moderate",
"cwe": [
"CWE-754"
],
"cvss": {
"score": 4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
},
"range": ">=1.3.0 <2.0.9"
},
{
"source": 1104106,
"name": "http-proxy-middleware",
"dependency": "http-proxy-middleware",
"title": "http-proxy-middleware can call writeBody twice because \"else if\" is not used",
"url": "https://github.com/advisories/GHSA-4www-5p9h-95mh",
"severity": "moderate",
"cwe": [
"CWE-670"
],
"cvss": {
"score": 4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
},
"range": ">=1.3.0 <2.0.8"
}
],
"effects": [
"netlify-cli"
],
"range": "1.3.0 - 2.0.8",
"nodes": [
"node_modules/netlify-cli/node_modules/http-proxy-middleware"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"inquirer": {
"name": "inquirer",
"severity": "low",
"isDirect": false,
"via": [
"external-editor"
],
"effects": [
"netlify-cli",
"tabtab"
],
"range": "3.0.0 - 8.2.6 || 9.0.0 - 9.3.7",
"nodes": [
"node_modules/netlify-cli/node_modules/inquirer"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"ipx": {
"name": "ipx",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1106842,
"name": "ipx",
"dependency": "ipx",
"title": "IPX Allows Path Traversal via Prefix Matching Bypass",
"url": "https://github.com/advisories/GHSA-mm3p-j368-7jcr",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0-0 <2.1.1"
}
],
"effects": [
"netlify-cli"
],
"range": "2.0.0-0 - 2.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/ipx"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"jest-environment-jsdom": {
"name": "jest-environment-jsdom",
"severity": "low",
"isDirect": true,
"via": [
"jsdom"
],
"effects": [],
"range": "27.0.1 - 30.0.0-rc.1",
"nodes": [
"node_modules/jest-environment-jsdom"
],
"fixAvailable": {
"name": "jest-environment-jsdom",
"version": "30.3.0",
"isSemVerMajor": true
}
},
"js-yaml": {
"name": "js-yaml",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1112714,
"name": "js-yaml",
"dependency": "js-yaml",
"title": "js-yaml has prototype pollution in merge (<<)",
"url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<3.14.2"
},
{
"source": 1112715,
"name": "js-yaml",
"dependency": "js-yaml",
"title": "js-yaml has prototype pollution in merge (<<)",
"url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=4.0.0 <4.1.1"
}
],
"effects": [
"netlify-cli"
],
"range": "<3.14.2 || >=4.0.0 <4.1.1",
"nodes": [
"node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml",
"node_modules/js-yaml",
"node_modules/netlify-cli/node_modules/js-yaml"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"jsdom": {
"name": "jsdom",
"severity": "low",
"isDirect": false,
"via": [
"http-proxy-agent"
],
"effects": [
"jest-environment-jsdom"
],
"range": "16.6.0 - 22.1.0",
"nodes": [
"node_modules/jsdom"
],
"fixAvailable": {
"name": "jest-environment-jsdom",
"version": "30.3.0",
"isSemVerMajor": true
}
},
"jws": {
"name": "jws",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1111244,
"name": "jws",
"dependency": "jws",
"title": "auth0/node-jws Improperly Verifies HMAC Signature",
"url": "https://github.com/advisories/GHSA-869p-cjfg-cm3x",
"severity": "high",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<3.2.3"
}
],
"effects": [],
"range": "<3.2.3",
"nodes": [
"node_modules/netlify-cli/node_modules/jws"
],
"fixAvailable": true
},
"lodash": {
"name": "lodash",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1112455,
"name": "lodash",
"dependency": "lodash",
"title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
"url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": ">=4.0.0 <=4.17.22"
},
{
"source": 1115806,
"name": "lodash",
"dependency": "lodash",
"title": "lodash vulnerable to Code Injection via `_.template` imports key names",
"url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc",
"severity": "high",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=4.0.0 <=4.17.23"
},
{
"source": 1115810,
"name": "lodash",
"dependency": "lodash",
"title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
"url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<=4.17.23"
}
],
"effects": [
"netlify-cli"
],
"range": "<=4.17.23",
"nodes": [
"node_modules/lodash",
"node_modules/netlify-cli/node_modules/lodash"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"lodash-es": {
"name": "lodash-es",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1112453,
"name": "lodash-es",
"dependency": "lodash-es",
"title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
"url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": ">=4.0.0 <=4.17.22"
},
{
"source": 1115805,
"name": "lodash-es",
"dependency": "lodash-es",
"title": "lodash vulnerable to Code Injection via `_.template` imports key names",
"url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc",
"severity": "high",
"cwe": [
"CWE-94"
],
"cvss": {
"score": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
"range": ">=4.0.0 <=4.17.23"
},
{
"source": 1115809,
"name": "lodash-es",
"dependency": "lodash-es",
"title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
"url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<=4.17.23"
}
],
"effects": [],
"range": "<=4.17.23",
"nodes": [
"node_modules/netlify-cli/node_modules/lodash-es"
],
"fixAvailable": true
},
"mdast-util-to-hast": {
