{"matches":[{"vulnerability":{"id":"GHSA-qqvq-6xgj-jw8g","dataSource":"https://github.com/advisories/GHSA-qqvq-6xgj-jw8g","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-5217","https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html","https://crbug.com/1486441","http://www.openwall.com/lists/oss-security/2023/09/28/5","http://www.openwall.com/lists/oss-security/2023/09/28/6","http://www.openwall.com/lists/oss-security/2023/09/29/1","http://www.openwall.com/lists/oss-security/2023/09/29/2","https://github.com/electron/electron/pull/40022","https://github.com/electron/electron/pull/40023","https://github.com/electron/electron/pull/40024","https://github.com/electron/electron/pull/40025","https://github.com/electron/electron/pull/40026","https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590","https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282","https://bugzilla.redhat.com/show_bug.cgi?id=2241191","https://github.com/electron/electron/releases/tag/v22.3.25","https://github.com/electron/electron/releases/tag/v24.8.5","https://github.com/electron/electron/releases/tag/v25.8.4","https://github.com/electron/electron/releases/tag/v26.2.4","https://github.com/electron/electron/releases/tag/v27.0.0-beta.8","https://github.com/webmproject/libvpx/releases/tag/v1.13.1","https://github.com/webmproject/libvpx/tags","https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html","https://pastebin.com/TdkC4pDv","https://security-tracker.debian.org/tracker/CVE-2023-5217","https://security.gentoo.org/glsa/202310-04","https://twitter.com/maddiestone/status/1707163313711497266","https://www.debian.org/security/2023/dsa-5508","https://www.debian.org/security/2023/dsa-5509","https://www.debian.org/security/2023/dsa-5510","https://www.openwall.com/lists/oss-security/2023/09/28/5","http://www.openwall.com/lists/oss-security/2023/09/29/11","http://www.openwall.com/lists/oss-security/2023/09/29/12","http://www.openwall.com/lists/oss-security/2023/09/29/14","http://www.openwall.com/lists/oss-security/2023/09/29/7","http://www.openwall.com/lists/oss-security/2023/09/29/9","http://www.openwall.com/lists/oss-security/2023/09/30/1","http://www.openwall.com/lists/oss-security/2023/09/30/2","http://www.openwall.com/lists/oss-security/2023/09/30/3","http://www.openwall.com/lists/oss-security/2023/09/30/4","http://www.openwall.com/lists/oss-security/2023/09/30/5","http://www.openwall.com/lists/oss-security/2023/10/01/1","http://www.openwall.com/lists/oss-security/2023/10/01/2","http://www.openwall.com/lists/oss-security/2023/10/01/5","http://www.openwall.com/lists/oss-security/2023/10/02/6","http://www.openwall.com/lists/oss-security/2023/10/03/11","http://seclists.org/fulldisclosure/2023/Oct/12","https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html","http://seclists.org/fulldisclosure/2023/Oct/16","https://support.apple.com/kb/HT213961","https://support.apple.com/kb/HT213972","https://security.gentoo.org/glsa/202401-34","https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I","https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217","https://www.mozilla.org/en-US/security/advisories/mfsa2023-44"],"description":"Electron affected by libvpx's heap buffer overflow in vp8 encoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2023-5217","vendorProject":"Google","product":"Chromium libvpx","dateAdded":"2023-10-02","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","dueDate":"2023-10-23","knownRansomwareCampaignUse":"unknown","urls":["https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html","https://nvd.nist.gov/vuln/detail/CVE-2023-5217"],"cwes":["CWE-787"]}],"epss":[{"cve":"CVE-2023-5217","epss":0.49013,"percentile":0.98881,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-5217","cwe":"CWE-787","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-5217","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["22.3.25"],"state":"fixed","available":[{"version":"22.3.25","date":"2023-10-06","kind":"first-observed"}]},"advisories":[],"risk":85.57500000000002},"relatedVulnerabilities":[{"id":"CVE-2023-5217","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5217","namespace":"nvd:cpe","severity":"High","urls":["http://seclists.org/fulldisclosure/2023/Oct/12","http://seclists.org/fulldisclosure/2023/Oct/16","http://www.openwall.com/lists/oss-security/2023/09/28/5","http://www.openwall.com/lists/oss-security/2023/09/28/6","http://www.openwall.com/lists/oss-security/2023/09/29/1","http://www.openwall.com/lists/oss-security/2023/09/29/11","http://www.openwall.com/lists/oss-security/2023/09/29/12","http://www.openwall.com/lists/oss-security/2023/09/29/14","http://www.openwall.com/lists/oss-security/2023/09/29/2","http://www.openwall.com/lists/oss-security/2023/09/29/7","http://www.openwall.com/lists/oss-security/2023/09/29/9","http://www.openwall.com/lists/oss-security/2023/09/30/1","http://www.openwall.com/lists/oss-security/2023/09/30/2","http://www.openwall.com/lists/oss-security/2023/09/30/3","http://www.openwall.com/lists/oss-security/2023/09/30/4","http://www.openwall.com/lists/oss-security/2023/09/30/5","http://www.openwall.com/lists/oss-security/2023/10/01/1","http://www.openwall.com/lists/oss-security/2023/10/01/2","http://www.openwall.com/lists/oss-security/2023/10/01/5","http://www.openwall.com/lists/oss-security/2023/10/02/6","http://www.openwall.com/lists/oss-security/2023/10/03/11","https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/","https://bugzilla.redhat.com/show_bug.cgi?id=2241191","https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html","https://crbug.com/1486441","https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590","https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282","https://github.com/webmproject/libvpx/releases/tag/v1.13.1","https://github.com/webmproject/libvpx/tags","https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/","https://pastebin.com/TdkC4pDv","https://security-tracker.debian.org/tracker/CVE-2023-5217","https://security.gentoo.org/glsa/202310-04","https://security.gentoo.org/glsa/202401-34","https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/","https://support.apple.com/kb/HT213961","https://support.apple.com/kb/HT213972","https://twitter.com/maddiestone/status/1707163313711497266","https://www.debian.org/security/2023/dsa-5508","https://www.debian.org/security/2023/dsa-5509","https://www.debian.org/security/2023/dsa-5510","https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/","https://www.openwall.com/lists/oss-security/2023/09/28/5","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5217"],"description":"Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"knownExploited":[{"cve":"CVE-2023-5217","vendorProject":"Google","product":"Chromium libvpx","dateAdded":"2023-10-02","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","dueDate":"2023-10-23","knownRansomwareCampaignUse":"unknown","urls":["https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html","https://nvd.nist.gov/vuln/detail/CVE-2023-5217"],"cwes":["CWE-787"]}],"epss":[{"cve":"CVE-2023-5217","epss":0.49013,"percentile":0.98881,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-5217","cwe":"CWE-787","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-5217","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-qqvq-6xgj-jw8g","versionConstraint":"<22.3.25 (semantic)"},"fix":{"suggestedVersion":"22.3.25"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-c4w7-xm78-47vh","dataSource":"https://github.com/advisories/GHSA-c4w7-xm78-47vh","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7774","https://github.com/yargs/y18n/issues/96","https://github.com/yargs/y18n/pull/108","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306","https://snyk.io/vuln/SNYK-JS-Y18N-1021887","https://github.com/yargs/y18n/commit/a9ac604abf756dec9687be3843e2c93bfe581f25","https://www.oracle.com/security-alerts/cpuApr2021.html","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/yargs/y18n/commit/90401eea9062ad498f4f792e3fff8008c4c193a3"],"description":"Prototype Pollution in y18n","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7774","epss":0.69589,"percentile":0.99365,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7774","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.0.1"],"state":"fixed","available":[{"version":"4.0.1","date":"2021-03-30","kind":"first-observed"}]},"advisories":[],"risk":51.49586000000001},"relatedVulnerabilities":[{"id":"CVE-2020-7774","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7774","namespace":"nvd:cpe","severity":"Critical","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/yargs/y18n/issues/96","https://github.com/yargs/y18n/pull/108","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306","https://snyk.io/vuln/SNYK-JS-Y18N-1021887","https://www.oracle.com/security-alerts/cpuApr2021.html"],"description":"The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7774","epss":0.69589,"percentile":0.99365,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7774","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"y18n","version":"4.0.0"}},"found":{"vulnerabilityID":"GHSA-c4w7-xm78-47vh","versionConstraint":"=4.0.0 (semantic)"},"fix":{"suggestedVersion":"4.0.1"}}],"artifact":{"id":"pkg:npm/y18n@4.0.0?package-id=b3a4bdeae158218e","name":"y18n","version":"4.0.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:y18n_project:y18n:4.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/y18n@4.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w573-4hg7-7wgq","dataSource":"https://github.com/advisories/GHSA-w573-4hg7-7wgq","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-38900","https://github.com/SamVerschueren/decode-uri-component/issues/5","https://github.com/sindresorhus/query-string/issues/345","https://github.com/SamVerschueren/decode-uri-component/commit/746ca5dcb6667c5d364e782d53c542830e4c10b9","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.2.1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5/"],"description":"decode-uri-component vulnerable to Denial of Service (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-38900","epss":0.2361,"percentile":0.97808,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.2.1"],"state":"fixed","available":[{"version":"0.2.1","date":"2022-12-02","kind":"first-observed"}]},"advisories":[],"risk":17.7075},"relatedVulnerabilities":[{"id":"CVE-2022-38900","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-38900","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/SamVerschueren/decode-uri-component/issues/5","https://github.com/sindresorhus/query-string/issues/345","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/"],"description":"decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-38900","epss":0.2361,"percentile":0.97808,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"decode-uri-component","version":"0.2.0"}},"found":{"vulnerabilityID":"GHSA-w573-4hg7-7wgq","versionConstraint":"<0.2.1 (semantic)"},"fix":{"suggestedVersion":"0.2.1"}}],"artifact":{"id":"pkg:npm/decode-uri-component@0.2.0?package-id=a174fcee943e47c0","name":"decode-uri-component","version":"0.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:decode-uri-component_project:decode-uri-component:0.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/decode-uri-component@0.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w573-4hg7-7wgq","dataSource":"https://github.com/advisories/GHSA-w573-4hg7-7wgq","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-38900","https://github.com/SamVerschueren/decode-uri-component/issues/5","https://github.com/sindresorhus/query-string/issues/345","https://github.com/SamVerschueren/decode-uri-component/commit/746ca5dcb6667c5d364e782d53c542830e4c10b9","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.2.1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5/"],"description":"decode-uri-component vulnerable to Denial of Service (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-38900","epss":0.2361,"percentile":0.97808,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.2.1"],"state":"fixed","available":[{"version":"0.2.1","date":"2022-12-02","kind":"first-observed"}]},"advisories":[],"risk":17.7075},"relatedVulnerabilities":[{"id":"CVE-2022-38900","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-38900","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/SamVerschueren/decode-uri-component/issues/5","https://github.com/sindresorhus/query-string/issues/345","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/"],"description":"decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-38900","epss":0.2361,"percentile":0.97808,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-38900","cwe":"CWE-20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"decode-uri-component","version":"0.2.0"}},"found":{"vulnerabilityID":"GHSA-w573-4hg7-7wgq","versionConstraint":"<0.2.1 (semantic)"},"fix":{"suggestedVersion":"0.2.1"}}],"artifact":{"id":"pkg:npm/decode-uri-component@0.2.0?package-id=c628a0855d545708","name":"decode-uri-component","version":"0.2.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:decode-uri-component_project:decode-uri-component:0.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/decode-uri-component@0.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-35jh-r3h4-6jhm","dataSource":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml"],"description":"Command Injection in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2021-05-07","kind":"first-observed"}]},"advisories":[],"risk":15.679754999999998},"relatedVulnerabilities":[{"id":"CVE-2021-23337","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-35jh-r3h4-6jhm","versionConstraint":"<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"pkg:npm/lodash@2.4.2?package-id=7a6b48925eb51c59","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-35jh-r3h4-6jhm","dataSource":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml"],"description":"Command Injection in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2021-05-07","kind":"first-observed"}]},"advisories":[],"risk":15.679754999999998},"relatedVulnerabilities":[{"id":"CVE-2021-23337","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-35jh-r3h4-6jhm","versionConstraint":"<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=c54a61e75e4999c4","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-35jh-r3h4-6jhm","dataSource":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml"],"description":"Command Injection in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2021-05-07","kind":"first-observed"}]},"advisories":[],"risk":15.679754999999998},"relatedVulnerabilities":[{"id":"CVE-2021-23337","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-35jh-r3h4-6jhm","versionConstraint":"<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=018753b8823e0ec7","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-35jh-r3h4-6jhm","dataSource":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml"],"description":"Command Injection in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2021-05-07","kind":"first-observed"}]},"advisories":[],"risk":15.679754999999998},"relatedVulnerabilities":[{"id":"CVE-2021-23337","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-35jh-r3h4-6jhm","versionConstraint":"<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=ba9b218e488409eb","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-35jh-r3h4-6jhm","dataSource":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml"],"description":"Command Injection in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":15.679754999999998},"relatedVulnerabilities":[{"id":"CVE-2021-23337","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash.template","version":"4.5.0"}},"found":{"vulnerabilityID":"GHSA-35jh-r3h4-6jhm","versionConstraint":"<=4.5.0 (semantic)"}}],"artifact":{"id":"pkg:npm/lodash.template@4.5.0?package-id=8d2bb9091577ac0d","name":"lodash.template","version":"4.5.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash.template:4.5.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash.template@4.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jfq-g458-7qm9","dataSource":"https://github.com/advisories/GHSA-3jfq-g458-7qm9","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4","https://www.npmjs.com/advisories/1770","https://www.npmjs.com/package/tar","https://nvd.nist.gov/vuln/detail/CVE-2021-32804","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"],"description":"Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-32804","epss":0.15067,"percentile":0.9673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-32804","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-32804","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.2.2"],"state":"fixed","available":[{"version":"3.2.2","date":"2021-08-04","kind":"first-observed"}]},"advisories":[],"risk":11.827594999999999},"relatedVulnerabilities":[{"id":"CVE-2021-32804","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-32804","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4","https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","https://www.npmjs.com/advisories/1770","https://www.npmjs.com/package/tar","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-32804","epss":0.15067,"percentile":0.9673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-32804","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-32804","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-3jfq-g458-7qm9","versionConstraint":"<3.2.2 (semantic)"},"fix":{"suggestedVersion":"3.2.2"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jfq-g458-7qm9","dataSource":"https://github.com/advisories/GHSA-3jfq-g458-7qm9","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4","https://www.npmjs.com/advisories/1770","https://www.npmjs.com/package/tar","https://nvd.nist.gov/vuln/detail/CVE-2021-32804","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"],"description":"Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-32804","epss":0.15067,"percentile":0.9673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-32804","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-32804","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.4.14"],"state":"fixed","available":[{"version":"4.4.14","date":"2021-08-04","kind":"first-observed"}]},"advisories":[],"risk":11.827594999999999},"relatedVulnerabilities":[{"id":"CVE-2021-32804","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-32804","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4","https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","https://www.npmjs.com/advisories/1770","https://www.npmjs.com/package/tar","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-32804","epss":0.15067,"percentile":0.9673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-32804","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-32804","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-3jfq-g458-7qm9","versionConstraint":">=4.0.0,<4.4.14 (semantic)"},"fix":{"suggestedVersion":"4.4.14"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-hrpp-h998-j3pp","dataSource":"https://github.com/advisories/GHSA-hrpp-h998-j3pp","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-24999","https://github.com/ljharb/qs/pull/428","https://github.com/n8tz/CVE-2022-24999","https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec","https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68","https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b","https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d","https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1","https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105","https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f","https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee","https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda","https://github.com/expressjs/express/releases/tag/4.17.3","https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","https://security.netapp.com/advisory/ntap-20230908-0005"],"description":"qs vulnerable to Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24999","epss":0.15622,"percentile":0.96843,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.4.1"],"state":"fixed","available":[{"version":"6.4.1","date":"2022-12-07","kind":"first-observed"}]},"advisories":[],"risk":11.7165},"relatedVulnerabilities":[{"id":"CVE-2022-24999","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24999","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/express/releases/tag/4.17.3","https://github.com/ljharb/qs/pull/428","https://github.com/n8tz/CVE-2022-24999","https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","https://security.netapp.com/advisory/ntap-20230908-0005/"],"description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24999","epss":0.15622,"percentile":0.96843,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.4.0"}},"found":{"vulnerabilityID":"GHSA-hrpp-h998-j3pp","versionConstraint":">=6.4.0,<6.4.1 (semantic)"},"fix":{"suggestedVersion":"6.4.1"}}],"artifact":{"id":"pkg:npm/qs@6.4.0?package-id=20732df25e595c98","name":"qs","version":"6.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hrpp-h998-j3pp","dataSource":"https://github.com/advisories/GHSA-hrpp-h998-j3pp","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-24999","https://github.com/ljharb/qs/pull/428","https://github.com/n8tz/CVE-2022-24999","https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec","https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68","https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b","https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d","https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1","https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105","https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f","https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee","https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda","https://github.com/expressjs/express/releases/tag/4.17.3","https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","https://security.netapp.com/advisory/ntap-20230908-0005"],"description":"qs vulnerable to Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24999","epss":0.15622,"percentile":0.96843,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.5.3"],"state":"fixed","available":[{"version":"6.5.3","date":"2022-12-07","kind":"first-observed"}]},"advisories":[],"risk":11.7165},"relatedVulnerabilities":[{"id":"CVE-2022-24999","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24999","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/express/releases/tag/4.17.3","https://github.com/ljharb/qs/pull/428","https://github.com/n8tz/CVE-2022-24999","https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","https://security.netapp.com/advisory/ntap-20230908-0005/"],"description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24999","epss":0.15622,"percentile":0.96843,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.5.2"}},"found":{"vulnerabilityID":"GHSA-hrpp-h998-j3pp","versionConstraint":">=6.5.0,<6.5.3 (semantic)"},"fix":{"suggestedVersion":"6.5.3"}}],"artifact":{"id":"pkg:npm/qs@6.5.2?package-id=6d31126b7caf030d","name":"qs","version":"6.5.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.5.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.5.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-hrpp-h998-j3pp","dataSource":"https://github.com/advisories/GHSA-hrpp-h998-j3pp","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-24999","https://github.com/ljharb/qs/pull/428","https://github.com/n8tz/CVE-2022-24999","https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec","https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68","https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b","https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d","https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1","https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105","https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f","https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee","https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda","https://github.com/expressjs/express/releases/tag/4.17.3","https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","https://security.netapp.com/advisory/ntap-20230908-0005"],"description":"qs vulnerable to Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24999","epss":0.15622,"percentile":0.96843,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.7.3"],"state":"fixed","available":[{"version":"6.7.3","date":"2022-12-07","kind":"first-observed"}]},"advisories":[],"risk":11.7165},"relatedVulnerabilities":[{"id":"CVE-2022-24999","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24999","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/express/releases/tag/4.17.3","https://github.com/ljharb/qs/pull/428","https://github.com/n8tz/CVE-2022-24999","https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html","https://security.netapp.com/advisory/ntap-20230908-0005/"],"description":"qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has \"deps: qs@6.9.7\" in its release description, is not vulnerable).