"name": "mdast-util-to-hast",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113048,
"name": "mdast-util-to-hast",
"dependency": "mdast-util-to-hast",
"title": "mdast-util-to-hast has unsanitized class attribute",
"url": "https://github.com/advisories/GHSA-4fh9-h7wg-q85m",
"severity": "moderate",
"cwe": [
"CWE-20",
"CWE-915"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=13.0.0 <13.2.1"
}
],
"effects": [],
"range": "13.0.0 - 13.2.0",
"nodes": [
"node_modules/mdast-util-to-hast"
],
"fixAvailable": true
},
"minimatch": {
"name": "minimatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113459,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<3.1.3"
},
{
"source": 1113461,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=5.0.0 <5.1.7"
},
{
"source": 1113465,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=9.0.0 <9.0.6"
},
{
"source": 1113466,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=10.0.0 <10.2.1"
},
{
"source": 1113538,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.3"
},
{
"source": 1113540,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=5.0.0 <5.1.8"
},
{
"source": 1113544,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=9.0.0 <9.0.7"
},
{
"source": 1113545,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
"severity": "high",
"cwe": [
"CWE-407"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=10.0.0 <10.2.3"
},
{
"source": 1113546,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<3.1.4"
},
{
"source": 1113548,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=5.0.0 <5.1.8"
},
{
"source": 1113552,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=9.0.0 <9.0.7"
},
{
"source": 1113553,
"name": "minimatch",
"dependency": "minimatch",
"title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
"url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=10.0.0 <10.2.3"
}
],
"effects": [
"editorconfig"
],
"range": "<=3.1.3 || 5.0.0 - 5.1.7 || 9.0.0 - 9.0.6 || 10.0.0 - 10.2.2",
"nodes": [
"node_modules/@bundled-es-modules/glob/node_modules/minimatch",
"node_modules/@vue/language-core/node_modules/minimatch",
"node_modules/editorconfig/node_modules/minimatch",
"node_modules/filelist/node_modules/minimatch",
"node_modules/js-beautify/node_modules/minimatch",
"node_modules/minimatch",
"node_modules/netlify-cli/node_modules/@fastify/static/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/@netlify/build-info/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/@netlify/build/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/@netlify/zip-it-and-ship-it/node_modules/glob/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/@netlify/zip-it-and-ship-it/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/archiver-utils/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/minimatch",
"node_modules/netlify-cli/node_modules/readdir-glob/node_modules/minimatch",
"node_modules/svglint/node_modules/minimatch",
"packages/codex-design-tokens/node_modules/minimatch",
"packages/codex-icons/node_modules/minimatch"
],
"fixAvailable": true
},
"netlify-cli": {
"name": "netlify-cli",
"severity": "high",
"isDirect": true,
"via": [
"@netlify/build",
"@netlify/edge-bundler",
"@netlify/zip-it-and-ship-it",
"@octokit/rest",
"express",
"fastify",
"gh-release-fetch",
"http-proxy-middleware",
"inquirer",
"ipx",
"js-yaml",
"lodash",
"tabtab"
],
"effects": [],
"range": "2.0.0-alpha.1 - 24.2.0",
"nodes": [
"node_modules/netlify-cli"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"node-forge": {
"name": "node-forge",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1110996,
"name": "node-forge",
"dependency": "node-forge",
"title": "node-forge has ASN.1 Unbounded Recursion",
"url": "https://github.com/advisories/GHSA-554w-wpv2-vw27",
"severity": "high",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.3.2"
},
{
"source": 1110998,
"name": "node-forge",
"dependency": "node-forge",
"title": "node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization",
"url": "https://github.com/advisories/GHSA-5gfm-wpxj-wjgq",
"severity": "high",
"cwe": [
"CWE-436"
],
"cvss": {
"score": 8.6,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
},
"range": "<1.3.2"
},
{
"source": 1111068,
"name": "node-forge",
"dependency": "node-forge",
"title": "node-forge is vulnerable to ASN.1 OID Integer Truncation",
"url": "https://github.com/advisories/GHSA-65ch-62r8-g69g",
"severity": "moderate",
"cwe": [
"CWE-190"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<1.3.2"
},
{
"source": 1115545,
"name": "node-forge",
"dependency": "node-forge",
"title": "Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)",
"url": "https://github.com/advisories/GHSA-2328-f5f3-gj25",
"severity": "high",
"cwe": [
"CWE-295"
],
"cvss": {
"score": 7.4,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
"range": "<=1.3.3"
},
{
"source": 1115546,
"name": "node-forge",
"dependency": "node-forge",
"title": "Forge has signature forgery in Ed25519 due to missing S > L check",
"url": "https://github.com/advisories/GHSA-q67f-28xg-22rw",
"severity": "high",
"cwe": [
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<1.4.0"
},
{
"source": 1115548,
"name": "node-forge",
"dependency": "node-forge",
"title": "Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input",
"url": "https://github.com/advisories/GHSA-5m6q-g25r-mvwx",
"severity": "high",
"cwe": [
"CWE-835"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<1.4.0"
},
{
"source": 1115612,
"name": "node-forge",
"dependency": "node-forge",
"title": "Forge has signature forgery in RSA-PKCS due to ASN.1 extra field ",
"url": "https://github.com/advisories/GHSA-ppp5-5v6c-4jwp",
"severity": "high",
"cwe": [
"CWE-20",
"CWE-347"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": "<1.4.0"
}
],
"effects": [],
"range": "<=1.3.3",
"nodes": [
"node_modules/netlify-cli/node_modules/node-forge"
],
"fixAvailable": true
},
"on-headers": {
"name": "on-headers",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1106812,
"name": "on-headers",
"dependency": "on-headers",
"title": "on-headers is vulnerable to http response header manipulation",
"url": "https://github.com/advisories/GHSA-76c9-3jph-rj3q",
"severity": "low",
"cwe": [
"CWE-241"
],
"cvss": {
"score": 3.4,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
},
"range": "<1.1.0"
}
],
"effects": [],
"range": "<1.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/on-headers"
],
"fixAvailable": true
},
"patch-package": {
"name": "patch-package",
"severity": "low",
"isDirect": false,
"via": [
"tmp"
],
"effects": [],
"range": "<=8.0.0 || >=8.1.0-canary",
"nodes": [
"node_modules/patch-package"
],
"fixAvailable": true
},
"path-to-regexp": {
"name": "path-to-regexp",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115527,
"name": "path-to-regexp",
"dependency": "path-to-regexp",
"title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
"url": "https://github.com/advisories/GHSA-37ch-88jc-xwx2",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<0.1.13"
}
],
"effects": [
"express"
],
"range": "<0.1.13",
"nodes": [
"node_modules/netlify-cli/node_modules/express/node_modules/path-to-regexp"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"picomatch": {
"name": "picomatch",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1115549,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<2.3.2"
},
{
"source": 1115551,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"severity": "moderate",
"cwe": [
"CWE-1321"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
"range": ">=4.0.0 <4.0.4"
},
{
"source": 1115552,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<2.3.2"
},
{
"source": 1115554,
"name": "picomatch",
"dependency": "picomatch",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"severity": "high",
"cwe": [
"CWE-1333"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=4.0.0 <4.0.4"
}
],
"effects": [],
"range": "<=2.3.1 || 4.0.0 - 4.0.3",
"nodes": [
"node_modules/@rollup/pluginutils/node_modules/picomatch",
"node_modules/@stylistic/eslint-plugin/node_modules/picomatch",
"node_modules/netlify-cli/node_modules/@rollup/pluginutils/node_modules/picomatch",
"node_modules/netlify-cli/node_modules/picomatch",
"node_modules/picomatch",
"packages/codex-docs/node_modules/picomatch",
"packages/codex-icons/node_modules/picomatch",
"packages/codex/node_modules/picomatch"
],
"fixAvailable": true
},
"preact": {
"name": "preact",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1111984,
"name": "preact",
"dependency": "preact",
"title": "Preact has JSON VNode Injection issue",
"url": "https://github.com/advisories/GHSA-36hm-qxxp-pg3m",
"severity": "high",
"cwe": [
"CWE-843"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=10.26.5 <10.26.10"
}
],
"effects": [],
"range": "10.26.5 - 10.26.9",
"nodes": [
"node_modules/preact"
],
"fixAvailable": true
},
"prismjs": {
"name": "prismjs",
"severity": "moderate",
"isDirect": true,
"via": [
{
"source": 1105770,
"name": "prismjs",
"dependency": "prismjs",
"title": "PrismJS DOM Clobbering vulnerability",
"url": "https://github.com/advisories/GHSA-x7hr-w5r2-h6wg",
"severity": "moderate",
"cwe": [
"CWE-79",
"CWE-94"
],
"cvss": {
"score": 4.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
},
"range": "<1.30.0"
}
],
"effects": [],
"range": "<1.30.0",
"nodes": [
"node_modules/prismjs"
],
"fixAvailable": {
"name": "prismjs",
"version": "1.30.0",
"isSemVerMajor": false
}
},
"qs": {
"name": "qs",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1113161,
"name": "qs",
"dependency": "qs",
"title": "qs's arrayLimit bypass in comma parsing allows denial of service",
"url": "https://github.com/advisories/GHSA-w7fw-mjwx-w883",
"severity": "low",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 3.7,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=6.7.0 <=6.14.1"
},
{
"source": 1113719,
"name": "qs",
"dependency": "qs",
"title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
"url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
"severity": "moderate",
"cwe": [
"CWE-20"
],
"cvss": {
"score": 3.7,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
"range": "<6.14.1"
}
],
"effects": [
"@cypress/request",
"body-parser",
"express"
],
"range": "<=6.14.1",
"nodes": [
"node_modules/netlify-cli/node_modules/qs",
"node_modules/qs"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"rollup": {
"name": "rollup",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1113515,
"name": "rollup",
"dependency": "rollup",
"title": "Rollup 4 has Arbitrary File Write via Path Traversal",