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24999","epss":0.15622,"percentile":0.96843,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-24999","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.7.0"}},"found":{"vulnerabilityID":"GHSA-hrpp-h998-j3pp","versionConstraint":">=6.7.0,<6.7.3 (semantic)"},"fix":{"suggestedVersion":"6.7.3"}}],"artifact":{"id":"pkg:npm/qs@6.7.0?package-id=48756c534af1cb28","name":"qs","version":"6.7.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9c47-m6qq-7p4h","dataSource":"https://github.com/advisories/GHSA-9c47-m6qq-7p4h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://nvd.nist.gov/vuln/detail/CVE-2022-46175","https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/commit/62a65408408d40aeea14c7869ed327acead12972","https://github.com/json5/json5/commit/7774c1097993bc3ce9f0ac4b722a32bf7d6871c8","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE"],"description":"Prototype Pollution in JSON5 via Parse Method","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.0.2"],"state":"fixed","available":[{"version":"1.0.2","date":"2023-01-04","kind":"first-observed"}]},"advisories":[],"risk":7.07954},"relatedVulnerabilities":[{"id":"CVE-2022-46175","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-46175","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/"],"description":"JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"json5","version":"0.5.1"}},"found":{"vulnerabilityID":"GHSA-9c47-m6qq-7p4h","versionConstraint":"<1.0.2 (semantic)"},"fix":{"suggestedVersion":"1.0.2"}}],"artifact":{"id":"pkg:npm/json5@0.5.1?package-id=a04ffa5c13d027e9","name":"json5","version":"0.5.1","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:json5:json5:0.5.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/json5@0.5.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-9c47-m6qq-7p4h","dataSource":"https://github.com/advisories/GHSA-9c47-m6qq-7p4h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://nvd.nist.gov/vuln/detail/CVE-2022-46175","https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/commit/62a65408408d40aeea14c7869ed327acead12972","https://github.com/json5/json5/commit/7774c1097993bc3ce9f0ac4b722a32bf7d6871c8","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE"],"description":"Prototype Pollution in JSON5 via Parse Method","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.0.2"],"state":"fixed","available":[{"version":"1.0.2","date":"2023-01-04","kind":"first-observed"}]},"advisories":[],"risk":7.07954},"relatedVulnerabilities":[{"id":"CVE-2022-46175","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-46175","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/"],"description":"JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"json5","version":"0.5.1"}},"found":{"vulnerabilityID":"GHSA-9c47-m6qq-7p4h","versionConstraint":"<1.0.2 (semantic)"},"fix":{"suggestedVersion":"1.0.2"}}],"artifact":{"id":"pkg:npm/json5@0.5.1?package-id=6118df959d26f2e8","name":"json5","version":"0.5.1","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:json5:json5:0.5.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/json5@0.5.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-9c47-m6qq-7p4h","dataSource":"https://github.com/advisories/GHSA-9c47-m6qq-7p4h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://nvd.nist.gov/vuln/detail/CVE-2022-46175","https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/commit/62a65408408d40aeea14c7869ed327acead12972","https://github.com/json5/json5/commit/7774c1097993bc3ce9f0ac4b722a32bf7d6871c8","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE"],"description":"Prototype Pollution in JSON5 via Parse Method","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.0.2"],"state":"fixed","available":[{"version":"1.0.2","date":"2023-01-04","kind":"first-observed"}]},"advisories":[],"risk":7.07954},"relatedVulnerabilities":[{"id":"CVE-2022-46175","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-46175","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/"],"description":"JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"json5","version":"0.5.1"}},"found":{"vulnerabilityID":"GHSA-9c47-m6qq-7p4h","versionConstraint":"<1.0.2 (semantic)"},"fix":{"suggestedVersion":"1.0.2"}}],"artifact":{"id":"pkg:npm/json5@0.5.1?package-id=07b0c6ec113c3e34","name":"json5","version":"0.5.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:json5:json5:0.5.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/json5@0.5.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-9c47-m6qq-7p4h","dataSource":"https://github.com/advisories/GHSA-9c47-m6qq-7p4h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://nvd.nist.gov/vuln/detail/CVE-2022-46175","https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/commit/62a65408408d40aeea14c7869ed327acead12972","https://github.com/json5/json5/commit/7774c1097993bc3ce9f0ac4b722a32bf7d6871c8","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE"],"description":"Prototype Pollution in JSON5 via Parse Method","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.2.2"],"state":"fixed","available":[{"version":"2.2.2","date":"2022-12-30","kind":"first-observed"}]},"advisories":[],"risk":7.07954},"relatedVulnerabilities":[{"id":"CVE-2022-46175","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-46175","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/"],"description":"JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"json5","version":"2.2.0"}},"found":{"vulnerabilityID":"GHSA-9c47-m6qq-7p4h","versionConstraint":">=2.0.0,<2.2.2 (semantic)"},"fix":{"suggestedVersion":"2.2.2"}}],"artifact":{"id":"pkg:npm/json5@2.2.0?package-id=50b908fdf2bc184c","name":"json5","version":"2.2.0","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:json5:json5:2.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/json5@2.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9c47-m6qq-7p4h","dataSource":"https://github.com/advisories/GHSA-9c47-m6qq-7p4h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://nvd.nist.gov/vuln/detail/CVE-2022-46175","https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/commit/62a65408408d40aeea14c7869ed327acead12972","https://github.com/json5/json5/commit/7774c1097993bc3ce9f0ac4b722a32bf7d6871c8","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE"],"description":"Prototype Pollution in JSON5 via Parse Method","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.2.2"],"state":"fixed","available":[{"version":"2.2.2","date":"2022-12-30","kind":"first-observed"}]},"advisories":[],"risk":7.07954},"relatedVulnerabilities":[{"id":"CVE-2022-46175","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-46175","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/"],"description":"JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"json5","version":"2.2.0"}},"found":{"vulnerabilityID":"GHSA-9c47-m6qq-7p4h","versionConstraint":">=2.0.0,<2.2.2 (semantic)"},"fix":{"suggestedVersion":"2.2.2"}}],"artifact":{"id":"pkg:npm/json5@2.2.0?package-id=45bca30c37c4b103","name":"json5","version":"2.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:json5:json5:2.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/json5@2.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9c47-m6qq-7p4h","dataSource":"https://github.com/advisories/GHSA-9c47-m6qq-7p4h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://nvd.nist.gov/vuln/detail/CVE-2022-46175","https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/commit/62a65408408d40aeea14c7869ed327acead12972","https://github.com/json5/json5/commit/7774c1097993bc3ce9f0ac4b722a32bf7d6871c8","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE"],"description":"Prototype Pollution in JSON5 via Parse Method","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.2.2"],"state":"fixed","available":[{"version":"2.2.2","date":"2022-12-30","kind":"first-observed"}]},"advisories":[],"risk":7.07954},"relatedVulnerabilities":[{"id":"CVE-2022-46175","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-46175","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/json5/json5/issues/199","https://github.com/json5/json5/issues/295","https://github.com/json5/json5/pull/298","https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h","https://lists.debian.org/debian-lts-announce/2023/11/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3S26TLPLVFAJTUN3VIXFDEBEXDYO22CE/"],"description":"JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-46175","epss":0.09698,"percentile":0.95509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-46175","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"json5","version":"2.2.0"}},"found":{"vulnerabilityID":"GHSA-9c47-m6qq-7p4h","versionConstraint":">=2.0.0,<2.2.2 (semantic)"},"fix":{"suggestedVersion":"2.2.2"}}],"artifact":{"id":"pkg:npm/json5@2.2.0?package-id=ad2121dedd845f4f","name":"json5","version":"2.2.0","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:json5:json5:2.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/json5@2.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-r628-mhmh-qjhw","dataSource":"https://github.com/advisories/GHSA-r628-mhmh-qjhw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw","https://github.com/npm/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20","https://www.npmjs.com/advisories/1771","https://nvd.nist.gov/vuln/detail/CVE-2021-32803","https://www.npmjs.com/package/tar","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/isaacs/node-tar/commit/46fe35083e2676e31c4e0a81639dce6da7aaa356","https://github.com/isaacs/node-tar/commit/5987d9a41f6bfbf1ddab1098e1fdcf1a5618f571","https://github.com/isaacs/node-tar/commit/85d3a942b4064e4ff171f91696fced7975167349","https://github.com/isaacs/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20"],"description":"Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-32803","epss":0.07795,"percentile":0.94661,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-32803","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-32803","cwe":"CWE-59","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.4.15"],"state":"fixed","available":[{"version":"4.4.15","date":"2021-08-04","kind":"first-observed"}]},"advisories":[],"risk":6.119075},"relatedVulnerabilities":[{"id":"CVE-2021-32803","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-32803","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/npm/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20","https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw","https://www.npmjs.com/advisories/1771","https://www.npmjs.com/package/tar","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"The npm package \"tar\" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-32803","epss":0.07795,"percentile":0.94661,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-32803","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-32803","cwe":"CWE-59","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-r628-mhmh-qjhw","versionConstraint":">=4.0.0,<4.4.15 (semantic)"},"fix":{"suggestedVersion":"4.4.15"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-x6fg-f45m-jf5q","dataSource":"https://github.com/advisories/GHSA-x6fg-f45m-jf5q","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-8855","https://www.npmjs.com/advisories/31","https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS","http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.securityfocus.com/bid/86957","https://github.com/github/advisory-database/pull/7102","https://github.com/npm/node-semver/commit/5c4c9f6e26c7052a42b5ced2a7481c5c9b4363a0","https://github.com/npm/node-semver/commit/c80180d8341a8ada0236815c29a2be59864afd70"],"description":"Regular Expression Denial of Service in semver","cvss":[{"type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-8855","epss":0.06887,"percentile":0.94072,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2015-8855","cwe":"CWE-399","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.3.2"],"state":"fixed","available":[{"version":"4.3.2","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":5.16525},"relatedVulnerabilities":[{"id":"CVE-2015-8855","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-8855","namespace":"nvd:cpe","severity":"High","urls":["http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.securityfocus.com/bid/86957","https://nodesecurity.io/advisories/31"],"description":"The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a \"regular expression denial of service (ReDoS).\"","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"exploitabilityScore":10,"impactScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-8855","epss":0.06887,"percentile":0.94072,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2015-8855","cwe":"CWE-399","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"2.2.1"}},"found":{"vulnerabilityID":"GHSA-x6fg-f45m-jf5q","versionConstraint":">=1.0.4,<4.3.2 (semantic)"},"fix":{"suggestedVersion":"4.3.2"}}],"artifact":{"id":"pkg:npm/semver@2.2.1?package-id=71a35fa02d8c3389","name":"semver","version":"2.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:2.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@2.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-jf85-cpcp-j695","dataSource":"https://github.com/advisories/GHSA-jf85-cpcp-j695","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/lodash/lodash/pull/4336","https://nvd.nist.gov/vuln/detail/CVE-2019-10744","https://snyk.io/vuln/SNYK-JS-LODASH-450202","https://access.redhat.com/errata/RHSA-2019:3024","https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp;utm_medium=RSS","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp%3Butm_medium=RSS","https://security.netapp.com/advisory/ntap-20191004-0005","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-10744.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10744","epss":0.05006,"percentile":0.9224,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-10744","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.12"],"state":"fixed","available":[{"version":"4.17.12","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":4.53043},"relatedVulnerabilities":[{"id":"CVE-2019-10744","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10744","namespace":"nvd:cpe","severity":"Critical","urls":["https://access.redhat.com/errata/RHSA-2019:3024","https://security.netapp.com/advisory/ntap-20191004-0005/","https://snyk.io/vuln/SNYK-JS-LODASH-450202","https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp%3Butm_medium=RSS","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"description":"Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"exploitabilityScore":10,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10744","epss":0.05006,"percentile":0.9224,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-10744","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-jf85-cpcp-j695","versionConstraint":"<4.17.12 (semantic)"},"fix":{"suggestedVersion":"4.17.12"}}],"artifact":{"id":"pkg:npm/lodash@2.4.2?package-id=7a6b48925eb51c59","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xvch-5gv4-984h","dataSource":"https://github.com/advisories/GHSA-xvch-5gv4-984h","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44906","https://github.com/substack/minimist/issues/164","https://github.com/substack/minimist/blob/master/index.js#L69","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/minimistjs/minimist/issues/11","https://github.com/minimistjs/minimist/pull/24","https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703","https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb","https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d","https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11","https://github.com/minimistjs/minimist/commits/v0.2.4","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2023-03-01","kind":"first-observed"}]},"advisories":[],"risk":4.30614},"relatedVulnerabilities":[{"id":"CVE-2021-44906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/substack/minimist/blob/master/index.js#L69","https://github.com/substack/minimist/issues/164","https://security.netapp.com/advisory/ntap-20240621-0006/","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"],"description":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"0.0.10"}},"found":{"vulnerabilityID":"GHSA-xvch-5gv4-984h","versionConstraint":"<0.2.4 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/minimist@0.0.10?package-id=afa454d6a75c818c","name":"minimist","version":"0.0.10","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:0.0.10:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@0.0.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-xvch-5gv4-984h","dataSource":"https://github.com/advisories/GHSA-xvch-5gv4-984h","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44906","https://github.com/substack/minimist/issues/164","https://github.com/substack/minimist/blob/master/index.js#L69","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/minimistjs/minimist/issues/11","https://github.com/minimistjs/minimist/pull/24","https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703","https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb","https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d","https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11","https://github.com/minimistjs/minimist/commits/v0.2.4","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2023-03-01","kind":"first-observed"}]},"advisories":[],"risk":4.30614},"relatedVulnerabilities":[{"id":"CVE-2021-44906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/substack/minimist/blob/master/index.js#L69","https://github.com/substack/minimist/issues/164","https://security.netapp.com/advisory/ntap-20240621-0006/","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"],"description":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"0.0.8"}},"found":{"vulnerabilityID":"GHSA-xvch-5gv4-984h","versionConstraint":"<0.2.4 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/minimist@0.0.8?package-id=4f68b30a302d2a75","name":"minimist","version":"0.0.8","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:0.0.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@0.0.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-xvch-5gv4-984h","dataSource":"https://github.com/advisories/GHSA-xvch-5gv4-984h","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44906","https://github.com/substack/minimist/issues/164","https://github.com/substack/minimist/blob/master/index.js#L69","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/minimistjs/minimist/issues/11","https://github.com/minimistjs/minimist/pull/24","https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703","https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb","https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d","https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11","https://github.com/minimistjs/minimist/commits/v0.2.4","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2023-03-01","kind":"first-observed"}]},"advisories":[],"risk":4.30614},"relatedVulnerabilities":[{"id":"CVE-2021-44906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/substack/minimist/blob/master/index.js#L69","https://github.com/substack/minimist/issues/164","https://security.netapp.com/advisory/ntap-20240621-0006/","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"],"description":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"0.0.8"}},"found":{"vulnerabilityID":"GHSA-xvch-5gv4-984h","versionConstraint":"<0.2.4 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/minimist@0.0.8?package-id=a1e50bdf96bae7b4","name":"minimist","version":"0.0.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:0.0.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@0.0.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-xvch-5gv4-984h","dataSource":"https://github.com/advisories/GHSA-xvch-5gv4-984h","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44906","https://github.com/substack/minimist/issues/164","https://github.com/substack/minimist/blob/master/index.js#L69","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/minimistjs/minimist/issues/11","https://github.com/minimistjs/minimist/pull/24","https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703","https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb","https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d","https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11","https://github.com/minimistjs/minimist/commits/v0.2.4","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2023-03-01","kind":"first-observed"}]},"advisories":[],"risk":4.30614},"relatedVulnerabilities":[{"id":"CVE-2021-44906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/substack/minimist/blob/master/index.js#L69","https://github.com/substack/minimist/issues/164","https://security.netapp.com/advisory/ntap-20240621-0006/","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"],"description":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"0.0.8"}},"found":{"vulnerabilityID":"GHSA-xvch-5gv4-984h","versionConstraint":"<0.2.4 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/minimist@0.0.8?package-id=fcfdadd30c7ba661","name":"minimist","version":"0.0.8","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:0.0.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@0.0.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-xvch-5gv4-984h","dataSource":"https://github.com/advisories/GHSA-xvch-5gv4-984h","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44906","https://github.com/substack/minimist/issues/164","https://github.com/substack/minimist/blob/master/index.js#L69","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/minimistjs/minimist/issues/11","https://github.com/minimistjs/minimist/pull/24","https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703","https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb","https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d","https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11","https://github.com/minimistjs/minimist/commits/v0.2.4","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.2.6"],"state":"fixed","available":[{"version":"1.2.6","date":"2022-03-24","kind":"first-observed"}]},"advisories":[],"risk":4.30614},"relatedVulnerabilities":[{"id":"CVE-2021-44906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/substack/minimist/blob/master/index.js#L69","https://github.com/substack/minimist/issues/164","https://security.netapp.com/advisory/ntap-20240621-0006/","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"],"description":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"1.1.3"}},"found":{"vulnerabilityID":"GHSA-xvch-5gv4-984h","versionConstraint":">=1.0.0,<1.2.6 (semantic)"},"fix":{"suggestedVersion":"1.2.6"}}],"artifact":{"id":"pkg:npm/minimist@1.1.3?package-id=1900c889dca61237","name":"minimist","version":"1.1.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:1.1.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@1.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-xvch-5gv4-984h","dataSource":"https://github.com/advisories/GHSA-xvch-5gv4-984h","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44906","https://github.com/substack/minimist/issues/164","https://github.com/substack/minimist/blob/master/index.js#L69","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/minimistjs/minimist/issues/11","https://github.com/minimistjs/minimist/pull/24","https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703","https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb","https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d","https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11","https://github.com/minimistjs/minimist/commits/v0.2.4","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.2.6"],"state":"fixed","available":[{"version":"1.2.6","date":"2022-03-24","kind":"first-observed"}]},"advisories":[],"risk":4.30614},"relatedVulnerabilities":[{"id":"CVE-2021-44906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/substack/minimist/blob/master/index.js#L69","https://github.com/substack/minimist/issues/164","https://security.netapp.com/advisory/ntap-20240621-0006/","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"],"description":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"1.2.0"}},"found":{"vulnerabilityID":"GHSA-xvch-5gv4-984h","versionConstraint":">=1.0.0,<1.2.6 (semantic)"},"fix":{"suggestedVersion":"1.2.6"}}],"artifact":{"id":"pkg:npm/minimist@1.2.0?package-id=31eac31db3232a54","name":"minimist","version":"1.2.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:1.2.