"url": "https://github.com/advisories/GHSA-mw96-cpmx-2vgc",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=4.0.0 <4.59.0"
}
],
"effects": [],
"range": "4.0.0 - 4.58.0",
"nodes": [
"node_modules/netlify-cli/node_modules/rollup",
"node_modules/rollup"
],
"fixAvailable": true
},
"start-server-and-test": {
"name": "start-server-and-test",
"severity": "high",
"isDirect": true,
"via": [
"wait-on"
],
"effects": [],
"range": "1.11.1 - 2.0.2",
"nodes": [
"node_modules/start-server-and-test"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "3.0.2",
"isSemVerMajor": true
}
},
"svgo": {
"name": "svgo",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1114151,
"name": "svgo",
"dependency": "svgo",
"title": "SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)",
"url": "https://github.com/advisories/GHSA-xpqw-6gx7-v673",
"severity": "high",
"cwe": [
"CWE-776"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=3.0.0 <3.3.3"
}
],
"effects": [],
"range": "3.0.0 - 3.3.2",
"nodes": [
"node_modules/netlify-cli/node_modules/svgo"
],
"fixAvailable": true
},
"tabtab": {
"name": "tabtab",
"severity": "low",
"isDirect": false,
"via": [
"inquirer"
],
"effects": [
"netlify-cli"
],
"range": ">=3.0.0-beta",
"nodes": [
"node_modules/netlify-cli/node_modules/tabtab"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"tar": {
"name": "tar",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1112659,
"name": "tar",
"dependency": "tar",
"title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
"url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 8.2,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
},
"range": "<7.5.7"
},
{
"source": 1113300,
"name": "tar",
"dependency": "tar",
"title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization",
"url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.2"
},
{
"source": 1113375,
"name": "tar",
"dependency": "tar",
"title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction",
"url": "https://github.com/advisories/GHSA-83g3-92jg-28cx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.1,
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
"range": "<7.5.8"
},
{
"source": 1114200,
"name": "tar",
"dependency": "tar",
"title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-59"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.9"
},
{
"source": 1114302,
"name": "tar",
"dependency": "tar",
"title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
"url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=7.5.10"
},
{
"source": 1114680,
"name": "tar",
"dependency": "tar",
"title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS",
"url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w",
"severity": "high",
"cwe": [
"CWE-176",
"CWE-367"
],
"cvss": {
"score": 8.8,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
},
"range": "<=7.5.3"
}
],
"effects": [
"@mapbox/node-pre-gyp"
],
"range": "<=7.5.10",
"nodes": [
"node_modules/netlify-cli/node_modules/tar"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"tar-fs": {
"name": "tar-fs",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1109532,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.4"
},
{
"source": 1109534,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
"url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
"severity": "high",
"cwe": [
"CWE-22",
"CWE-61"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.1.1"
},
{
"source": 1109542,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs can extract outside the specified dir with a specific tarball",
"url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=3.0.0 <3.0.9"
},
{
"source": 1109543,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs can extract outside the specified dir with a specific tarball",
"url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=2.0.0 <2.1.3"
},
{
"source": 1109551,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
"url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=3.0.0 <3.0.7"
},
{
"source": 1109552,
"name": "tar-fs",
"dependency": "tar-fs",
"title": "tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File",
"url": "https://github.com/advisories/GHSA-pq67-2wwv-3xjx",
"severity": "high",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
"range": ">=2.0.0 <2.1.2"
}
],
"effects": [],
"range": "2.0.0 - 2.1.3 || 3.0.0 - 3.1.0",
"nodes": [
"node_modules/netlify-cli/node_modules/prebuild-install/node_modules/tar-fs",
"node_modules/netlify-cli/node_modules/tar-fs"
],
"fixAvailable": true
},
"tmp": {
"name": "tmp",
"severity": "low",
"isDirect": false,
"via": [
{
"source": 1109537,
"name": "tmp",
"dependency": "tmp",
"title": "tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"url": "https://github.com/advisories/GHSA-52f5-9888-hmc6",
"severity": "low",
"cwe": [
"CWE-59"
],
"cvss": {
"score": 2.5,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
"range": "<=0.2.3"
}
],
"effects": [
"external-editor",
"patch-package"
],
"range": "<=0.2.3",
"nodes": [
"node_modules/netlify-cli/node_modules/tmp",
"node_modules/netlify-cli/node_modules/tmp-promise/node_modules/tmp",
"node_modules/patch-package/node_modules/tmp",
"node_modules/tmp"
],
"fixAvailable": {
"name": "netlify-cli",
"version": "25.0.1",