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@1.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xvch-5gv4-984h","dataSource":"https://github.com/advisories/GHSA-xvch-5gv4-984h","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44906","https://github.com/substack/minimist/issues/164","https://github.com/substack/minimist/blob/master/index.js#L69","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/minimistjs/minimist/issues/11","https://github.com/minimistjs/minimist/pull/24","https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703","https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb","https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d","https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11","https://github.com/minimistjs/minimist/commits/v0.2.4","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.2.6"],"state":"fixed","available":[{"version":"1.2.6","date":"2022-03-24","kind":"first-observed"}]},"advisories":[],"risk":4.30614},"relatedVulnerabilities":[{"id":"CVE-2021-44906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/substack/minimist/blob/master/index.js#L69","https://github.com/substack/minimist/issues/164","https://security.netapp.com/advisory/ntap-20240621-0006/","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"],"description":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"1.2.5"}},"found":{"vulnerabilityID":"GHSA-xvch-5gv4-984h","versionConstraint":">=1.0.0,<1.2.6 (semantic)"},"fix":{"suggestedVersion":"1.2.6"}}],"artifact":{"id":"pkg:npm/minimist@1.2.5?package-id=04ab3b2fd7a0b19a","name":"minimist","version":"1.2.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:1.2.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@1.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-xvch-5gv4-984h","dataSource":"https://github.com/advisories/GHSA-xvch-5gv4-984h","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44906","https://github.com/substack/minimist/issues/164","https://github.com/substack/minimist/blob/master/index.js#L69","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/minimistjs/minimist/issues/11","https://github.com/minimistjs/minimist/pull/24","https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703","https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb","https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d","https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11","https://github.com/minimistjs/minimist/commits/v0.2.4","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.2.6"],"state":"fixed","available":[{"version":"1.2.6","date":"2022-03-24","kind":"first-observed"}]},"advisories":[],"risk":4.30614},"relatedVulnerabilities":[{"id":"CVE-2021-44906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/substack/minimist/blob/master/index.js#L69","https://github.com/substack/minimist/issues/164","https://security.netapp.com/advisory/ntap-20240621-0006/","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"],"description":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"1.2.5"}},"found":{"vulnerabilityID":"GHSA-xvch-5gv4-984h","versionConstraint":">=1.0.0,<1.2.6 (semantic)"},"fix":{"suggestedVersion":"1.2.6"}}],"artifact":{"id":"pkg:npm/minimist@1.2.5?package-id=dcaf811aeeb49ecc","name":"minimist","version":"1.2.5","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:1.2.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@1.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-xvch-5gv4-984h","dataSource":"https://github.com/advisories/GHSA-xvch-5gv4-984h","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44906","https://github.com/substack/minimist/issues/164","https://github.com/substack/minimist/blob/master/index.js#L69","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068","https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/minimistjs/minimist/issues/11","https://github.com/minimistjs/minimist/pull/24","https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703","https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb","https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d","https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11","https://github.com/minimistjs/minimist/commits/v0.2.4","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.2.6"],"state":"fixed","available":[{"version":"1.2.6","date":"2022-03-24","kind":"first-observed"}]},"advisories":[],"risk":4.30614},"relatedVulnerabilities":[{"id":"CVE-2021-44906","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip","https://github.com/substack/minimist/blob/master/index.js#L69","https://github.com/substack/minimist/issues/164","https://security.netapp.com/advisory/ntap-20240621-0006/","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068"],"description":"Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-44906","epss":0.04581,"percentile":0.91634,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-44906","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"1.2.5"}},"found":{"vulnerabilityID":"GHSA-xvch-5gv4-984h","versionConstraint":">=1.0.0,<1.2.6 (semantic)"},"fix":{"suggestedVersion":"1.2.6"}}],"artifact":{"id":"pkg:npm/minimist@1.2.5?package-id=940931626fbc7c30","name":"minimist","version":"1.2.5","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:1.2.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@1.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-p6mc-m468-83gw","dataSource":"https://github.com/advisories/GHSA-p6mc-m468-83gw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/issues/4744","https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12","https://nvd.nist.gov/vuln/detail/CVE-2020-8203","https://hackerone.com/reports/712065","https://github.com/lodash/lodash/issues/4874","https://github.com/github/advisory-database/pull/2884","https://hackerone.com/reports/864701","https://github.com/lodash/lodash/wiki/Changelog#v41719","https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744","https://security.netapp.com/advisory/ntap-20200724-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.05213,"percentile":0.92501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":3.883685},"relatedVulnerabilities":[{"id":"CVE-2020-8203","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8203","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/lodash/lodash/issues/4874","https://hackerone.com/reports/712065","https://security.netapp.com/advisory/ntap-20200724-0006/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.05213,"percentile":0.92501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash.pick","version":"4.4.0"}},"found":{"vulnerabilityID":"GHSA-p6mc-m468-83gw","versionConstraint":">=4.0.0,<=4.4.0 (semantic)"}}],"artifact":{"id":"pkg:npm/lodash.pick@4.4.0?package-id=499bcdad42d57617","name":"lodash.pick","version":"4.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash.pick:lodash.pick:4.4.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/lodash.pick@4.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-29mw-wpgm-hmr9","dataSource":"https://github.com/advisories/GHSA-29mw-wpgm-hmr9","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-28500","https://github.com/lodash/lodash/pull/5065","https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-28500.yml","https://github.com/github/advisory-database/pull/6139"],"description":"Regular Expression Denial of Service (ReDoS) in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28500","epss":0.07336,"percentile":0.94394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-28500","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2022-01-07","kind":"first-observed"}]},"advisories":[],"risk":3.77804},"relatedVulnerabilities":[{"id":"CVE-2020-28500","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-28500","namespace":"nvd:cpe","severity":"Medium","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://github.com/lodash/lodash/pull/5065","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28500","epss":0.07336,"percentile":0.94394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-28500","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-29mw-wpgm-hmr9","versionConstraint":">=4.0.0,<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=018753b8823e0ec7","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-29mw-wpgm-hmr9","dataSource":"https://github.com/advisories/GHSA-29mw-wpgm-hmr9","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-28500","https://github.com/lodash/lodash/pull/5065","https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-28500.yml","https://github.com/github/advisory-database/pull/6139"],"description":"Regular Expression Denial of Service (ReDoS) in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28500","epss":0.07336,"percentile":0.94394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-28500","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2022-01-07","kind":"first-observed"}]},"advisories":[],"risk":3.77804},"relatedVulnerabilities":[{"id":"CVE-2020-28500","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-28500","namespace":"nvd:cpe","severity":"Medium","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://github.com/lodash/lodash/pull/5065","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28500","epss":0.07336,"percentile":0.94394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-28500","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-29mw-wpgm-hmr9","versionConstraint":">=4.0.0,<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=ba9b218e488409eb","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-29mw-wpgm-hmr9","dataSource":"https://github.com/advisories/GHSA-29mw-wpgm-hmr9","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-28500","https://github.com/lodash/lodash/pull/5065","https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-28500.yml","https://github.com/github/advisory-database/pull/6139"],"description":"Regular Expression Denial of Service (ReDoS) in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28500","epss":0.07336,"percentile":0.94394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-28500","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2022-01-07","kind":"first-observed"}]},"advisories":[],"risk":3.77804},"relatedVulnerabilities":[{"id":"CVE-2020-28500","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-28500","namespace":"nvd:cpe","severity":"Medium","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://github.com/lodash/lodash/pull/5065","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28500","epss":0.07336,"percentile":0.94394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-28500","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-29mw-wpgm-hmr9","versionConstraint":">=4.0.0,<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=c54a61e75e4999c4","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-jp4x-w63m-7wgm","dataSource":"https://github.com/advisories/GHSA-jp4x-w63m-7wgm","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-3728","https://hackerone.com/reports/310439","https://github.com/hapijs/hoek/commit/32ed5c9413321fbc37da5ca81a7cbab693786dee","https://access.redhat.com/errata/RHSA-2018:1263","https://access.redhat.com/errata/RHSA-2018:1264","https://snyk.io/vuln/npm:hoek:20180212","https://github.com/hapijs/hoek/commit/5aed1a8c4a3d55722d1c799f2368857bf418d6df","https://web.archive.org/web/20200227131737/https://www.securityfocus.com/bid/103108"],"description":"Prototype Pollution in hoek","cvss":[{"type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3728","epss":0.0419,"percentile":0.90937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2018-3728","cwe":"CWE-471","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2018-3728","cwe":"CWE-471","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":3.4148500000000004},"relatedVulnerabilities":[{"id":"CVE-2018-3728","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-3728","namespace":"nvd:cpe","severity":"High","urls":["http://www.securityfocus.com/bid/103108","https://access.redhat.com/errata/RHSA-2018:1263","https://access.redhat.com/errata/RHSA-2018:1264","https://github.com/hapijs/hoek/commit/32ed5c9413321fbc37da5ca81a7cbab693786dee","https://hackerone.com/reports/310439","https://nodesecurity.io/advisories/566","https://snyk.io/vuln/npm:hoek:20180212"],"description":"hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3728","epss":0.0419,"percentile":0.90937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2018-3728","cwe":"CWE-471","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2018-3728","cwe":"CWE-471","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hoek","version":"2.16.3"}},"found":{"vulnerabilityID":"GHSA-jp4x-w63m-7wgm","versionConstraint":"<4.2.1 (semantic)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:npm/hoek@2.16.3?package-id=8c4967f292409a05","name":"hoek","version":"2.16.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:hoek:hoek:2.16.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/hoek@2.16.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-34r7-q49f-h37c","dataSource":"https://github.com/advisories/GHSA-34r7-q49f-h37c","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-8857","https://github.com/mishoo/UglifyJS2/issues/751","https://zyan.scripts.mit.edu/blog/backdooring-js/","http://www.openwall.com/lists/oss-security/2016/04/20/11","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml","https://web.archive.org/web/20200227190830/http://www.securityfocus.com/bid/96410","https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e"],"description":"Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-8857","epss":0.03559,"percentile":0.8933,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2015-8857","cwe":"CWE-254","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.4.24"],"state":"fixed","available":[{"version":"2.4.24","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":3.34546},"relatedVulnerabilities":[{"id":"CVE-2015-8857","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-8857","namespace":"nvd:cpe","severity":"Critical","urls":["http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.securityfocus.com/bid/96410","https://nodesecurity.io/advisories/39"],"description":"The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-8857","epss":0.03559,"percentile":0.8933,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2015-8857","cwe":"CWE-254","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uglify-js","version":"2.2.5"}},"found":{"vulnerabilityID":"GHSA-34r7-q49f-h37c","versionConstraint":"<2.4.24 (semantic)"},"fix":{"suggestedVersion":"2.4.24"}}],"artifact":{"id":"pkg:npm/uglify-js@2.2.5?package-id=4211a14eca224db7","name":"uglify-js","version":"2.2.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:uglifyjs_project:uglifyjs:2.2.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uglify-js@2.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-93q8-gq69-wqmw","dataSource":"https://github.com/advisories/GHSA-93q8-gq69-wqmw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3807","https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9","https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","https://github.com/chalk/ansi-regex/issues/38#issuecomment-924086311","https://app.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908","https://github.com/chalk/ansi-regex/issues/38#issuecomment-925924774","https://github.com/chalk/ansi-regex/releases/tag/v6.0.1","https://www.oracle.com/security-alerts/cpuapr2022.html","https://security.netapp.com/advisory/ntap-20221014-0002/","https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1","https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a","https://github.com/chalk/ansi-regex/commit/c3c0b3f2736b9c01feec0fef33980c43720dcde8"],"description":"Inefficient Regular Expression Complexity in chalk/ansi-regex","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3807","epss":0.03552,"percentile":0.89312,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.0.1"],"state":"fixed","available":[{"version":"3.0.1","date":"2022-03-29","kind":"first-observed"}]},"advisories":[],"risk":2.6640000000000006},"relatedVulnerabilities":[{"id":"CVE-2021-3807","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3807","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9","https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","https://security.netapp.com/advisory/ntap-20221014-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"description":"ansi-regex is vulnerable to Inefficient Regular Expression Complexity","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"exploitabilityScore":10,"impactScore":6.9},"vendorMetadata":{}},{"source":"security@huntr.dev","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3807","epss":0.03552,"percentile":0.89312,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ansi-regex","version":"3.0.0"}},"found":{"vulnerabilityID":"GHSA-93q8-gq69-wqmw","versionConstraint":">=3.0.0,<3.0.1 (semantic)"},"fix":{"suggestedVersion":"3.0.1"}}],"artifact":{"id":"pkg:npm/ansi-regex@3.0.0?package-id=c9edd65cfc81830e","name":"ansi-regex","version":"3.0.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ansi-regex_project:ansi-regex:3.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ansi-regex@3.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-93q8-gq69-wqmw","dataSource":"https://github.com/advisories/GHSA-93q8-gq69-wqmw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3807","https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9","https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","https://github.com/chalk/ansi-regex/issues/38#issuecomment-924086311","https://app.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908","https://github.com/chalk/ansi-regex/issues/38#issuecomment-925924774","https://github.com/chalk/ansi-regex/releases/tag/v6.0.1","https://www.oracle.com/security-alerts/cpuapr2022.html","https://security.netapp.com/advisory/ntap-20221014-0002/","https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1","https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a","https://github.com/chalk/ansi-regex/commit/c3c0b3f2736b9c01feec0fef33980c43720dcde8"],"description":"Inefficient Regular Expression Complexity in chalk/ansi-regex","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3807","epss":0.03552,"percentile":0.89312,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.0.1"],"state":"fixed","available":[{"version":"3.0.1","date":"2022-03-29","kind":"first-observed"}]},"advisories":[],"risk":2.6640000000000006},"relatedVulnerabilities":[{"id":"CVE-2021-3807","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3807","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9","https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","https://security.netapp.com/advisory/ntap-20221014-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"description":"ansi-regex is vulnerable to Inefficient Regular Expression Complexity","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"exploitabilityScore":10,"impactScore":6.9},"vendorMetadata":{}},{"source":"security@huntr.dev","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3807","epss":0.03552,"percentile":0.89312,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ansi-regex","version":"3.0.0"}},"found":{"vulnerabilityID":"GHSA-93q8-gq69-wqmw","versionConstraint":">=3.0.0,<3.0.1 (semantic)"},"fix":{"suggestedVersion":"3.0.1"}}],"artifact":{"id":"pkg:npm/ansi-regex@3.0.0?package-id=22a69252d332f8a1","name":"ansi-regex","version":"3.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ansi-regex_project:ansi-regex:3.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ansi-regex@3.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-93q8-gq69-wqmw","dataSource":"https://github.com/advisories/GHSA-93q8-gq69-wqmw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3807","https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9","https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","https://github.com/chalk/ansi-regex/issues/38#issuecomment-924086311","https://app.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908","https://github.com/chalk/ansi-regex/issues/38#issuecomment-925924774","https://github.com/chalk/ansi-regex/releases/tag/v6.0.1","https://www.oracle.com/security-alerts/cpuapr2022.html","https://security.netapp.com/advisory/ntap-20221014-0002/","https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1","https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a","https://github.com/chalk/ansi-regex/commit/c3c0b3f2736b9c01feec0fef33980c43720dcde8"],"description":"Inefficient Regular Expression Complexity in chalk/ansi-regex","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3807","epss":0.03552,"percentile":0.89312,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.1.1"],"state":"fixed","available":[{"version":"4.1.1","date":"2022-03-26","kind":"first-observed"}]},"advisories":[],"risk":2.6640000000000006},"relatedVulnerabilities":[{"id":"CVE-2021-3807","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3807","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9","https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","https://security.netapp.com/advisory/ntap-20221014-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"description":"ansi-regex is vulnerable to Inefficient Regular Expression Complexity","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"exploitabilityScore":10,"impactScore":6.9},"vendorMetadata":{}},{"source":"security@huntr.dev","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3807","epss":0.03552,"percentile":0.89312,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ansi-regex","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-93q8-gq69-wqmw","versionConstraint":">=4.0.0,<4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.1.1"}}],"artifact":{"id":"pkg:npm/ansi-regex@4.1.0?package-id=9e582704d11d43d7","name":"ansi-regex","version":"4.1.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ansi-regex_project:ansi-regex:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ansi-regex@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-93q8-gq69-wqmw","dataSource":"https://github.com/advisories/GHSA-93q8-gq69-wqmw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3807","https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9","https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","https://github.com/chalk/ansi-regex/issues/38#issuecomment-924086311","https://app.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908","https://github.com/chalk/ansi-regex/issues/38#issuecomment-925924774","https://github.com/chalk/ansi-regex/releases/tag/v6.0.1","https://www.oracle.com/security-alerts/cpuapr2022.html","https://security.netapp.com/advisory/ntap-20221014-0002/","https://github.com/chalk/ansi-regex/commit/419250fa510bf31b4cc672e76537a64f9332e1f1","https://github.com/chalk/ansi-regex/commit/75a657da7af875b2e2724fd6331bf0a4b23d3c9a","https://github.com/chalk/ansi-regex/commit/c3c0b3f2736b9c01feec0fef33980c43720dcde8"],"description":"Inefficient Regular Expression Complexity in chalk/ansi-regex","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3807","epss":0.03552,"percentile":0.89312,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.1.1"],"state":"fixed","available":[{"version":"4.1.1","date":"2022-03-26","kind":"first-observed"}]},"advisories":[],"risk":2.6640000000000006},"relatedVulnerabilities":[{"id":"CVE-2021-3807","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3807","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9","https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","https://security.netapp.com/advisory/ntap-20221014-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"description":"ansi-regex is vulnerable to Inefficient Regular Expression Complexity","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"exploitabilityScore":10,"impactScore":6.9},"vendorMetadata":{}},{"source":"security@huntr.dev","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3807","epss":0.03552,"percentile":0.89312,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3807","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ansi-regex","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-93q8-gq69-wqmw","versionConstraint":">=4.0.0,<4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.1.1"}}],"artifact":{"id":"pkg:npm/ansi-regex@4.1.0?package-id=0dbf6a3c1c89ffe4","name":"ansi-regex","version":"4.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ansi-regex_project:ansi-regex:4.