"isSemVerMajor": true
}
},
"tsx": {
"name": "tsx",
"severity": "moderate",
"isDirect": true,
"via": [
"esbuild"
],
"effects": [],
"range": "3.13.0 - 4.19.2",
"nodes": [
"node_modules/tsx"
],
"fixAvailable": {
"name": "tsx",
"version": "4.21.0",
"isSemVerMajor": false
}
},
"undici": {
"name": "undici",
"severity": "high",
"isDirect": false,
"via": [
{
"source": 1101609,
"name": "undici",
"dependency": "undici",
"title": "Use of Insufficiently Random Values in undici",
"url": "https://github.com/advisories/GHSA-c76h-2ccp-4975",
"severity": "moderate",
"cwe": [
"CWE-330"
],
"cvss": {
"score": 6.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
"range": ">=6.0.0 <6.21.1"
},
{
"source": 1112496,
"name": "undici",
"dependency": "undici",
"title": "Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
"url": "https://github.com/advisories/GHSA-g9mf-h72j-4rw9",
"severity": "moderate",
"cwe": [
"CWE-770"
],
"cvss": {
"score": 5.9,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.23.0"
},
{
"source": 1113068,
"name": "undici",
"dependency": "undici",
"title": "undici Denial of Service attack via bad certificate data",
"url": "https://github.com/advisories/GHSA-cxrh-j4jr-qwg3",
"severity": "low",
"cwe": [
"CWE-401"
],
"cvss": {
"score": 3.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=6.0.0 <6.21.2"
},
{
"source": 1114592,
"name": "undici",
"dependency": "undici",
"title": "Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
"url": "https://github.com/advisories/GHSA-f269-vfmq-vjvj",
"severity": "high",
"cwe": [
"CWE-248",
"CWE-1284"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": ">=6.0.0 <6.24.0"
},
{
"source": 1114594,
"name": "undici",
"dependency": "undici",
"title": "Undici has an HTTP Request/Response Smuggling issue",
"url": "https://github.com/advisories/GHSA-2mjp-6q6p-2qxm",
"severity": "moderate",
"cwe": [
"CWE-444"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
"range": "<6.24.0"
},
{
"source": 1114638,
"name": "undici",
"dependency": "undici",
"title": "Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression",
"url": "https://github.com/advisories/GHSA-vrm6-8vpv-qv8q",
"severity": "high",
"cwe": [
"CWE-409"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.24.0"
},
{
"source": 1114640,
"name": "undici",
"dependency": "undici",
"title": "Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation",
"url": "https://github.com/advisories/GHSA-v9p9-hfj2-hcw8",
"severity": "high",
"cwe": [
"CWE-248"
],
"cvss": {
"score": 7.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
"range": "<6.24.0"
},
{
"source": 1114642,
"name": "undici",
"dependency": "undici",
"title": "Undici has CRLF Injection in undici via `upgrade` option",
"url": "https://github.com/advisories/GHSA-4992-7rv2-5pvq",
"severity": "moderate",
"cwe": [
"CWE-93"
],
"cvss": {
"score": 4.6,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
},
"range": "<6.24.0"
}
],
"effects": [],
"range": "<=6.23.0",
"nodes": [
"node_modules/undici"
],
"fixAvailable": true
},
"vite": {
"name": "vite",
"severity": "high",
"isDirect": true,
"via": [
{
"source": 1102438,
"name": "vite",
"dependency": "vite",
"title": "Websites were able to send any requests to the development server and read the response in vite",
"url": "https://github.com/advisories/GHSA-vg6x-rcgg-rjx6",
"severity": "moderate",
"cwe": [
"CWE-346",
"CWE-350",
"CWE-1385"
],
"cvss": {
"score": 6.5,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <=6.0.8"
},
{
"source": 1103518,
"name": "vite",
"dependency": "vite",
"title": "Vite bypasses server.fs.deny when using ?raw??",
"url": "https://github.com/advisories/GHSA-x574-m823-4x7w",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <6.0.12"
},
{
"source": 1103885,
"name": "vite",
"dependency": "vite",
"title": "Vite has an `server.fs.deny` bypass with an invalid `request-target`",
"url": "https://github.com/advisories/GHSA-356w-63v5-8wf4",
"severity": "moderate",
"cwe": [
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <6.0.15"
},
{
"source": 1104174,
"name": "vite",
"dependency": "vite",
"title": "Vite's server.fs.deny bypassed with /. for files under project root",
"url": "https://github.com/advisories/GHSA-859w-5945-r5v3",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <=6.1.5"
},
{
"source": 1104203,
"name": "vite",
"dependency": "vite",
"title": "Vite allows server.fs.deny to be bypassed with .svg or relative paths",
"url": "https://github.com/advisories/GHSA-xcj6-pq6g-qj4x",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <6.0.14"
},
{
"source": 1107323,
"name": "vite",
"dependency": "vite",
"title": "Vite middleware may serve files starting with the same name with the public directory",
"url": "https://github.com/advisories/GHSA-g4jq-h2w9-997c",
"severity": "low",
"cwe": [
"CWE-22",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=5.4.19"
},
{
"source": 1107324,
"name": "vite",
"dependency": "vite",
"title": "Vite middleware may serve files starting with the same name with the public directory",
"url": "https://github.com/advisories/GHSA-g4jq-h2w9-997c",
"severity": "low",
"cwe": [
"CWE-22",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <=6.3.5"
},
{
"source": 1107325,
"name": "vite",
"dependency": "vite",
"title": "Vite middleware may serve files starting with the same name with the public directory",
"url": "https://github.com/advisories/GHSA-g4jq-h2w9-997c",
"severity": "low",
"cwe": [
"CWE-22",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0 <=7.0.6"
},
{
"source": 1107327,
"name": "vite",
"dependency": "vite",
"title": "Vite's `server.fs` settings were not applied to HTML files",
"url": "https://github.com/advisories/GHSA-jqfw-vq24-v9c3",
"severity": "low",
"cwe": [
"CWE-23",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=5.4.19"
},
{
"source": 1107328,
"name": "vite",
"dependency": "vite",
"title": "Vite's `server.fs` settings were not applied to HTML files",
"url": "https://github.com/advisories/GHSA-jqfw-vq24-v9c3",
"severity": "low",
"cwe": [
"CWE-23",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <=6.3.5"
},
{
"source": 1107329,
"name": "vite",
"dependency": "vite",
"title": "Vite's `server.fs` settings were not applied to HTML files",
"url": "https://github.com/advisories/GHSA-jqfw-vq24-v9c3",
"severity": "low",
"cwe": [
"CWE-23",
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0 <=7.0.6"
},
{
"source": 1109131,
"name": "vite",
"dependency": "vite",
"title": "vite allows server.fs.deny bypass via backslash on Windows",
"url": "https://github.com/advisories/GHSA-93m4-6634-74q7",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=5.2.6 <=5.4.20"
},
{
"source": 1109135,
"name": "vite",
"dependency": "vite",
"title": "vite allows server.fs.deny bypass via backslash on Windows",
"url": "https://github.com/advisories/GHSA-93m4-6634-74q7",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <=6.4.0"
},
{
"source": 1109136,
"name": "vite",
"dependency": "vite",
"title": "vite allows server.fs.deny bypass via backslash on Windows",
"url": "https://github.com/advisories/GHSA-93m4-6634-74q7",
"severity": "moderate",
"cwe": [
"CWE-22"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0 <=7.0.7"
},
{
"source": 1112512,
"name": "vite",
"dependency": "vite",
"title": "Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query",
"url": "https://github.com/advisories/GHSA-4r4m-qw57-chr8",
"severity": "moderate",
"cwe": [
"CWE-200",
"CWE-284"
],
"cvss": {
"score": 5.3,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
"range": ">=6.0.0 <6.0.13"
},
{
"source": 1116229,
"name": "vite",
"dependency": "vite",
"title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"url": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
"severity": "moderate",
"cwe": [
"CWE-22",
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": "<=6.4.1"
},
{
"source": 1116230,
"name": "vite",
"dependency": "vite",
"title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"url": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
"severity": "moderate",
"cwe": [
"CWE-22",
"CWE-200"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0 <=7.3.1"
},
{
"source": 1116234,
"name": "vite",
"dependency": "vite",
"title": "Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket",
"url": "https://github.com/advisories/GHSA-p9ff-h696-f583",
"severity": "high",
"cwe": [
"CWE-200",
"CWE-306"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=6.0.0 <=6.4.1"
},
{
"source": 1116235,
"name": "vite",
"dependency": "vite",
"title": "Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket",
"url": "https://github.com/advisories/GHSA-p9ff-h696-f583",
"severity": "high",
"cwe": [
"CWE-200",
"CWE-306"
],
"cvss": {
"score": 0,
"vectorString": null
},
"range": ">=7.0.0 <=7.3.1"
},
"esbuild"
],
"effects": [],
"range": "<=6.4.1 || 7.0.0 - 7.3.1",
"nodes": [
"node_modules/vite",
"node_modules/vitepress/node_modules/vite",
"packages/codex-docs/node_modules/vite",
"packages/codex-icons/node_modules/vite",
"packages/codex/node_modules/vite"
],
"fixAvailable": {
"name": "vite",
"version": "7.3.2",
"isSemVerMajor": false
}
},
"wait-on": {
"name": "wait-on",
"severity": "high",
"isDirect": false,
"via": [
"axios"
],
"effects": [
"start-server-and-test"
],
"range": "5.0.0-rc.0 - 7.1.0",
"nodes": [
"node_modules/wait-on"
],
"fixAvailable": {
"name": "start-server-and-test",
"version": "3.0.2",
"isSemVerMajor": true
}
},
"yaml": {
"name": "yaml",
"severity": "moderate",
"isDirect": false,
"via": [
{
"source": 1115556,
"name": "yaml",
"dependency": "yaml",
"title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"url": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp",
"severity": "moderate",
"cwe": [
"CWE-674"
],
"cvss": {
"score": 4.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
"range": ">=2.0.0 <2.8.3"
}
],
"effects": [],
"range": "2.0.0 - 2.8.2",
"nodes": [
"node_modules/netlify-cli/node_modules/@netlify/build-info/node_modules/yaml",
"node_modules/yaml"
],
"fixAvailable": true
}
},
"metadata": {
"vulnerabilities": {
"info": 0,
"low": 13,
"moderate": 29,
"high": 29,
"critical": 1,
"total": 72
},
"dependencies": {
"prod": 143,
"dev": 2633,
"optional": 282,
"peer": 103,
"peerOptional": 0,
"total": 2775
}
}
}
--- end ---
Attempting to npm audit fix
$ /usr/bin/npm audit fix --dry-run --only=dev --json
--- stderr ---
npm WARN invalid config only="dev" set in command line options
npm WARN invalid config Must be one of: null, prod, production
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR!