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ansi-regex@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9r2w-394v-53qc","dataSource":"https://github.com/advisories/GHSA-9r2w-394v-53qc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc","https://www.npmjs.com/package/tar","https://nvd.nist.gov/vuln/detail/CVE-2021-37701","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.debian.org/security/2021/dsa-5008","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://lists.debian.org/debian-lts-announce/2022/12/msg00023.html"],"description":"Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-37701","epss":0.03286,"percentile":0.8847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-37701","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37701","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37701","cwe":"CWE-59","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.4.16"],"state":"fixed","available":[{"version":"4.4.16","date":"2021-09-01","kind":"first-observed"}]},"advisories":[],"risk":2.57951},"relatedVulnerabilities":[{"id":"CVE-2021-37701","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-37701","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc","https://lists.debian.org/debian-lts-announce/2022/12/msg00023.html","https://www.debian.org/security/2021/dsa-5008","https://www.npmjs.com/package/tar","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"The npm package \"tar\" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both `\\` and `/` characters as path separators, however `\\` is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at `FOO`, followed by a symbolic link named `foo`, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but _not_ from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the `FOO` directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"exploitabilityScore":1.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.4,"exploitabilityScore":3.4,"impactScore":6.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-37701","epss":0.03286,"percentile":0.8847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-37701","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37701","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37701","cwe":"CWE-59","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-9r2w-394v-53qc","versionConstraint":">=3.0.0,<4.4.16 (semantic)"},"fix":{"suggestedVersion":"4.4.16"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-fwr7-v2mv-hh25","dataSource":"https://github.com/advisories/GHSA-fwr7-v2mv-hh25","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-43138","https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d","https://github.com/caolan/async/blob/master/lib/internal/iterator.js","https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js","https://github.com/caolan/async/pull/1828","https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2","https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264","https://github.com/caolan/async/compare/v2.6.3...v2.6.4","https://jsfiddle.net/oz5twjd9","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Prototype Pollution in async","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-43138","epss":0.03346,"percentile":0.88673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-43138","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.6.4"],"state":"fixed","available":[{"version":"2.6.4","date":"2022-04-15","kind":"first-observed"}]},"advisories":[],"risk":2.55969},"relatedVulnerabilities":[{"id":"CVE-2021-43138","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-43138","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/caolan/async/blob/master/lib/internal/iterator.js","https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js","https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264","https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d","https://github.com/caolan/async/compare/v2.6.3...v2.6.4","https://github.com/caolan/async/pull/1828","https://jsfiddle.net/oz5twjd9/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/","https://security.netapp.com/advisory/ntap-20240621-0006/"],"description":"In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-43138","epss":0.03346,"percentile":0.88673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-43138","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"async","version":"2.6.1"}},"found":{"vulnerabilityID":"GHSA-fwr7-v2mv-hh25","versionConstraint":">=2.0.0,<2.6.4 (semantic)"},"fix":{"suggestedVersion":"2.6.4"}}],"artifact":{"id":"pkg:npm/async@2.6.1?package-id=4782e0c2b1d8f2c8","name":"async","version":"2.6.1","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:async:async:2.6.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/async@2.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-fwr7-v2mv-hh25","dataSource":"https://github.com/advisories/GHSA-fwr7-v2mv-hh25","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-43138","https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d","https://github.com/caolan/async/blob/master/lib/internal/iterator.js","https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js","https://github.com/caolan/async/pull/1828","https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2","https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264","https://github.com/caolan/async/compare/v2.6.3...v2.6.4","https://jsfiddle.net/oz5twjd9","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"Prototype Pollution in async","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-43138","epss":0.03346,"percentile":0.88673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-43138","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.6.4"],"state":"fixed","available":[{"version":"2.6.4","date":"2022-04-15","kind":"first-observed"}]},"advisories":[],"risk":2.55969},"relatedVulnerabilities":[{"id":"CVE-2021-43138","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-43138","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/caolan/async/blob/master/lib/internal/iterator.js","https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js","https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264","https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d","https://github.com/caolan/async/compare/v2.6.3...v2.6.4","https://github.com/caolan/async/pull/1828","https://jsfiddle.net/oz5twjd9/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/","https://security.netapp.com/advisory/ntap-20240621-0006/"],"description":"In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-43138","epss":0.03346,"percentile":0.88673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-43138","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"async","version":"2.6.1"}},"found":{"vulnerabilityID":"GHSA-fwr7-v2mv-hh25","versionConstraint":">=2.0.0,<2.6.4 (semantic)"},"fix":{"suggestedVersion":"2.6.4"}}],"artifact":{"id":"pkg:npm/async@2.6.1?package-id=c497e9eda01a3d93","name":"async","version":"2.6.1","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:async:async:2.6.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/async@2.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4wf5-vphf-c2xc","dataSource":"https://github.com/advisories/GHSA-4wf5-vphf-c2xc","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25858","https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b","https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012","https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722","https://snyk.io/vuln/SNYK-JS-TERSER-2806366"],"description":"Terser insecure use of regular expressions leads to ReDoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25858","epss":0.03253,"percentile":0.88347,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25858","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.8.1"],"state":"fixed","available":[{"version":"4.8.1","date":"2022-07-21","kind":"first-observed"}]},"advisories":[],"risk":2.43975},"relatedVulnerabilities":[{"id":"CVE-2022-25858","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25858","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135","https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b","https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722","https://snyk.io/vuln/SNYK-JS-TERSER-2806366"],"description":"The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25858","epss":0.03253,"percentile":0.88347,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25858","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"terser","version":"3.12.0"}},"found":{"vulnerabilityID":"GHSA-4wf5-vphf-c2xc","versionConstraint":"<4.8.1 (semantic)"},"fix":{"suggestedVersion":"4.8.1"}}],"artifact":{"id":"pkg:npm/terser@3.12.0?package-id=bae8e7ec04f3ce5d","name":"terser","version":"3.12.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:terser:terser:3.12.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/terser@3.12.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4cpg-3vgw-4877","dataSource":"https://github.com/advisories/GHSA-4cpg-3vgw-4877","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22912","https://github.com/TooTallNate/plist.js/issues/114","https://github.com/TooTallNate/plist.js/pull/118","https://github.com/TooTallNate/plist.js/commit/96e2303d059e6be0c9e0c4773226d14b4758de52"],"description":"Prototype pollution in Plist before 3.0.5 can cause denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22912","epss":0.02553,"percentile":0.85049,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-22912","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.0.5"],"state":"fixed","available":[{"version":"3.0.5","date":"2022-03-26","kind":"first-observed"}]},"advisories":[],"risk":2.39982},"relatedVulnerabilities":[{"id":"CVE-2022-22912","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22912","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/TooTallNate/plist.js/issues/114"],"description":"Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22912","epss":0.02553,"percentile":0.85049,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-22912","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"plist","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-4cpg-3vgw-4877","versionConstraint":"<3.0.5 (semantic)"},"fix":{"suggestedVersion":"3.0.5"}}],"artifact":{"id":"pkg:npm/plist@2.1.0?package-id=435a7bfa8d46adda","name":"plist","version":"2.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:plist_project:plist:2.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/plist@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4cpg-3vgw-4877","dataSource":"https://github.com/advisories/GHSA-4cpg-3vgw-4877","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22912","https://github.com/TooTallNate/plist.js/issues/114","https://github.com/TooTallNate/plist.js/pull/118","https://github.com/TooTallNate/plist.js/commit/96e2303d059e6be0c9e0c4773226d14b4758de52"],"description":"Prototype pollution in Plist before 3.0.5 can cause denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22912","epss":0.02553,"percentile":0.85049,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-22912","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.0.5"],"state":"fixed","available":[{"version":"3.0.5","date":"2022-03-26","kind":"first-observed"}]},"advisories":[],"risk":2.39982},"relatedVulnerabilities":[{"id":"CVE-2022-22912","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22912","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/TooTallNate/plist.js/issues/114"],"description":"Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-22912","epss":0.02553,"percentile":0.85049,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-22912","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"plist","version":"3.0.1"}},"found":{"vulnerabilityID":"GHSA-4cpg-3vgw-4877","versionConstraint":"<3.0.5 (semantic)"},"fix":{"suggestedVersion":"3.0.5"}}],"artifact":{"id":"pkg:npm/plist@3.0.1?package-id=9282b31628a89628","name":"plist","version":"3.0.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:plist_project:plist:3.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/plist@3.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-4g88-fppr-53pp","dataSource":"https://github.com/advisories/GHSA-4g88-fppr-53pp","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-10747","https://snyk.io/vuln/SNYK-JS-SETVALUE-450213","https://www.npmjs.com/advisories/1012","https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292@%3Cdev.drat.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT/","https://github.com/jonschlinkert/set-value/commit/95e9d9923f8a8b4a01da1ea138fcc39ec7b6b15f","https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad"],"description":"Prototype Pollution in set-value","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10747","epss":0.02475,"percentile":0.84545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-10747","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":2.3265000000000002},"relatedVulnerabilities":[{"id":"CVE-2019-10747","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10747","namespace":"nvd:cpe","severity":"Critical","urls":["https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292%40%3Cdev.drat.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT/","https://snyk.io/vuln/SNYK-JS-SETVALUE-450213"],"description":"set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10747","epss":0.02475,"percentile":0.84545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-10747","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"set-value","version":"0.4.3"}},"found":{"vulnerabilityID":"GHSA-4g88-fppr-53pp","versionConstraint":"<2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"pkg:npm/set-value@0.4.3?package-id=9e8e5a5502807f65","name":"set-value","version":"0.4.3","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:set-value_project:set-value:0.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/set-value@0.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-4g88-fppr-53pp","dataSource":"https://github.com/advisories/GHSA-4g88-fppr-53pp","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-10747","https://snyk.io/vuln/SNYK-JS-SETVALUE-450213","https://www.npmjs.com/advisories/1012","https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292@%3Cdev.drat.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT/","https://github.com/jonschlinkert/set-value/commit/95e9d9923f8a8b4a01da1ea138fcc39ec7b6b15f","https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad"],"description":"Prototype Pollution in set-value","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10747","epss":0.02475,"percentile":0.84545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-10747","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":2.3265000000000002},"relatedVulnerabilities":[{"id":"CVE-2019-10747","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10747","namespace":"nvd:cpe","severity":"Critical","urls":["https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292%40%3Cdev.drat.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT/","https://snyk.io/vuln/SNYK-JS-SETVALUE-450213"],"description":"set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10747","epss":0.02475,"percentile":0.84545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-10747","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"set-value","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-4g88-fppr-53pp","versionConstraint":"<2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"pkg:npm/set-value@2.0.0?package-id=8bec15c9300d8789","name":"set-value","version":"2.0.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:set-value_project:set-value:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/set-value@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-7p7h-4mm5-852v","dataSource":"https://github.com/advisories/GHSA-7p7h-4mm5-852v","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-33623","https://github.com/sindresorhus/trim-newlines/commit/25246c6ce5eea1c82d448998733a6302a4350d91","https://github.com/sindresorhus/trim-newlines/releases/tag/v4.0.1","https://www.npmjs.com/package/trim-newlines","https://security.netapp.com/advisory/ntap-20210702-0007/","https://lists.debian.org/debian-lts-announce/2022/12/msg00033.html","https://github.com/sindresorhus/trim-newlines/commit/b10d5f4afef832b16bc56d49fc52c68cbd403869"],"description":"Uncontrolled Resource Consumption in trim-newlines","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-33623","epss":0.02925,"percentile":0.8706,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-33623","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.0.1"],"state":"fixed","available":[{"version":"3.0.1","date":"2021-06-08","kind":"first-observed"}]},"advisories":[],"risk":2.19375},"relatedVulnerabilities":[{"id":"CVE-2021-33623","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33623","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sindresorhus/trim-newlines/releases/tag/v4.0.1","https://lists.debian.org/debian-lts-announce/2022/12/msg00033.html","https://security.netapp.com/advisory/ntap-20210702-0007/","https://www.npmjs.com/package/trim-newlines"],"description":"The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-33623","epss":0.02925,"percentile":0.8706,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-33623","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"trim-newlines","version":"1.0.0"}},"found":{"vulnerabilityID":"GHSA-7p7h-4mm5-852v","versionConstraint":"<3.0.1 (semantic)"},"fix":{"suggestedVersion":"3.0.1"}}],"artifact":{"id":"pkg:npm/trim-newlines@1.0.0?package-id=fe1537920b41dafc","name":"trim-newlines","version":"1.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:trim-newlines_project:trim-newlines:1.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/trim-newlines@1.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-r5fr-rjxr-66jc","dataSource":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://nvd.nist.gov/vuln/detail/CVE-2026-4800","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-35jh-r3h4-6jhm"],"description":"lodash vulnerable to Code Injection via `_.template` imports key names","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":2.19024},"relatedVulnerabilities":[{"id":"CVE-2026-4800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://access.redhat.com/errata/RHBA-2026:21387","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10710","https://access.redhat.com/errata/RHSA-2026:10713","https://access.redhat.com/errata/RHSA-2026:11454","https://access.redhat.com/errata/RHSA-2026:11469","https://access.redhat.com/errata/RHSA-2026:11470","https://access.redhat.com/errata/RHSA-2026:11471","https://access.redhat.com/errata/RHSA-2026:11493","https://access.redhat.com/errata/RHSA-2026:11494","https://access.redhat.com/errata/RHSA-2026:11495","https://access.redhat.com/errata/RHSA-2026:11516","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13553","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17549","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:19008","https://access.redhat.com/errata/RHSA-2026:19167","https://access.redhat.com/errata/RHSA-2026:19409","https://access.redhat.com/errata/RHSA-2026:19410","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8498","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-4800","https://bugzilla.redhat.com/show_bug.cgi?id=2453496","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"],"description":"The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-r5fr-rjxr-66jc","versionConstraint":">=4.0.0,<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=c54a61e75e4999c4","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-r5fr-rjxr-66jc","dataSource":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://nvd.nist.gov/vuln/detail/CVE-2026-4800","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-35jh-r3h4-6jhm"],"description":"lodash vulnerable to Code Injection via `_.template` imports key names","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":2.19024},"relatedVulnerabilities":[{"id":"CVE-2026-4800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://access.redhat.com/errata/RHBA-2026:21387","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10710","https://access.redhat.com/errata/RHSA-2026:10713","https://access.redhat.com/errata/RHSA-2026:11454","https://access.redhat.com/errata/RHSA-2026:11469","https://access.redhat.com/errata/RHSA-2026:11470","https://access.redhat.com/errata/RHSA-2026:11471","https://access.redhat.com/errata/RHSA-2026:11493","https://access.redhat.com/errata/RHSA-2026:11494","https://access.redhat.com/errata/RHSA-2026:11495","https://access.redhat.com/errata/RHSA-2026:11516","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13553","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17549","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:19008","https://access.redhat.com/errata/RHSA-2026:19167","https://access.redhat.com/errata/RHSA-2026:19409","https://access.redhat.com/errata/RHSA-2026:19410","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8498","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-4800","https://bugzilla.redhat.com/show_bug.cgi?id=2453496","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"],"description":"The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-r5fr-rjxr-66jc","versionConstraint":">=4.0.0,<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=018753b8823e0ec7","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-r5fr-rjxr-66jc","dataSource":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://nvd.nist.gov/vuln/detail/CVE-2026-4800","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-35jh-r3h4-6jhm"],"description":"lodash vulnerable to Code Injection via `_.template` imports key names","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":2.19024},"relatedVulnerabilities":[{"id":"CVE-2026-4800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://access.redhat.com/errata/RHBA-2026:21387","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10710","https://access.redhat.com/errata/RHSA-2026:10713","https://access.redhat.com/errata/RHSA-2026:11454","https://access.redhat.com/errata/RHSA-2026:11469","https://access.redhat.com/errata/RHSA-2026:11470","https://access.redhat.com/errata/RHSA-2026:11471","https://access.redhat.com/errata/RHSA-2026:11493","https://access.redhat.com/errata/RHSA-2026:11494","https://access.redhat.com/errata/RHSA-2026:11495","https://access.redhat.com/errata/RHSA-2026:11516","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13553","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17549","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:19008","https://access.redhat.com/errata/RHSA-2026:19167","https://access.redhat.com/errata/RHSA-2026:19409","https://access.redhat.com/errata/RHSA-2026:19410","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8498","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-4800","https://bugzilla.redhat.com/show_bug.cgi?id=2453496","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"],"description":"The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-r5fr-rjxr-66jc","versionConstraint":">=4.0.0,<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=ba9b218e488409eb","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-r5fr-rjxr-66jc","dataSource":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://nvd.nist.gov/vuln/detail/CVE-2026-4800","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-35jh-r3h4-6jhm"],"description":"lodash vulnerable to Code Injection via `_.template` imports key names","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":2.19024},"relatedVulnerabilities":[{"id":"CVE-2026-4800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://access.redhat.com/errata/RHBA-2026:21387","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10710","https://access.redhat.com/errata/RHSA-2026:10713","https://access.redhat.com/errata/RHSA-2026:11454","https://access.redhat.com/errata/RHSA-2026:11469","https://access.redhat.com/errata/RHSA-2026:11470","https://access.redhat.com/errata/RHSA-2026:11471","https://access.redhat.com/errata/RHSA-2026:11493","https://access.redhat.com/errata/RHSA-2026:11494","https://access.redhat.com/errata/RHSA-2026:11495","https://access.redhat.com/errata/RHSA-2026:11516","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13553","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17549","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:19008","https://access.redhat.com/errata/RHSA-2026:19167","https://access.redhat.com/errata/RHSA-2026:19409","https://access.redhat.com/errata/RHSA-2026:19410","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8498","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-4800","https://bugzilla.redhat.com/show_bug.cgi?id=2453496","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"],"description":"The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.21"}},"found":{"vulnerabilityID":"GHSA-r5fr-rjxr-66jc","versionConstraint":">=4.0.0,<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.21?package-id=cb6dfff11809ad1e","name":"lodash","version":"4.17.21","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.21","upstreams":[]}},{"vulnerability":{"id":"GHSA-r5fr-rjxr-66jc","dataSource":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://nvd.nist.gov/vuln/detail/CVE-2026-4800","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-35jh-r3h4-6jhm"],"description":"lodash vulnerable to Code Injection via `_.template` imports key names","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":2.19024},"relatedVulnerabilities":[{"id":"CVE-2026-4800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://access.redhat.com/errata/RHBA-2026:21387","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10710","https://access.redhat.com/errata/RHSA-2026:10713","https://access.redhat.com/errata/RHSA-2026:11454","https://access.redhat.com/errata/RHSA-2026:11469","https://access.redhat.com/errata/RHSA-2026:11470","https://access.redhat.com/errata/RHSA-2026:11471","https://access.redhat.com/errata/RHSA-2026:11493","https://access.redhat.com/errata/RHSA-2026:11494","https://access.redhat.com/errata/RHSA-2026:11495","https://access.redhat.com/errata/RHSA-2026:11516","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13553","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17549","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:19008","https://access.redhat.com/errata/RHSA-2026:19167","https://access.redhat.com/errata/RHSA-2026:19409","https://access.redhat.com/errata/RHSA-2026:19410","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8498","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-4800","https://bugzilla.redhat.com/show_bug.cgi?id=2453496","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"],"description":"The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02808,"percentile":0.86506,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash.template","version":"4.5.0"}},"found":{"vulnerabilityID":"GHSA-r5fr-rjxr-66jc","versionConstraint":">=4.0.0,<4.18.0 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash.template@4.5.0?package-id=8d2bb9091577ac0d","name":"lodash.template","version":"4.5.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash.template:4.5.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash.template@4.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["5.7.2"],"state":"fixed","available":[{"version":"5.7.2","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"2.2.1"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=2.0.0-alpha,<5.7.2 (semantic)"},"fix":{"suggestedVersion":"5.7.2"}}],"artifact":{"id":"pkg:npm/semver@2.2.1?package-id=71a35fa02d8c3389","name":"semver","version":"2.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:2.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@2.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["5.7.2"],"state":"fixed","available":[{"version":"5.7.2","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"5.3.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=2.0.0-alpha,<5.7.2 (semantic)"},"fix":{"suggestedVersion":"5.7.2"}}],"artifact":{"id":"pkg:npm/semver@5.3.0?package-id=7ad000c7695fd7b8","name":"semver","version":"5.3.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:5.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@5.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["5.7.2"],"state":"fixed","available":[{"version":"5.7.2","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"5.5.1"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=2.0.0-alpha,<5.7.2 (semantic)"},"fix":{"suggestedVersion":"5.7.2"}}],"artifact":{"id":"pkg:npm/semver@5.5.1?package-id=581bd4f4e86507e1","name":"semver","version":"5.5.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:5.5.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@5.5.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["5.7.2"],"state":"fixed","available":[{"version":"5.7.2","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"5.7.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=2.0.0-alpha,<5.7.2 (semantic)"},"fix":{"suggestedVersion":"5.7.2"}}],"artifact":{"id":"pkg:npm/semver@5.7.0?package-id=8f9416e180a698c0","name":"semver","version":"5.7.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:5.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@5.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["5.7.2"],"state":"fixed","available":[{"version":"5.7.2","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"5.7.1"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=2.0.0-alpha,<5.7.2 (semantic)"},"fix":{"suggestedVersion":"5.7.2"}}],"artifact":{"id":"pkg:npm/semver@5.7.1?package-id=8ed5c77bbf184264","name":"semver","version":"5.7.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:5.7.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@5.7.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["5.7.2"],"state":"fixed","available":[{"version":"5.7.2","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"5.7.1"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=2.0.0-alpha,<5.7.2 (semantic)"},"fix":{"suggestedVersion":"5.7.2"}}],"artifact":{"id":"pkg:npm/semver@5.7.1?package-id=e369f8f49b9d92c1","name":"semver","version":"5.7.1","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:5.7.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@5.7.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["5.7.2"],"state":"fixed","available":[{"version":"5.7.2","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"5.7.1"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=2.0.0-alpha,<5.7.2 (semantic)"},"fix":{"suggestedVersion":"5.7.2"}}],"artifact":{"id":"pkg:npm/semver@5.7.1?package-id=5c3330d42516475b","name":"semver","version":"5.7.1","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:5.7.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@5.7.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.3.1"],"state":"fixed","available":[{"version":"6.3.1","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"6.3.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=6.0.0,<6.3.1 (semantic)"},"fix":{"suggestedVersion":"6.3.1"}}],"artifact":{"id":"pkg:npm/semver@6.3.0?package-id=09a357ca53eb199a","name":"semver","version":"6.3.0","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:6.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@6.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.3.1"],"state":"fixed","available":[{"version":"6.3.1","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"6.3.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=6.0.0,<6.3.1 (semantic)"},"fix":{"suggestedVersion":"6.3.1"}}],"artifact":{"id":"pkg:npm/semver@6.3.0?package-id=40dfb83d71f7bfcb","name":"semver","version":"6.3.0","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:6.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@6.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.3.1"],"state":"fixed","available":[{"version":"6.3.1","date":"2023-07-11","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"6.3.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=6.0.0,<6.3.1 (semantic)"},"fix":{"suggestedVersion":"6.3.1"}}],"artifact":{"id":"pkg:npm/semver@6.3.0?package-id=a86ffcaa86821397","name":"semver","version":"6.3.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:6.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@6.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.5.2"],"state":"fixed","available":[{"version":"7.5.2","date":"2023-06-23","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"7.0.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=7.0.0,<7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.2"}}],"artifact":{"id":"pkg:npm/semver@7.0.0?package-id=180f12b097ee83a6","name":"semver","version":"7.0.0","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:7.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@7.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.5.2"],"state":"fixed","available":[{"version":"7.5.2","date":"2023-06-23","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"7.0.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=7.0.0,<7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.2"}}],"artifact":{"id":"pkg:npm/semver@7.0.0?package-id=f4281c734e880811","name":"semver","version":"7.0.0","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:7.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@7.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.5.2"],"state":"fixed","available":[{"version":"7.5.2","date":"2023-06-23","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"7.0.0"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=7.0.0,<7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.2"}}],"artifact":{"id":"pkg:npm/semver@7.0.0?package-id=a280131d9220e4ec","name":"semver","version":"7.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:7.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@7.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2qf-rxjj-qqgw","dataSource":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25883","https://github.com/npm/node-semver/pull/564","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js#L138","https://github.com/npm/node-semver/blob/main/internal/re.js#L160","https://github.com/npm/node-semver/pull/585","https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c","https://github.com/npm/node-semver/pull/593","https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0","https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://security.netapp.com/advisory/ntap-20241025-0004"],"description":"semver vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.5.2"],"state":"fixed","available":[{"version":"7.5.2","date":"2023-06-23","kind":"first-observed"}]},"advisories":[],"risk":2.07075},"relatedVulnerabilities":[{"id":"CVE-2022-25883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25883","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104","https://github.com/npm/node-semver/blob/main/internal/re.js%23L138","https://github.com/npm/node-semver/blob/main/internal/re.js%23L160","https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441","https://github.com/npm/node-semver/pull/564","https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795","https://security.netapp.com/advisory/ntap-20241025-0004/"],"description":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25883","epss":0.02761,"percentile":0.86272,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25883","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"semver","version":"7.5.1"}},"found":{"vulnerabilityID":"GHSA-c2qf-rxjj-qqgw","versionConstraint":">=7.0.0,<7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.2"}}],"artifact":{"id":"pkg:npm/semver@7.5.1?package-id=b6a660686c47bb95","name":"semver","version":"7.5.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:npmjs:semver:7.5.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/semver@7.5.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r8j5-h5cx-65gg","dataSource":"https://github.com/advisories/GHSA-r8j5-h5cx-65gg","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-29059","https://github.com/sindresorhus/is-svg/releases/tag/v4.3.0","https://github.com/yetingli/PoCs/blob/main/CVE-2021-29059/IS-SVG.md","https://github.com/yetingli/SaveResults/blob/main/js/is-svg.js","https://www.npmjs.com/package/is-svg","https://github.com/sindresorhus/is-svg/commit/732fc72779840c45a30817d3fe28e12058592b02"],"description":"ReDOS in IS-SVG","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-29059","epss":0.02629,"percentile":0.8551,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-29059","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.3.0"],"state":"fixed","available":[{"version":"4.3.0","date":"2021-12-11","kind":"first-observed"}]},"advisories":[],"risk":1.97175},"relatedVulnerabilities":[{"id":"CVE-2021-29059","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-29059","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sindresorhus/is-svg/releases/tag/v4.3.0","https://github.com/yetingli/PoCs/blob/main/CVE-2021-29059/IS-SVG.md","https://github.com/yetingli/SaveResults/blob/main/js/is-svg.js","https://www.npmjs.com/package/is-svg"],"description":"A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-29059","epss":0.02629,"percentile":0.8551,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-29059","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"is-svg","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-r8j5-h5cx-65gg","versionConstraint":">=2.1.0,<4.3.0 (semantic)"},"fix":{"suggestedVersion":"4.3.0"}}],"artifact":{"id":"pkg:npm/is-svg@2.1.0?package-id=4ea7aeb94476916b","name":"is-svg","version":"2.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:is-svg:is-svg:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:is-svg:is_svg:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:is_svg:is-svg:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:is_svg:is_svg:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:is:is-svg:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:is:is_svg:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/is-svg@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2w6w-674q-4c4q","dataSource":"https://github.com/advisories/GHSA-2w6w-674q-4c4q","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33937"],"description":"Handlebars.js has JavaScript Injection via AST Type Confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33937","epss":0.01907,"percentile":0.79759,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":1.7925800000000003},"relatedVulnerabilities":[{"id":"CVE-2026-33937","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33937","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33937","https://bugzilla.redhat.com/show_bug.cgi?id=2452523","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33937.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to `compile()` can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. Validate input type before calling `Handlebars.compile()`; ensure the argument is always a  `string`, never a plain object or JSON-deserialized value. Use the Handlebars runtime-only build (`handlebars/runtime`) on the server if templates are pre-compiled at build time; `compile()` will be unavailable.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33937","epss":0.01907,"percentile":0.79759,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33937","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.7"}},"found":{"vulnerabilityID":"GHSA-2w6w-674q-4c4q","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.7?package-id=94a6b0a915fbcc9f","name":"handlebars","version":"4.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.7:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-c9f4-xj24-8jqx","dataSource":"https://github.com/advisories/GHSA-c9f4-xj24-8jqx","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-8858","https://www.npmjs.com/advisories/48","http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.securityfocus.com/bid/96409"],"description":"Regular Expression Denial of Service in uglify-js","cvss":[{"type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-8858","epss":0.02358,"percentile":0.83761,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2015-8858","cwe":"CWE-399","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.6.0"],"state":"fixed","available":[{"version":"2.6.0","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.7685},"relatedVulnerabilities":[{"id":"CVE-2015-8858","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-8858","namespace":"nvd:cpe","severity":"High","urls":["http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.securityfocus.com/bid/96409","https://nodesecurity.io/advisories/48"],"description":"The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a \"regular expression denial of service (ReDoS).\"","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"exploitabilityScore":10,"impactScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-8858","epss":0.02358,"percentile":0.83761,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2015-8858","cwe":"CWE-399","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uglify-js","version":"2.2.5"}},"found":{"vulnerabilityID":"GHSA-c9f4-xj24-8jqx","versionConstraint":"<2.6.0 (semantic)"},"fix":{"suggestedVersion":"2.6.0"}}],"artifact":{"id":"pkg:npm/uglify-js@2.2.5?package-id=4211a14eca224db7","name":"uglify-js","version":"2.2.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:uglifyjs_project:uglifyjs:2.2.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uglify-js@2.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-6c8f-qphg-qjgp","dataSource":"https://github.com/advisories/GHSA-6c8f-qphg-qjgp","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-20149","https://github.com/jonschlinkert/kind-of/issues/30","https://github.com/jonschlinkert/kind-of/pull/31","https://github.com/jonschlinkert/kind-of/commit/1df992ce6d5a1292048e5fe9c52c5382f941ee0b","https://snyk.io/vuln/SNYK-JS-KINDOF-537849","https://www.npmjs.com/advisories/1490"],"description":"Validation Bypass in kind-of","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-20149","epss":0.02342,"percentile":0.83635,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-20149","cwe":"CWE-668","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["6.0.3"],"state":"fixed","available":[{"version":"6.0.3","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.7565000000000002},"relatedVulnerabilities":[{"id":"CVE-2019-20149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jonschlinkert/kind-of/issues/30","https://github.com/jonschlinkert/kind-of/pull/31"],"description":"ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-20149","epss":0.02342,"percentile":0.83635,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-20149","cwe":"CWE-668","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"kind-of","version":"6.0.2"}},"found":{"vulnerabilityID":"GHSA-6c8f-qphg-qjgp","versionConstraint":">=6.0.0,<6.0.3 (semantic)"},"fix":{"suggestedVersion":"6.0.3"}}],"artifact":{"id":"pkg:npm/kind-of@6.0.2?package-id=4569de34e75c20ac","name":"kind-of","version":"6.0.2","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:kind-of:kind-of:6.0.2:*:*:*:*:*:*:*","cpe:2.3:a:kind-of:kind_of:6.0.2:*:*:*:*:*:*:*","cpe:2.3:a:kind_of:kind-of:6.0.2:*:*:*:*:*:*:*","cpe:2.3:a:kind_of:kind_of:6.0.2:*:*:*:*:*:*:*","cpe:2.3:a:kind:kind-of:6.0.2:*:*:*:*:*:*:*","cpe:2.3:a:kind:kind_of:6.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/kind-of@6.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-f8q6-p94x-37v3","dataSource":"https://github.com/advisories/GHSA-f8q6-p94x-37v3","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-3517","https://github.com/grafana/grafana-image-renderer/issues/329","https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6","https://github.com/nodejs/node/issues/42510","https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK"],"description":"minimatch ReDoS vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3517","epss":0.02279,"percentile":0.83128,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-3517","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-3517","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.0.5"],"state":"fixed","available":[{"version":"3.0.5","date":"2022-10-21","kind":"first-observed"}]},"advisories":[],"risk":1.70925},"relatedVulnerabilities":[{"id":"CVE-2022-3517","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3517","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grafana/grafana-image-renderer/issues/329","https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6","https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/"],"description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3517","epss":0.02279,"percentile":0.83128,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-3517","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-3517","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"0.3.0"}},"found":{"vulnerabilityID":"GHSA-f8q6-p94x-37v3","versionConstraint":"<3.0.5 (semantic)"},"fix":{"suggestedVersion":"3.0.5"}}],"artifact":{"id":"pkg:npm/minimatch@0.3.0?package-id=b5eda2de6c0adccc","name":"minimatch","version":"0.3.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:0.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@0.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f8q6-p94x-37v3","dataSource":"https://github.com/advisories/GHSA-f8q6-p94x-37v3","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-3517","https://github.com/grafana/grafana-image-renderer/issues/329","https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6","https://github.com/nodejs/node/issues/42510","https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK"],"description":"minimatch ReDoS vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3517","epss":0.02279,"percentile":0.83128,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-3517","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-3517","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.0.5"],"state":"fixed","available":[{"version":"3.0.5","date":"2022-10-21","kind":"first-observed"}]},"advisories":[],"risk":1.70925},"relatedVulnerabilities":[{"id":"CVE-2022-3517","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3517","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grafana/grafana-image-renderer/issues/329","https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6","https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/"],"description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3517","epss":0.02279,"percentile":0.83128,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-3517","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-3517","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-f8q6-p94x-37v3","versionConstraint":"<3.0.5 (semantic)"},"fix":{"suggestedVersion":"3.0.5"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=70a0bfe47d5139e6","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-f8q6-p94x-37v3","dataSource":"https://github.com/advisories/GHSA-f8q6-p94x-37v3","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-3517","https://github.com/grafana/grafana-image-renderer/issues/329","https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6","https://github.com/nodejs/node/issues/42510","https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK"],"description":"minimatch ReDoS vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3517","epss":0.02279,"percentile":0.83128,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-3517","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-3517","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.0.5"],"state":"fixed","available":[{"version":"3.0.5","date":"2022-10-21","kind":"first-observed"}]},"advisories":[],"risk":1.70925},"relatedVulnerabilities":[{"id":"CVE-2022-3517","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3517","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grafana/grafana-image-renderer/issues/329","https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6","https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/"],"description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3517","epss":0.02279,"percentile":0.83128,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-3517","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-3517","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-f8q6-p94x-37v3","versionConstraint":"<3.0.5 (semantic)"},"fix":{"suggestedVersion":"3.0.5"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=c0db5736107463f9","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-f8q6-p94x-37v3","dataSource":"https://github.com/advisories/GHSA-f8q6-p94x-37v3","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-3517","https://github.com/grafana/grafana-image-renderer/issues/329","https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6","https://github.com/nodejs/node/issues/42510","https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK"],"description":"minimatch ReDoS vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3517","epss":0.02279,"percentile":0.83128,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-3517","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-3517","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.0.5"],"state":"fixed","available":[{"version":"3.0.5","date":"2022-10-21","kind":"first-observed"}]},"advisories":[],"risk":1.70925},"relatedVulnerabilities":[{"id":"CVE-2022-3517","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3517","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grafana/grafana-image-renderer/issues/329","https://github.com/isaacs/minimatch/commit/a8763f4388e51956be62dc6025cec1126beeb5e6","https://lists.debian.org/debian-lts-announce/2023/01/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/"],"description":"A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-3517","epss":0.02279,"percentile":0.83128,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-3517","cwe":"CWE-400","source":"secalert@redhat.com","type":"Secondary"},{"cve":"CVE-2022-3517","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-f8q6-p94x-37v3","versionConstraint":"<3.0.5 (semantic)"},"fix":{"suggestedVersion":"3.0.5"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=6c204b89569ec56b","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-fjxv-7rqg-78g4","dataSource":"https://github.com/advisories/GHSA-fjxv-7rqg-78g4","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4","https://nvd.nist.gov/vuln/detail/CVE-2025-7783","https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0","https://github.com/benweissmann/CVE-2025-7783-poc","https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"],"description":"form-data uses unsafe random function in form-data for choosing boundary","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7783","epss":0.0181,"percentile":0.78614,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7783","cwe":"CWE-330","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["2.5.4"],"state":"fixed","available":[{"version":"2.5.4","date":"2025-07-22","kind":"first-observed"}]},"advisories":[],"risk":1.6652000000000005},"relatedVulnerabilities":[{"id":"CVE-2025-7783","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7783","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0","https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4","https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"],"description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7783","epss":0.0181,"percentile":0.78614,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7783","cwe":"CWE-330","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"form-data","version":"2.1.4"}},"found":{"vulnerabilityID":"GHSA-fjxv-7rqg-78g4","versionConstraint":"<2.5.4 (semantic)"},"fix":{"suggestedVersion":"2.5.4"}}],"artifact":{"id":"pkg:npm/form-data@2.1.4?package-id=2dbe8da4f13eb60c","name":"form-data","version":"2.1.