npm ERR! While resolving: vite@7.0.4
npm ERR! Found: tsx@4.19.2
npm ERR! node_modules/tsx
npm ERR! peerOptional tsx@"^4.8.1" from vite@7.0.4
npm ERR! packages/codex-docs/node_modules/vite
npm ERR! peer vite@"^5.0.0 || ^6.0.0 || ^7.0.0" from @vitejs/plugin-vue@6.0.0
npm ERR! packages/codex-docs/node_modules/@vitejs/plugin-vue
npm ERR! dev @vitejs/plugin-vue@"6.0.0" from codex-docs@undefined
npm ERR! packages/codex-docs
npm ERR! codex-docs@undefined
npm ERR! node_modules/codex-docs
npm ERR! dev vite@"7.0.4" from codex-docs@undefined
npm ERR! packages/codex-docs
npm ERR! codex-docs@undefined
npm ERR! node_modules/codex-docs
npm ERR! workspace packages/codex-docs from the root project
npm ERR! peerOptional tsx@"^4.8.1" from vite@7.0.4
npm ERR! packages/codex-icons/node_modules/vite
npm ERR! dev vite@"7.0.4" from @wikimedia/codex-icons@2.5.0
npm ERR! packages/codex-icons
npm ERR! @wikimedia/codex-icons@2.5.0
npm ERR! node_modules/@wikimedia/codex-icons
npm ERR! workspace packages/codex-icons from the root project
npm ERR! 2 more (@wikimedia/codex, codex-docs)
npm ERR! 3 more (vite, @wikimedia/codex, vite)
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peerOptional tsx@"^4.8.1" from vite@7.0.4
npm ERR! packages/codex/node_modules/vite
npm ERR! peer vite@"^5.0.0 || ^6.0.0 || ^7.0.0" from @vitejs/plugin-vue@6.0.0
npm ERR! packages/codex/node_modules/@vitejs/plugin-vue
npm ERR! dev @vitejs/plugin-vue@"6.0.0" from @wikimedia/codex@2.5.0
npm ERR! packages/codex
npm ERR! @wikimedia/codex@2.5.0
npm ERR! node_modules/@wikimedia/codex
npm ERR! dev vite@"7.0.4" from @wikimedia/codex@2.5.0
npm ERR! packages/codex
npm ERR! @wikimedia/codex@2.5.0
npm ERR! node_modules/@wikimedia/codex
npm ERR! workspace packages/codex from the root project
npm ERR! 1 more (codex-docs)
npm ERR!
npm ERR! Conflicting peer dependency: tsx@4.21.0
npm ERR! node_modules/tsx
npm ERR! peerOptional tsx@"^4.8.1" from vite@7.0.4
npm ERR! packages/codex/node_modules/vite
npm ERR! peer vite@"^5.0.0 || ^6.0.0 || ^7.0.0" from @vitejs/plugin-vue@6.0.0
npm ERR! packages/codex/node_modules/@vitejs/plugin-vue
npm ERR! dev @vitejs/plugin-vue@"6.0.0" from @wikimedia/codex@2.5.0
npm ERR! packages/codex
npm ERR! @wikimedia/codex@2.5.0
npm ERR! node_modules/@wikimedia/codex
npm ERR! dev vite@"7.0.4" from @wikimedia/codex@2.5.0
npm ERR! packages/codex
npm ERR! @wikimedia/codex@2.5.0
npm ERR! node_modules/@wikimedia/codex
npm ERR! workspace packages/codex from the root project
npm ERR! 1 more (codex-docs)
npm ERR!
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR!
npm ERR!
npm ERR! For a full report see:
npm ERR! /cache/_logs/2026-04-20T00_08_16_619Z-eresolve-report.txt
npm ERR! A complete log of this run can be found in:
npm ERR! /cache/_logs/2026-04-20T00_08_16_619Z-debug-0.log
--- stdout ---
{
"error": {
"code": "ERESOLVE",
"summary": "could not resolve",
"detail": "\nWhile resolving: vite@7.0.4\nFound: tsx@4.19.2\nnode_modules/tsx\n peerOptional tsx@\"^4.8.1\" from vite@7.0.4\n packages/codex-docs/node_modules/vite\n peer vite@\"^5.0.0 || ^6.0.0 || ^7.0.0\" from @vitejs/plugin-vue@6.0.0\n packages/codex-docs/node_modules/@vitejs/plugin-vue\n dev @vitejs/plugin-vue@\"6.0.0\" from codex-docs@undefined\n packages/codex-docs\n codex-docs@undefined\n node_modules/codex-docs\n dev vite@\"7.0.4\" from codex-docs@undefined\n packages/codex-docs\n codex-docs@undefined\n node_modules/codex-docs\n workspace packages/codex-docs from the root project\n peerOptional tsx@\"^4.8.1\" from vite@7.0.4\n packages/codex-icons/node_modules/vite\n dev vite@\"7.0.4\" from @wikimedia/codex-icons@2.5.0\n packages/codex-icons\n @wikimedia/codex-icons@2.5.0\n node_modules/@wikimedia/codex-icons\n workspace packages/codex-icons from the root project\n 2 more (@wikimedia/codex, codex-docs)\n 3 more (vite, @wikimedia/codex, vite)\n\nCould not resolve dependency:\npeerOptional tsx@\"^4.8.1\" from vite@7.0.4\npackages/codex/node_modules/vite\n peer vite@\"^5.0.0 || ^6.0.0 || ^7.0.0\" from @vitejs/plugin-vue@6.0.0\n packages/codex/node_modules/@vitejs/plugin-vue\n dev @vitejs/plugin-vue@\"6.0.0\" from @wikimedia/codex@2.5.0\n packages/codex\n @wikimedia/codex@2.5.0\n node_modules/@wikimedia/codex\n dev vite@\"7.0.4\" from @wikimedia/codex@2.5.0\n packages/codex\n @wikimedia/codex@2.5.0\n node_modules/@wikimedia/codex\n workspace packages/codex from the root project\n 1 more (codex-docs)\n\nConflicting peer dependency: tsx@4.21.0\nnode_modules/tsx\n peerOptional tsx@\"^4.8.1\" from vite@7.0.4\n packages/codex/node_modules/vite\n peer vite@\"^5.0.0 || ^6.0.0 || ^7.0.0\" from @vitejs/plugin-vue@6.0.0\n packages/codex/node_modules/@vitejs/plugin-vue\n dev @vitejs/plugin-vue@\"6.0.0\" from @wikimedia/codex@2.5.0\n packages/codex\n @wikimedia/codex@2.5.0\n node_modules/@wikimedia/codex\n dev vite@\"7.0.4\" from @wikimedia/codex@2.5.0\n packages/codex\n @wikimedia/codex@2.5.0\n node_modules/@wikimedia/codex\n workspace packages/codex from the root project\n 1 more (codex-docs)\n\nFix the upstream dependency conflict, or retry\nthis command with --force or --legacy-peer-deps\nto accept an incorrect (and potentially broken) dependency resolution.\n\n\nFor a full report see:\n/cache/_logs/2026-04-20T00_08_16_619Z-eresolve-report.txt"
}
}
--- end ---
{"error": {"code": "ERESOLVE", "summary": "could not resolve", "detail": "\nWhile resolving: vite@7.0.4\nFound: tsx@4.19.2\nnode_modules/tsx\n peerOptional tsx@\"^4.8.1\" from vite@7.0.4\n packages/codex-docs/node_modules/vite\n peer vite@\"^5.0.0 || ^6.0.0 || ^7.0.0\" from @vitejs/plugin-vue@6.0.0\n packages/codex-docs/node_modules/@vitejs/plugin-vue\n dev @vitejs/plugin-vue@\"6.0.0\" from codex-docs@undefined\n packages/codex-docs\n codex-docs@undefined\n node_modules/codex-docs\n dev vite@\"7.0.4\" from codex-docs@undefined\n packages/codex-docs\n codex-docs@undefined\n node_modules/codex-docs\n workspace packages/codex-docs from the root project\n peerOptional tsx@\"^4.8.1\" from vite@7.0.4\n packages/codex-icons/node_modules/vite\n dev vite@\"7.0.4\" from @wikimedia/codex-icons@2.5.0\n packages/codex-icons\n @wikimedia/codex-icons@2.5.0\n node_modules/@wikimedia/codex-icons\n workspace packages/codex-icons from the root project\n 2 more (@wikimedia/codex, codex-docs)\n 3 more (vite, @wikimedia/codex, vite)\n\nCould not resolve dependency:\npeerOptional tsx@\"^4.8.1\" from vite@7.0.4\npackages/codex/node_modules/vite\n peer vite@\"^5.0.0 || ^6.0.0 || ^7.0.0\" from @vitejs/plugin-vue@6.0.0\n packages/codex/node_modules/@vitejs/plugin-vue\n dev @vitejs/plugin-vue@\"6.0.0\" from @wikimedia/codex@2.5.0\n packages/codex\n @wikimedia/codex@2.5.0\n node_modules/@wikimedia/codex\n dev vite@\"7.0.4\" from @wikimedia/codex@2.5.0\n packages/codex\n @wikimedia/codex@2.5.0\n node_modules/@wikimedia/codex\n workspace packages/codex from the root project\n 1 more (codex-docs)\n\nConflicting peer dependency: tsx@4.21.0\nnode_modules/tsx\n peerOptional tsx@\"^4.8.1\" from vite@7.0.4\n packages/codex/node_modules/vite\n peer vite@\"^5.0.0 || ^6.0.0 || ^7.0.0\" from @vitejs/plugin-vue@6.0.0\n packages/codex/node_modules/@vitejs/plugin-vue\n dev @vitejs/plugin-vue@\"6.0.0\" from @wikimedia/codex@2.5.0\n packages/codex\n @wikimedia/codex@2.5.0\n node_modules/@wikimedia/codex\n dev vite@\"7.0.4\" from @wikimedia/codex@2.5.0\n packages/codex\n @wikimedia/codex@2.5.0\n node_modules/@wikimedia/codex\n workspace packages/codex from the root project\n 1 more (codex-docs)\n\nFix the upstream dependency conflict, or retry\nthis command with --force or --legacy-peer-deps\nto accept an incorrect (and potentially broken) dependency resolution.\n\n\nFor a full report see:\n/cache/_logs/2026-04-20T00_08_16_619Z-eresolve-report.txt"}}
Traceback (most recent call last):
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 1268, in main
libup.run()
~~~~~~~~~^^
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 1208, in run
self.npm_audit_fix(new_npm_audit)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/venv/lib/python3.13/site-packages/runner/__init__.py", line 182, in npm_audit_fix
if dry_run["audit"]["auditReportVersion"] != 2:
~~~~~~~^^^^^^^^^
KeyError: 'audit'