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:form-data:form-data:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:form-data:form_data:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form-data:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form_data:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:form:form-data:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:form:form_data:2.1.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/form-data@2.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-fjxv-7rqg-78g4","dataSource":"https://github.com/advisories/GHSA-fjxv-7rqg-78g4","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4","https://nvd.nist.gov/vuln/detail/CVE-2025-7783","https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0","https://github.com/benweissmann/CVE-2025-7783-poc","https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"],"description":"form-data uses unsafe random function in form-data for choosing boundary","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7783","epss":0.0181,"percentile":0.78614,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7783","cwe":"CWE-330","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["2.5.4"],"state":"fixed","available":[{"version":"2.5.4","date":"2025-07-22","kind":"first-observed"}]},"advisories":[],"risk":1.6652000000000005},"relatedVulnerabilities":[{"id":"CVE-2025-7783","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7783","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0","https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4","https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"],"description":"Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7783","epss":0.0181,"percentile":0.78614,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7783","cwe":"CWE-330","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"form-data","version":"2.3.3"}},"found":{"vulnerabilityID":"GHSA-fjxv-7rqg-78g4","versionConstraint":"<2.5.4 (semantic)"},"fix":{"suggestedVersion":"2.5.4"}}],"artifact":{"id":"pkg:npm/form-data@2.3.3?package-id=2fdb266fa204cae0","name":"form-data","version":"2.3.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:form-data:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form-data:form_data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form_data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form:form_data:2.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/form-data@2.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-rp65-9cf3-cjxr","dataSource":"https://github.com/advisories/GHSA-rp65-9cf3-cjxr","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3803","https://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726","https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0","https://lists.debian.org/debian-lts-announce/2023/05/msg00023.html"],"description":"Inefficient Regular Expression Complexity in nth-check","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3803","epss":0.02206,"percentile":0.8257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3803","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3803","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2021-09-21","kind":"first-observed"}]},"advisories":[],"risk":1.6545},"relatedVulnerabilities":[{"id":"CVE-2021-3803","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3803","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/fb55/nth-check/commit/9894c1d2010870c351f66c6f6efcf656e26bb726","https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0","https://lists.debian.org/debian-lts-announce/2023/05/msg00023.html"],"description":"nth-check is vulnerable to Inefficient Regular Expression Complexity","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security@huntr.dev","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3803","epss":0.02206,"percentile":0.8257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3803","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3803","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nth-check","version":"1.0.2"}},"found":{"vulnerabilityID":"GHSA-rp65-9cf3-cjxr","versionConstraint":"<2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"pkg:npm/nth-check@1.0.2?package-id=ccbf8203e06cf834","name":"nth-check","version":"1.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nth-check:nth-check:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:nth-check:nth_check:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:nth_check:nth-check:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:nth_check:nth_check:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:nth:nth-check:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:nth:nth_check:1.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/nth-check@1.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4jqc-8m5r-9rpr","dataSource":"https://github.com/advisories/GHSA-4jqc-8m5r-9rpr","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23440","https://github.com/jonschlinkert/set-value/pull/33","https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212","https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541","https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/","https://www.oracle.com/security-alerts/cpujan2022.html","https://github.com/jonschlinkert/set-value/pull/33/commits/383b72d47c74a55ae8b6e231da548f9280a4296a","https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad","https://github.com/jonschlinkert/set-value/commit/09c4b108fea3c0260008590053ff13da64913245"],"description":"Prototype Pollution in set-value","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23440","epss":0.02206,"percentile":0.82569,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23440","cwe":"CWE-843","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2021-11-13","kind":"first-observed"}]},"advisories":[],"risk":1.63244},"relatedVulnerabilities":[{"id":"CVE-2021-23440","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23440","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452","https://github.com/jonschlinkert/set-value/pull/33","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212","https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541","https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/","https://www.oracle.com/security-alerts/cpujan2022.html"],"description":"This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23440","epss":0.02206,"percentile":0.82569,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23440","cwe":"CWE-843","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"set-value","version":"0.4.3"}},"found":{"vulnerabilityID":"GHSA-4jqc-8m5r-9rpr","versionConstraint":"<2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"pkg:npm/set-value@0.4.3?package-id=9e8e5a5502807f65","name":"set-value","version":"0.4.3","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:set-value_project:set-value:0.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/set-value@0.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-4jqc-8m5r-9rpr","dataSource":"https://github.com/advisories/GHSA-4jqc-8m5r-9rpr","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23440","https://github.com/jonschlinkert/set-value/pull/33","https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212","https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541","https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/","https://www.oracle.com/security-alerts/cpujan2022.html","https://github.com/jonschlinkert/set-value/pull/33/commits/383b72d47c74a55ae8b6e231da548f9280a4296a","https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad","https://github.com/jonschlinkert/set-value/commit/09c4b108fea3c0260008590053ff13da64913245"],"description":"Prototype Pollution in set-value","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23440","epss":0.02206,"percentile":0.82569,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23440","cwe":"CWE-843","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2021-11-13","kind":"first-observed"}]},"advisories":[],"risk":1.63244},"relatedVulnerabilities":[{"id":"CVE-2021-23440","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23440","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/jonschlinkert/set-value/commit/7cf8073bb06bf0c15e08475f9f952823b4576452","https://github.com/jonschlinkert/set-value/pull/33","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1584212","https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541","https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/","https://www.oracle.com/security-alerts/cpujan2022.html"],"description":"This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23440","epss":0.02206,"percentile":0.82569,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23440","cwe":"CWE-843","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"set-value","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-4jqc-8m5r-9rpr","versionConstraint":"<2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"pkg:npm/set-value@2.0.0?package-id=8bec15c9300d8789","name":"set-value","version":"2.0.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:set-value_project:set-value:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/set-value@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xfhp-gmh8-r8v2","dataSource":"https://github.com/advisories/GHSA-xfhp-gmh8-r8v2","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23354","https://github.com/adaltas/node-printf/issues/31","https://github.com/adaltas/node-printf/pull/32","https://github.com/adaltas/node-printf/commit/a8502e7c9b0b22555696a2d8ef67722086413a68","https://snyk.io/vuln/SNYK-JS-PRINTF-1072096"],"description":"printf vulnerable to Regular Expression Denial of Service (ReDoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23354","epss":0.02176,"percentile":0.82327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23354","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.6.1"],"state":"fixed","available":[{"version":"0.6.1","date":"2021-03-20","kind":"first-observed"}]},"advisories":[],"risk":1.6320000000000001},"relatedVulnerabilities":[{"id":"CVE-2021-23354","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23354","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/adaltas/node-printf/issues/31","https://github.com/adaltas/node-printf/pull/32","https://snyk.io/vuln/SNYK-JS-PRINTF-1072096"],"description":"The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\\%(?:\\(([\\w_.]+)\\)|([1-9]\\d*)\\$)?([0 +\\-\\]*)(\\*|\\d+)?(\\.)?(\\*|\\d+)?[hlL]?([\\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23354","epss":0.02176,"percentile":0.82327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23354","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"printf","version":"0.5.3"}},"found":{"vulnerabilityID":"GHSA-xfhp-gmh8-r8v2","versionConstraint":"<0.6.1 (semantic)"},"fix":{"suggestedVersion":"0.6.1"}}],"artifact":{"id":"pkg:npm/printf@0.5.3?package-id=7436a0c43cc2d02a","name":"printf","version":"0.5.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:adaltas:printf:0.5.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/printf@0.5.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-257v-vj4p-3w2h","dataSource":"https://github.com/advisories/GHSA-257v-vj4p-3w2h","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-29060","https://github.com/Qix-/color-string/commit/0789e21284c33d89ebc4ab4ca6f759b9375ac9d3","https://github.com/Qix-/color-string/releases/tag/1.5.5","https://github.com/yetingli/PoCs/blob/main/CVE-2021-29060/Color-String.md","https://github.com/yetingli/SaveResults/blob/main/js/color-string.js","https://www.npmjs.com/package/color-string"],"description":"Regular Expression Denial of Service (ReDOS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-29060","epss":0.03134,"percentile":0.87887,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-29060","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.5.5"],"state":"fixed","available":[{"version":"1.5.5","date":"2021-06-22","kind":"first-observed"}]},"advisories":[],"risk":1.6140100000000002},"relatedVulnerabilities":[{"id":"CVE-2021-29060","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-29060","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/Qix-/color-string/commit/0789e21284c33d89ebc4ab4ca6f759b9375ac9d3","https://github.com/yetingli/PoCs/blob/main/CVE-2021-29060/Color-String.md","https://github.com/yetingli/SaveResults/blob/main/js/color-string.js","https://www.npmjs.com/package/color-string"],"description":"A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-29060","epss":0.03134,"percentile":0.87887,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-29060","cwe":"CWE-770","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"color-string","version":"0.3.0"}},"found":{"vulnerabilityID":"GHSA-257v-vj4p-3w2h","versionConstraint":"<1.5.5 (semantic)"},"fix":{"suggestedVersion":"1.5.5"}}],"artifact":{"id":"pkg:npm/color-string@0.3.0?package-id=b4b813958f7cc672","name":"color-string","version":"0.3.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:color-string_project:color-string:0.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/color-string@0.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rrc9-gqf8-8rwg","dataSource":"https://github.com/advisories/GHSA-rrc9-gqf8-8rwg","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-28472","https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611","https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425","https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424","https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-1049304"],"description":"Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28472","epss":0.02168,"percentile":0.82264,"date":"2026-10-31"}],"fix":{"versions":["2.814.0"],"state":"fixed","available":[{"version":"2.814.0","date":"2021-11-30","kind":"first-observed"}]},"advisories":[],"risk":1.60432},"relatedVulnerabilities":[{"id":"CVE-2020-28472","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-28472","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9","https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425","https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424","https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-1049304"],"description":"This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28472","epss":0.02168,"percentile":0.82264,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"aws-sdk","version":"2.0.31"}},"found":{"vulnerabilityID":"GHSA-rrc9-gqf8-8rwg","versionConstraint":"<2.814.0 (semantic)"},"fix":{"suggestedVersion":"2.814.0"}}],"artifact":{"id":"pkg:npm/aws-sdk@2.0.31?package-id=cf51df77075ade7c","name":"aws-sdk","version":"2.0.31","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:amazon:aws_sdk_for_javascipt:2.0.31:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/aws-sdk@2.0.31","upstreams":[]}},{"vulnerability":{"id":"GHSA-wrvr-8mpx-r7pp","dataSource":"https://github.com/advisories/GHSA-wrvr-8mpx-r7pp","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-16138","https://github.com/broofa/node-mime/issues/167","https://github.com/broofa/mime/commit/1df903fdeb9ae7eaa048795b8d580ce2c98f40b0","https://github.com/broofa/mime/commit/855d0c4b8b22e4a80b9401a81f2872058eae274d"],"description":"mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input","cvss":[{"type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16138","epss":0.02119,"percentile":0.81871,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2017-16138","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16138","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.4.1"],"state":"fixed","available":[{"version":"1.4.1","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.58925},"relatedVulnerabilities":[{"id":"CVE-2017-16138","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16138","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/broofa/node-mime/issues/167","https://nodesecurity.io/advisories/535"],"description":"The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16138","epss":0.02119,"percentile":0.81871,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2017-16138","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16138","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"mime","version":"1.2.11"}},"found":{"vulnerabilityID":"GHSA-wrvr-8mpx-r7pp","versionConstraint":"<1.4.1 (semantic)"},"fix":{"suggestedVersion":"1.4.1"}}],"artifact":{"id":"pkg:npm/mime@1.2.11?package-id=4d9949965f5c374e","name":"mime","version":"1.2.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:mime_project:mime:1.2.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/mime@1.2.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r28-3m3f-r2pr","dataSource":"https://github.com/advisories/GHSA-7r28-3m3f-r2pr","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-28092","https://github.com/sindresorhus/is-svg/commit/01f8a087fab8a69c3ac9085fbb16035907ab6a5b","https://github.com/sindresorhus/is-svg/releases","https://github.com/sindresorhus/is-svg/releases/tag/v4.2.2","https://www.npmjs.com/package/is-svg","https://security.netapp.com/advisory/ntap-20210513-0008/"],"description":"Regular Expression Denial of Service (ReDoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-28092","epss":0.02027,"percentile":0.81011,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-28092","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.2"],"state":"fixed","available":[{"version":"4.2.2","date":"2021-03-20","kind":"first-observed"}]},"advisories":[],"risk":1.52025},"relatedVulnerabilities":[{"id":"CVE-2021-28092","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28092","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sindresorhus/is-svg/releases","https://github.com/sindresorhus/is-svg/releases/tag/v4.2.2","https://security.netapp.com/advisory/ntap-20210513-0008/","https://www.npmjs.com/package/is-svg"],"description":"The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-28092","epss":0.02027,"percentile":0.81011,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-28092","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"is-svg","version":"2.1.0"}},"found":{"vulnerabilityID":"GHSA-7r28-3m3f-r2pr","versionConstraint":">=2.1.0,<4.2.2 (semantic)"},"fix":{"suggestedVersion":"4.2.2"}}],"artifact":{"id":"pkg:npm/is-svg@2.1.0?package-id=4ea7aeb94476916b","name":"is-svg","version":"2.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:is-svg:is-svg:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:is-svg:is_svg:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:is_svg:is-svg:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:is_svg:is_svg:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:is:is-svg:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:is:is_svg:2.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/is-svg@2.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-72xf-g2v4-qvf3","dataSource":"https://github.com/advisories/GHSA-72xf-g2v4-qvf3","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-26136","https://github.com/salesforce/tough-cookie/issues/282","https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e","https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3","https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873","https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"tough-cookie Prototype Pollution vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26136","epss":0.02627,"percentile":0.85495,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.1.3"],"state":"fixed","available":[{"version":"4.1.3","date":"2023-07-08","kind":"first-observed"}]},"advisories":[],"risk":1.5105250000000001},"relatedVulnerabilities":[{"id":"CVE-2023-26136","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-26136","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e","https://github.com/salesforce/tough-cookie/issues/282","https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3","https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873"],"description":"Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26136","epss":0.02627,"percentile":0.85495,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tough-cookie","version":"2.3.4"}},"found":{"vulnerabilityID":"GHSA-72xf-g2v4-qvf3","versionConstraint":"<4.1.3 (semantic)"},"fix":{"suggestedVersion":"4.1.3"}}],"artifact":{"id":"pkg:npm/tough-cookie@2.3.4?package-id=06eac7cb38fda6b8","name":"tough-cookie","version":"2.3.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:salesforce:tough-cookie:2.3.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tough-cookie@2.3.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-72xf-g2v4-qvf3","dataSource":"https://github.com/advisories/GHSA-72xf-g2v4-qvf3","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-26136","https://github.com/salesforce/tough-cookie/issues/282","https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e","https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3","https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873","https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"tough-cookie Prototype Pollution vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26136","epss":0.02627,"percentile":0.85495,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.1.3"],"state":"fixed","available":[{"version":"4.1.3","date":"2023-07-08","kind":"first-observed"}]},"advisories":[],"risk":1.5105250000000001},"relatedVulnerabilities":[{"id":"CVE-2023-26136","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-26136","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e","https://github.com/salesforce/tough-cookie/issues/282","https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3","https://lists.debian.org/debian-lts-announce/2023/07/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873"],"description":"Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26136","epss":0.02627,"percentile":0.85495,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26136","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tough-cookie","version":"2.4.3"}},"found":{"vulnerabilityID":"GHSA-72xf-g2v4-qvf3","versionConstraint":"<4.1.3 (semantic)"},"fix":{"suggestedVersion":"4.1.3"}}],"artifact":{"id":"pkg:npm/tough-cookie@2.4.3?package-id=4a69ddb23c7686b5","name":"tough-cookie","version":"2.4.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:salesforce:tough-cookie:2.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tough-cookie@2.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-crh6-fp67-6883","dataSource":"https://github.com/advisories/GHSA-crh6-fp67-6883","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883","https://github.com/xmldom/xmldom/releases/tag/0.7.7","https://github.com/xmldom/xmldom/releases/tag/0.8.4","https://github.com/xmldom/xmldom/releases/tag/0.9.0-beta.4","https://nvd.nist.gov/vuln/detail/CVE-2022-39353","https://github.com/jindw/xmldom/issues/150","https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html","https://github.com/xmldom/xmldom/commit/52a708360c35aa160fcca8621720d71fd0f95f1a","https://github.com/xmldom/xmldom/commit/7ff7c10ab2961703ac1752e95b4ff60ee4ee6643","https://github.com/xmldom/xmldom/commit/c02f786216bed70825f9a351c65e61500f51e931"],"description":"xmldom allows multiple root nodes in a DOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-39353","epss":0.01597,"percentile":0.75761,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-39353","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-39353","cwe":"CWE-1288","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-39353","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":1.5011800000000002},"relatedVulnerabilities":[{"id":"CVE-2022-39353","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-39353","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/jindw/xmldom/issues/150","https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883","https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":9.4,"exploitabilityScore":3.9,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-39353","epss":0.01597,"percentile":0.75761,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-39353","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-39353","cwe":"CWE-1288","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-39353","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-crh6-fp67-6883","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-qq89-hq3f-393p","dataSource":"https://github.com/advisories/GHSA-qq89-hq3f-393p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p","https://www.npmjs.com/package/tar","https://nvd.nist.gov/vuln/detail/CVE-2021-37712","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.debian.org/security/2021/dsa-5008","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://lists.debian.org/debian-lts-announce/2022/12/msg00023.html","https://github.com/isaacs/node-tar/commit/1739408d3122af897caefd09662bce2ea477533b","https://github.com/isaacs/node-tar/commit/b6162c7fafe797f856564ef37f4b82747f051455","https://github.com/isaacs/node-tar/commit/bb93ba243746f705092905da1955ac3b0509ba1e","https://github.com/isaacs/node-tar/commit/2f1bca027286c23e110b8dfc7efc10756fa3db5a","https://github.com/isaacs/node-tar/commit/3aaf19b2501bbddb145d92b3322c80dcaed3c35f","https://github.com/isaacs/node-tar/commit/d56f790bda9fea807dd80c5083f24771dbdd6eb1"],"description":"Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-37712","epss":0.01865,"percentile":0.79288,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-37712","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37712","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37712","cwe":"CWE-59","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.4.18"],"state":"fixed","available":[{"version":"4.4.18","date":"2021-09-01","kind":"first-observed"}]},"advisories":[],"risk":1.464025},"relatedVulnerabilities":[{"id":"CVE-2021-37712","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-37712","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p","https://lists.debian.org/debian-lts-announce/2022/12/msg00023.html","https://www.debian.org/security/2021/dsa-5008","https://www.npmjs.com/package/tar","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"The npm package \"tar\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 \"short path\" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"exploitabilityScore":1.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.4,"exploitabilityScore":3.4,"impactScore":6.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-37712","epss":0.01865,"percentile":0.79288,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-37712","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37712","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37712","cwe":"CWE-59","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-qq89-hq3f-393p","versionConstraint":">=3.0.0,<4.4.18 (semantic)"},"fix":{"suggestedVersion":"4.4.18"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-fvqr-27wr-82fm","dataSource":"https://github.com/advisories/GHSA-fvqr-27wr-82fm","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-3721","https://hackerone.com/reports/310443","https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a","https://security.netapp.com/advisory/ntap-20190919-0004","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-3721.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3721","epss":0.02347,"percentile":0.83673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2018-3721","cwe":"CWE-471","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2018-3721","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.5"],"state":"fixed","available":[{"version":"4.17.5","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.349525},"relatedVulnerabilities":[{"id":"CVE-2018-3721","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-3721","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a","https://hackerone.com/reports/310443","https://security.netapp.com/advisory/ntap-20190919-0004/"],"description":"lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3721","epss":0.02347,"percentile":0.83673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2018-3721","cwe":"CWE-471","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2018-3721","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-fvqr-27wr-82fm","versionConstraint":"<4.17.5 (semantic)"},"fix":{"suggestedVersion":"4.17.5"}}],"artifact":{"id":"pkg:npm/lodash@2.4.2?package-id=7a6b48925eb51c59","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-r683-j2x4-v87g","dataSource":"https://github.com/advisories/GHSA-r683-j2x4-v87g","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-0235","https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10","https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7","https://github.com/node-fetch/node-fetch/pull/1453","https://github.com/node-fetch/node-fetch/commit/5c32f002fdd65b1c6a8f1e3620210813d45c7e60","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html","https://github.com/node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60","https://github.com/node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35"],"description":"node-fetch forwards secure headers to untrusted sites","cvss":[{"type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-0235","epss":0.01653,"percentile":0.76557,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-0235","cwe":"CWE-200","source":"security@huntr.dev","type":"Primary"},{"cve":"CVE-2022-0235","cwe":"CWE-601","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2022-0235","cwe":"CWE-200","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["2.6.7"],"state":"fixed","available":[{"version":"2.6.7","date":"2022-01-23","kind":"first-observed"}]},"advisories":[],"risk":1.347195},"relatedVulnerabilities":[{"id":"CVE-2022-0235","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0235","namespace":"nvd:cpe","severity":"Medium","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10","https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7","https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html"],"description":"node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security@huntr.dev","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-0235","epss":0.01653,"percentile":0.76557,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-0235","cwe":"CWE-200","source":"security@huntr.dev","type":"Primary"},{"cve":"CVE-2022-0235","cwe":"CWE-601","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2022-0235","cwe":"CWE-200","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-fetch","version":"2.6.1"}},"found":{"vulnerabilityID":"GHSA-r683-j2x4-v87g","versionConstraint":"<2.6.7 (semantic)"},"fix":{"suggestedVersion":"2.6.7"}}],"artifact":{"id":"pkg:npm/node-fetch@2.6.1?package-id=2d85778f9131328b","name":"node-fetch","version":"2.6.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:node-fetch_project:node-fetch:2.6.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-fetch@2.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mw96-cpmx-2vgc","dataSource":"https://github.com/advisories/GHSA-mw96-cpmx-2vgc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc","https://nvd.nist.gov/vuln/detail/CVE-2026-27606","https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2","https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e","https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3","https://github.com/rollup/rollup/releases/tag/v2.80.0","https://github.com/rollup/rollup/releases/tag/v3.30.0","https://github.com/rollup/rollup/releases/tag/v4.59.0"],"description":"Rollup 4 has Arbitrary File Write via Path Traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":8.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27606","epss":0.01651,"percentile":0.76534,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27606","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-27606","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["2.80.0"],"state":"fixed","available":[{"version":"2.80.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":1.3455650000000001},"relatedVulnerabilities":[{"id":"CVE-2026-27606","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27606","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2","https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e","https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3","https://github.com/rollup/rollup/releases/tag/v2.80.0","https://github.com/rollup/rollup/releases/tag/v3.30.0","https://github.com/rollup/rollup/releases/tag/v4.59.0","https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:13508","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:5132","https://access.redhat.com/errata/RHSA-2026:5649","https://access.redhat.com/errata/RHSA-2026:5665","https://access.redhat.com/errata/RHSA-2026:6174","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/security/cve/CVE-2026-27606","https://bugzilla.redhat.com/show_bug.cgi?id=2442530","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27606.json"],"description":"Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27606","epss":0.01651,"percentile":0.76534,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27606","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-27606","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"rollup","version":"1.32.1"}},"found":{"vulnerabilityID":"GHSA-mw96-cpmx-2vgc","versionConstraint":"<2.80.0 (semantic)"},"fix":{"suggestedVersion":"2.80.0"}}],"artifact":{"id":"pkg:npm/rollup@1.32.1?package-id=11d4fdab28eaa257","name":"rollup","version":"1.32.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:rollupjs:rollup:1.32.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/rollup@1.32.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-whgm-jr23-g3j9","dataSource":"https://github.com/advisories/GHSA-whgm-jr23-g3j9","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23424","https://github.com/Tjatse/ansi-html/issues/19","https://snyk.io/vuln/SNYK-JS-ANSIHTML-1296849","https://github.com/ioet/time-tracker-ui/security/advisories/GHSA-4fjc-8q3h-8r69","https://github.com/Tjatse/ansi-html/commit/8142b25bca3133ea060bcc1889277dc482327a63","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1567198"],"description":"Uncontrolled Resource Consumption in ansi-html","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23424","epss":0.01768,"percentile":0.78116,"date":"2026-10-31"}],"fix":{"versions":["0.0.8"],"state":"fixed","available":[{"version":"0.0.8","date":"2022-03-09","kind":"first-observed"}]},"advisories":[],"risk":1.326},"relatedVulnerabilities":[{"id":"CVE-2021-23424","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23424","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/Tjatse/ansi-html/issues/19","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1567198","https://snyk.io/vuln/SNYK-JS-ANSIHTML-1296849"],"description":"This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23424","epss":0.01768,"percentile":0.78116,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ansi-html","version":"0.0.7"}},"found":{"vulnerabilityID":"GHSA-whgm-jr23-g3j9","versionConstraint":"<0.0.8 (semantic)"},"fix":{"suggestedVersion":"0.0.8"}}],"artifact":{"id":"pkg:npm/ansi-html@0.0.7?package-id=6df7102f66be2e4d","name":"ansi-html","version":"0.0.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ansi-html_project:ansi-html:0.0.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ansi-html@0.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-6xwr-q98w-rvg7","dataSource":"https://github.com/advisories/GHSA-6xwr-q98w-rvg7","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-21803","https://github.com/indexzero/nconf/pull/397","https://github.com/indexzero/nconf/releases/tag/v0.11.4","https://snyk.io/vuln/SNYK-JS-NCONF-2395478"],"description":"Prototype Pollution in nconf","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21803","epss":0.0178,"percentile":0.78252,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-21803","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.11.4"],"state":"fixed","available":[{"version":"0.11.4","date":"2022-04-27","kind":"first-observed"}]},"advisories":[],"risk":1.3172},"relatedVulnerabilities":[{"id":"CVE-2022-21803","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21803","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/indexzero/nconf/pull/397","https://github.com/indexzero/nconf/releases/tag/v0.11.4","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2632450","https://snyk.io/vuln/SNYK-JS-NCONF-2395478"],"description":"This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21803","epss":0.0178,"percentile":0.78252,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-21803","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"nconf","version":"0.6.9"}},"found":{"vulnerabilityID":"GHSA-6xwr-q98w-rvg7","versionConstraint":"<0.11.4 (semantic)"},"fix":{"suggestedVersion":"0.11.4"}}],"artifact":{"id":"pkg:npm/nconf@0.6.9?package-id=3b818717978adc92","name":"nconf","version":"0.6.9","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nconf_project:nconf:0.6.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/nconf@0.6.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-566m-qj78-rww5","dataSource":"https://github.com/advisories/GHSA-566m-qj78-rww5","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23382","https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641","https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640","https://github.com/postcss/postcss/releases/tag/7.0.36"],"description":"Regular Expression Denial of Service in postcss","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23382","epss":0.02557,"percentile":0.85073,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23382","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.0.36"],"state":"fixed","available":[{"version":"7.0.36","date":"2022-03-03","kind":"first-observed"}]},"advisories":[],"risk":1.3168549999999999},"relatedVulnerabilities":[{"id":"CVE-2021-23382","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23382","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/postcss/postcss/commit/2b1d04c867995e55124e0a165b7c6622c1735956","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1255641","https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640"],"description":"The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \\/\\*\\s* sourceMappingURL=(.*).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23382","epss":0.02557,"percentile":0.85073,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23382","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"5.2.18"}},"found":{"vulnerabilityID":"GHSA-566m-qj78-rww5","versionConstraint":"<7.0.36 (semantic)"},"fix":{"suggestedVersion":"7.0.36"}}],"artifact":{"id":"pkg:npm/postcss@5.2.18?package-id=a2216b0d3db52a78","name":"postcss","version":"5.2.18","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:postcss:postcss:5.2.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@5.2.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-pfrx-2q88-qq97","dataSource":"https://github.com/advisories/GHSA-pfrx-2q88-qq97","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-33987","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/commit/861ccd9ac2237df762a9e2beed7edd88c60782dc","https://github.com/sindresorhus/got/releases/tag/v11.8.5","https://github.com/sindresorhus/got/releases/tag/v12.1.0"],"description":"Got allows a redirect to a UNIX socket","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.02416,"percentile":0.84145,"date":"2026-10-31"}],"fix":{"versions":["11.8.5"],"state":"fixed","available":[{"version":"11.8.5","date":"2022-06-22","kind":"first-observed"}]},"advisories":[],"risk":1.24424},"relatedVulnerabilities":[{"id":"CVE-2022-33987","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-33987","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/releases/tag/v11.8.5"],"description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.02416,"percentile":0.84145,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"got","version":"6.7.1"}},"found":{"vulnerabilityID":"GHSA-pfrx-2q88-qq97","versionConstraint":"<11.8.5 (semantic)"},"fix":{"suggestedVersion":"11.8.5"}}],"artifact":{"id":"pkg:npm/got@6.7.1?package-id=91efa5beaf2296a3","name":"got","version":"6.7.1","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:got:got:6.7.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/got@6.7.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-pfrx-2q88-qq97","dataSource":"https://github.com/advisories/GHSA-pfrx-2q88-qq97","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-33987","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/commit/861ccd9ac2237df762a9e2beed7edd88c60782dc","https://github.com/sindresorhus/got/releases/tag/v11.8.5","https://github.com/sindresorhus/got/releases/tag/v12.1.0"],"description":"Got allows a redirect to a UNIX socket","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.02416,"percentile":0.84145,"date":"2026-10-31"}],"fix":{"versions":["11.8.5"],"state":"fixed","available":[{"version":"11.8.5","date":"2022-06-22","kind":"first-observed"}]},"advisories":[],"risk":1.24424},"relatedVulnerabilities":[{"id":"CVE-2022-33987","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-33987","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/releases/tag/v11.8.5"],"description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.02416,"percentile":0.84145,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"got","version":"8.3.2"}},"found":{"vulnerabilityID":"GHSA-pfrx-2q88-qq97","versionConstraint":"<11.8.5 (semantic)"},"fix":{"suggestedVersion":"11.8.5"}}],"artifact":{"id":"pkg:npm/got@8.3.2?package-id=d62510ba63a9e860","name":"got","version":"8.3.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:got:got:8.3.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/got@8.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-w8qv-6jwh-64r5","dataSource":"https://github.com/advisories/GHSA-w8qv-6jwh-64r5","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23364","https://github.com/browserslist/browserslist/pull/593","https://github.com/browserslist/browserslist/commit/c091916910dfe0b5fd61caad96083c6709b02d98","https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c/index.js%23L472-L474","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1277182","https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194"],"description":"Regular Expression Denial of Service in browserslist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23364","epss":0.02383,"percentile":0.83911,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23364","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.16.5"],"state":"fixed","available":[{"version":"4.16.5","date":"2021-05-25","kind":"first-observed"}]},"advisories":[],"risk":1.2272450000000001},"relatedVulnerabilities":[{"id":"CVE-2021-23364","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23364","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c/index.js%23L472-L474","https://github.com/browserslist/browserslist/commit/c091916910dfe0b5fd61caad96083c6709b02d98","https://github.com/browserslist/browserslist/pull/593","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1277182","https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194"],"description":"The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23364","epss":0.02383,"percentile":0.83911,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23364","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.16.3"}},"found":{"vulnerabilityID":"GHSA-w8qv-6jwh-64r5","versionConstraint":">=4.0.0,<4.16.5 (semantic)"},"fix":{"suggestedVersion":"4.16.5"}}],"artifact":{"id":"pkg:npm/browserslist@4.16.3?package-id=3ec28aaee5ad11f1","name":"browserslist","version":"4.16.3","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.16.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.16.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-w8qv-6jwh-64r5","dataSource":"https://github.com/advisories/GHSA-w8qv-6jwh-64r5","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23364","https://github.com/browserslist/browserslist/pull/593","https://github.com/browserslist/browserslist/commit/c091916910dfe0b5fd61caad96083c6709b02d98","https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c/index.js%23L472-L474","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1277182","https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194"],"description":"Regular Expression Denial of Service in browserslist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23364","epss":0.02383,"percentile":0.83911,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23364","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.16.5"],"state":"fixed","available":[{"version":"4.16.5","date":"2021-05-25","kind":"first-observed"}]},"advisories":[],"risk":1.2272450000000001},"relatedVulnerabilities":[{"id":"CVE-2021-23364","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23364","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/browserslist/browserslist/blob/e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c/index.js%23L472-L474","https://github.com/browserslist/browserslist/commit/c091916910dfe0b5fd61caad96083c6709b02d98","https://github.com/browserslist/browserslist/pull/593","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1277182","https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194"],"description":"The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23364","epss":0.02383,"percentile":0.83911,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-23364","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.16.3"}},"found":{"vulnerabilityID":"GHSA-w8qv-6jwh-64r5","versionConstraint":">=4.0.0,<4.16.5 (semantic)"},"fix":{"suggestedVersion":"4.16.5"}}],"artifact":{"id":"pkg:npm/browserslist@4.16.3?package-id=6051dad1be54c1ee","name":"browserslist","version":"4.16.3","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.16.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.16.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-v88g-cgmw-v5xw","dataSource":"https://github.com/advisories/GHSA-v88g-cgmw-v5xw","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-15366","https://github.com/ajv-validator/ajv/commit/65b2f7d76b190ac63a0d4e9154c712d7aa37049f","https://github.com/ajv-validator/ajv/releases/tag/v6.12.3","https://hackerone.com/bugs?subject=user&report_id=894259","https://github.com/ajv-validator/ajv/tags","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"Prototype Pollution in Ajv","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15366","epss":0.02313,"percentile":0.83405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-15366","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["6.12.3"],"state":"fixed","available":[{"version":"6.12.3","date":"2022-02-11","kind":"first-observed"}]},"advisories":[],"risk":1.2258900000000001},"relatedVulnerabilities":[{"id":"CVE-2020-15366","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15366","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ajv-validator/ajv/releases/tag/v6.12.3","https://github.com/ajv-validator/ajv/tags","https://hackerone.com/bugs?subject=user&report_id=894259","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15366","epss":0.02313,"percentile":0.83405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-15366","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"4.11.8"}},"found":{"vulnerabilityID":"GHSA-v88g-cgmw-v5xw","versionConstraint":"<6.12.3 (semantic)"},"fix":{"suggestedVersion":"6.12.3"}}],"artifact":{"id":"pkg:npm/ajv@4.11.8?package-id=3b2f8424f2ea8fd2","name":"ajv","version":"4.11.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:4.11.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@4.11.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-v88g-cgmw-v5xw","dataSource":"https://github.com/advisories/GHSA-v88g-cgmw-v5xw","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-15366","https://github.com/ajv-validator/ajv/commit/65b2f7d76b190ac63a0d4e9154c712d7aa37049f","https://github.com/ajv-validator/ajv/releases/tag/v6.12.3","https://hackerone.com/bugs?subject=user&report_id=894259","https://github.com/ajv-validator/ajv/tags","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"Prototype Pollution in Ajv","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15366","epss":0.02313,"percentile":0.83405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-15366","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["6.12.3"],"state":"fixed","available":[{"version":"6.12.3","date":"2022-02-11","kind":"first-observed"}]},"advisories":[],"risk":1.2258900000000001},"relatedVulnerabilities":[{"id":"CVE-2020-15366","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15366","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ajv-validator/ajv/releases/tag/v6.12.3","https://github.com/ajv-validator/ajv/tags","https://hackerone.com/bugs?subject=user&report_id=894259","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15366","epss":0.02313,"percentile":0.83405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-15366","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"6.6.2"}},"found":{"vulnerabilityID":"GHSA-v88g-cgmw-v5xw","versionConstraint":"<6.12.3 (semantic)"},"fix":{"suggestedVersion":"6.12.3"}}],"artifact":{"id":"pkg:npm/ajv@6.6.2?package-id=3eaad64be5bb1ab4","name":"ajv","version":"6.6.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:6.6.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@6.6.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rc47-6667-2j5j","dataSource":"https://github.com/advisories/GHSA-rc47-6667-2j5j","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25881","https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332","https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783","https://github.com/kornelski/http-cache-semantics/commit/560b2d8ef452bbba20ffed69dc155d63ac757b74","https://security.netapp.com/advisory/ntap-20230622-0008"],"description":"http-cache-semantics vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25881","epss":0.01613,"percentile":0.7598,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["4.1.1"],"state":"fixed","available":[{"version":"4.1.1","date":"2023-02-03","kind":"first-observed"}]},"advisories":[],"risk":1.2097499999999999},"relatedVulnerabilities":[{"id":"CVE-2022-25881","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25881","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83","https://security.netapp.com/advisory/ntap-20230622-0008/","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332","https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783"],"description":"This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25881","epss":0.01613,"percentile":0.7598,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"http-cache-semantics","version":"3.8.1"}},"found":{"vulnerabilityID":"GHSA-rc47-6667-2j5j","versionConstraint":"<4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.1.1"}}],"artifact":{"id":"pkg:npm/http-cache-semantics@3.8.1?package-id=3b6e5acd4096ebe5","name":"http-cache-semantics","version":"3.8.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:http-cache-semantics_project:http-cache-semantics:3.8.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/http-cache-semantics@3.8.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-pp7h-53gx-mx7r","dataSource":"https://github.com/advisories/GHSA-pp7h-53gx-mx7r","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-8244","https://github.com/rvagg/bl/commit/8a8c13c880e2bef519133ea43e0e9b78b5d0c91e","https://github.com/rvagg/bl/commit/d3e240e3b8ba4048d3c76ef5fb9dd1f8872d3190","https://github.com/rvagg/bl/commit/dacc4ac7d5fcd6201bcf26fbd886951be9537466","https://hackerone.com/reports/966347","https://lists.debian.org/debian-lts-announce/2021/06/msg00028.html"],"description":"Remote Memory Exposure in bl","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8244","epss":0.02097,"percentile":0.8168,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-8244","cwe":"CWE-126","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8244","cwe":"CWE-125","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.2.3"],"state":"fixed","available":[{"version":"1.2.3","date":"2020-09-12","kind":"first-observed"}]},"advisories":[],"risk":1.2057749999999998},"relatedVulnerabilities":[{"id":"CVE-2020-8244","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8244","namespace":"nvd:cpe","severity":"Medium","urls":["https://hackerone.com/reports/966347","https://lists.debian.org/debian-lts-announce/2021/06/msg00028.html"],"description":"A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"exploitabilityScore":10,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8244","epss":0.02097,"percentile":0.8168,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-8244","cwe":"CWE-126","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8244","cwe":"CWE-125","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"bl","version":"0.9.5"}},"found":{"vulnerabilityID":"GHSA-pp7h-53gx-mx7r","versionConstraint":"<1.2.3 (semantic)"},"fix":{"suggestedVersion":"1.2.3"}}],"artifact":{"id":"pkg:npm/bl@0.9.5?package-id=63ca115ea0317f7d","name":"bl","version":"0.9.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:bl:bl:0.9.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/bl@0.9.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-6vfc-qv3f-vr6c","dataSource":"https://github.com/advisories/GHSA-6vfc-qv3f-vr6c","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6vfc-qv3f-vr6c","https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101","https://nvd.nist.gov/vuln/detail/CVE-2022-21670"],"description":"Uncontrolled Resource Consumption in markdown-it","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21670","epss":0.02282,"percentile":0.83149,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-21670","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-21670","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["12.3.2"],"state":"fixed","available":[{"version":"12.3.2","date":"2022-01-13","kind":"first-observed"}]},"advisories":[],"risk":1.17523},"relatedVulnerabilities":[{"id":"CVE-2022-21670","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21670","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6vfc-qv3f-vr6c"],"description":"markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21670","epss":0.02282,"percentile":0.83149,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-21670","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-21670","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"8.4.2"}},"found":{"vulnerabilityID":"GHSA-6vfc-qv3f-vr6c","versionConstraint":"<12.3.2 (semantic)"},"fix":{"suggestedVersion":"12.3.2"}}],"artifact":{"id":"pkg:npm/markdown-it@8.4.2?package-id=26992563bba8d2e3","name":"markdown-it","version":"8.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:8.4.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@8.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-hj48-42vr-x3v9","dataSource":"https://github.com/advisories/GHSA-hj48-42vr-x3v9","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23343","https://github.com/jbgutierrez/path-parse/issues/8","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279028","https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067","https://lists.apache.org/thread.html/r6a32cb3eda3b19096ad48ef1e7aa8f26e005f2f63765abb69ce08b85@%3Cdev.myfaces.apache.org%3E","https://github.com/jbgutierrez/path-parse/pull/10","https://github.com/jbgutierrez/path-parse/commit/eca63a7b9a473bf6978a2f5b7b3343662d1506f7"],"description":"Regular Expression Denial of Service in path-parse","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23343","epss":0.02218,"percentile":0.82661,"date":"2026-10-31"}],"fix":{"versions":["1.0.7"],"state":"fixed","available":[{"version":"1.0.7","date":"2021-08-11","kind":"first-observed"}]},"advisories":[],"risk":1.14227},"relatedVulnerabilities":[{"id":"CVE-2021-23343","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23343","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jbgutierrez/path-parse/issues/8","https://lists.apache.org/thread.html/r6a32cb3eda3b19096ad48ef1e7aa8f26e005f2f63765abb69ce08b85%40%3Cdev.myfaces.apache.org%3E","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279028","https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067"],"description":"All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23343","epss":0.02218,"percentile":0.82661,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-parse","version":"1.0.6"}},"found":{"vulnerabilityID":"GHSA-hj48-42vr-x3v9","versionConstraint":"<1.0.7 (semantic)"},"fix":{"suggestedVersion":"1.0.7"}}],"artifact":{"id":"pkg:npm/path-parse@1.0.6?package-id=15e4533f2d88e64b","name":"path-parse","version":"1.0.6","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:path-parse_project:path-parse:1.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-parse@1.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-hj48-42vr-x3v9","dataSource":"https://github.com/advisories/GHSA-hj48-42vr-x3v9","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23343","https://github.com/jbgutierrez/path-parse/issues/8","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279028","https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067","https://lists.apache.org/thread.html/r6a32cb3eda3b19096ad48ef1e7aa8f26e005f2f63765abb69ce08b85@%3Cdev.myfaces.apache.org%3E","https://github.com/jbgutierrez/path-parse/pull/10","https://github.com/jbgutierrez/path-parse/commit/eca63a7b9a473bf6978a2f5b7b3343662d1506f7"],"description":"Regular Expression Denial of Service in path-parse","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23343","epss":0.02218,"percentile":0.82661,"date":"2026-10-31"}],"fix":{"versions":["1.0.7"],"state":"fixed","available":[{"version":"1.0.7","date":"2021-08-11","kind":"first-observed"}]},"advisories":[],"risk":1.14227},"relatedVulnerabilities":[{"id":"CVE-2021-23343","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23343","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jbgutierrez/path-parse/issues/8","https://lists.apache.org/thread.html/r6a32cb3eda3b19096ad48ef1e7aa8f26e005f2f63765abb69ce08b85%40%3Cdev.myfaces.apache.org%3E","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279028","https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067"],"description":"All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23343","epss":0.02218,"percentile":0.82661,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-parse","version":"1.0.6"}},"found":{"vulnerabilityID":"GHSA-hj48-42vr-x3v9","versionConstraint":"<1.0.7 (semantic)"},"fix":{"suggestedVersion":"1.0.7"}}],"artifact":{"id":"pkg:npm/path-parse@1.0.6?package-id=0b371a9ed47ecf9a","name":"path-parse","version":"1.0.6","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:path-parse_project:path-parse:1.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-parse@1.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-hxm2-r34f-qmc5","dataSource":"https://github.com/advisories/GHSA-hxm2-r34f-qmc5","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-10540","https://www.npmjs.com/advisories/118"],"description":"Regular Expression Denial of Service in minimatch","cvss":[{"type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-10540","epss":0.01503,"percentile":0.74319,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2016-10540","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2016-10540","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.0.2"],"state":"fixed","available":[{"version":"3.0.2","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.1272499999999999},"relatedVulnerabilities":[{"id":"CVE-2016-10540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10540","namespace":"nvd:cpe","severity":"High","urls":["https://nodesecurity.io/advisories/118"],"description":"Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-10540","epss":0.01503,"percentile":0.74319,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2016-10540","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2016-10540","cwe":"CWE-20","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"0.3.0"}},"found":{"vulnerabilityID":"GHSA-hxm2-r34f-qmc5","versionConstraint":"<3.0.2 (semantic)"},"fix":{"suggestedVersion":"3.0.2"}}],"artifact":{"id":"pkg:npm/minimatch@0.3.0?package-id=b5eda2de6c0adccc","name":"minimatch","version":"0.3.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:0.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@0.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4xc9-xhrj-v574","dataSource":"https://github.com/advisories/GHSA-4xc9-xhrj-v574","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-16487","https://hackerone.com/reports/380873","https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad","https://security.netapp.com/advisory/ntap-20190919-0004","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-16487.yml"],"description":"Prototype Pollution in lodash","cvss":[],"epss":[{"cve":"CVE-2018-16487","epss":0.01491,"percentile":0.74127,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2018-16487","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"}],"fix":{"versions":["4.17.11"],"state":"fixed","available":[{"version":"4.17.11","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.11825},"relatedVulnerabilities":[{"id":"CVE-2018-16487","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16487","namespace":"nvd:cpe","severity":"Medium","urls":["https://hackerone.com/reports/380873","https://security.netapp.com/advisory/ntap-20190919-0004/"],"description":"A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-16487","epss":0.01491,"percentile":0.74127,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2018-16487","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-4xc9-xhrj-v574","versionConstraint":"<4.17.11 (semantic)"},"fix":{"suggestedVersion":"4.17.11"}}],"artifact":{"id":"pkg:npm/lodash@2.4.2?package-id=7a6b48925eb51c59","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-g6ww-v8xp-vmwg","dataSource":"https://github.com/advisories/GHSA-g6ww-v8xp-vmwg","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7751","https://github.com/chaijs/pathval/pull/58/commits/21a9046cfa0c2697cb41990f3b4316db410e6c8a","https://github.com/chaijs/pathval/releases/tag/v1.1.1","https://snyk.io/vuln/SNYK-JS-PATHVAL-596926","https://github.com/chaijs/pathval/pull/58/files"],"description":"Prototype pollution in pathval","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7751","epss":0.01516,"percentile":0.74533,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7751","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.1.1"],"state":"fixed","available":[{"version":"1.1.1","date":"2022-02-11","kind":"first-observed"}]},"advisories":[],"risk":1.1142599999999998},"relatedVulnerabilities":[{"id":"CVE-2020-7751","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7751","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/chaijs/pathval/pull/58/files","https://snyk.io/vuln/SNYK-JS-PATHVAL-596926"],"description":"pathval before version 1.1.1 is vulnerable to prototype pollution.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":6,"exploitabilityScore":1.3,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7751","epss":0.01516,"percentile":0.74533,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7751","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"pathval","version":"1.1.0"}},"found":{"vulnerabilityID":"GHSA-g6ww-v8xp-vmwg","versionConstraint":"<1.1.1 (semantic)"},"fix":{"suggestedVersion":"1.1.1"}}],"artifact":{"id":"pkg:npm/pathval@1.1.0?package-id=3dfb46817fd5115b","name":"pathval","version":"1.1.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:chaijis:pathval:1.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/pathval@1.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-grv7-fg5c-xmjg","dataSource":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4068","https://github.com/micromatch/braces/issues/35","https://devhub.checkmarx.com/cve-details/CVE-2024-4068","https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff"],"description":"Uncontrolled resource consumption in braces","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.01471,"percentile":0.73774,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["3.0.3"],"state":"fixed","available":[{"version":"3.0.3","date":"2024-06-11","kind":"first-observed"}]},"advisories":[],"risk":1.10325},"relatedVulnerabilities":[{"id":"CVE-2024-4068","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4068","namespace":"nvd:cpe","severity":"High","urls":["https://devhub.checkmarx.com/cve-details/CVE-2024-4068/","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff","https://github.com/micromatch/braces/issues/35","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40"],"description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","cvss":[{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.01471,"percentile":0.73774,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"braces","version":"2.3.2"}},"found":{"vulnerabilityID":"GHSA-grv7-fg5c-xmjg","versionConstraint":"<3.0.3 (semantic)"},"fix":{"suggestedVersion":"3.0.3"}}],"artifact":{"id":"pkg:npm/braces@2.3.2?package-id=1d895d004569b22c","name":"braces","version":"2.3.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:braces_project:braces:2.3.2:*:*:*:*:node.js:*:*","cpe:2.3:a:jonschlinkert:braces:2.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/braces@2.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-grv7-fg5c-xmjg","dataSource":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4068","https://github.com/micromatch/braces/issues/35","https://devhub.checkmarx.com/cve-details/CVE-2024-4068","https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff"],"description":"Uncontrolled resource consumption in braces","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.01471,"percentile":0.73774,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["3.0.3"],"state":"fixed","available":[{"version":"3.0.3","date":"2024-06-11","kind":"first-observed"}]},"advisories":[],"risk":1.10325},"relatedVulnerabilities":[{"id":"CVE-2024-4068","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4068","namespace":"nvd:cpe","severity":"High","urls":["https://devhub.checkmarx.com/cve-details/CVE-2024-4068/","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff","https://github.com/micromatch/braces/issues/35","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40"],"description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","cvss":[{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.01471,"percentile":0.73774,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"braces","version":"2.3.2"}},"found":{"vulnerabilityID":"GHSA-grv7-fg5c-xmjg","versionConstraint":"<3.0.3 (semantic)"},"fix":{"suggestedVersion":"3.0.3"}}],"artifact":{"id":"pkg:npm/braces@2.3.2?package-id=5113de9a9ee73f6c","name":"braces","version":"2.3.2","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:braces_project:braces:2.3.2:*:*:*:*:node.js:*:*","cpe:2.3:a:jonschlinkert:braces:2.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/braces@2.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-grv7-fg5c-xmjg","dataSource":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4068","https://github.com/micromatch/braces/issues/35","https://devhub.checkmarx.com/cve-details/CVE-2024-4068","https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff"],"description":"Uncontrolled resource consumption in braces","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.01471,"percentile":0.73774,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["3.0.3"],"state":"fixed","available":[{"version":"3.0.3","date":"2024-06-11","kind":"first-observed"}]},"advisories":[],"risk":1.10325},"relatedVulnerabilities":[{"id":"CVE-2024-4068","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4068","namespace":"nvd:cpe","severity":"High","urls":["https://devhub.checkmarx.com/cve-details/CVE-2024-4068/","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff","https://github.com/micromatch/braces/issues/35","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40"],"description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","cvss":[{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.01471,"percentile":0.73774,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"braces","version":"3.0.2"}},"found":{"vulnerabilityID":"GHSA-grv7-fg5c-xmjg","versionConstraint":"<3.0.3 (semantic)"},"fix":{"suggestedVersion":"3.0.3"}}],"artifact":{"id":"pkg:npm/braces@3.0.2?package-id=8ce66ef5e5f71f9f","name":"braces","version":"3.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:braces_project:braces:3.0.2:*:*:*:*:node.js:*:*","cpe:2.3:a:jonschlinkert:braces:3.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/braces@3.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-96hv-2xvq-fx4p","dataSource":"https://github.com/advisories/GHSA-96hv-2xvq-fx4p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://nvd.nist.gov/vuln/detail/CVE-2026-48779","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://access.redhat.com/security/cve/CVE-2026-48779","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:27171","https://access.redhat.com/errata/RHSA-2026:26638"],"description":"ws: Memory exhaustion DoS from tiny fragments and data chunks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.11"],"state":"fixed","available":[{"version":"7.5.11","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":1.0695},"relatedVulnerabilities":[{"id":"CVE-2026-48779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7","https://github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53","https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94","https://github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8","https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-48779","https://bugzilla.redhat.com/show_bug.cgi?id=2489661","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json"],"description":"ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48779","epss":0.01426,"percentile":0.72944,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48779","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48779","cwe":"CWE-1050","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"7.4.6"}},"found":{"vulnerabilityID":"GHSA-96hv-2xvq-fx4p","versionConstraint":">=7.0.0,<7.5.11 (semantic)"},"fix":{"suggestedVersion":"7.5.11"}}],"artifact":{"id":"pkg:npm/ws@7.4.6?package-id=7decfcb4dbbffaef","name":"ws","version":"7.4.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ws_project:ws:7.4.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@7.4.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-xxjr-mmjv-4gpg","dataSource":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.17.23"],"state":"fixed","available":[{"version":"4.17.23","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":1.066455},"relatedVulnerabilities":[{"id":"CVE-2025-13465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:1845","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:2078","https://access.redhat.com/errata/RHSA-2026:2119","https://access.redhat.com/errata/RHSA-2026:2145","https://access.redhat.com/errata/RHSA-2026:2147","https://access.redhat.com/errata/RHSA-2026:2148","https://access.redhat.com/errata/RHSA-2026:2149","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:2438","https://access.redhat.com/errata/RHSA-2026:2452","https://access.redhat.com/errata/RHSA-2026:2462","https://access.redhat.com/errata/RHSA-2026:2465","https://access.redhat.com/errata/RHSA-2026:2469","https://access.redhat.com/errata/RHSA-2026:2484","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:2651","https://access.redhat.com/errata/RHSA-2026:2661","https://access.redhat.com/errata/RHSA-2026:2672","https://access.redhat.com/errata/RHSA-2026:2675","https://access.redhat.com/errata/RHSA-2026:2694","https://access.redhat.com/errata/RHSA-2026:2816","https://access.redhat.com/errata/RHSA-2026:2817","https://access.redhat.com/errata/RHSA-2026:2818","https://access.redhat.com/errata/RHSA-2026:2819","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:2984","https://access.redhat.com/errata/RHSA-2026:2990","https://access.redhat.com/errata/RHSA-2026:3087","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:3422","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3710","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3825","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3870","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3962","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:4423","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4630","https://access.redhat.com/errata/RHSA-2026:4782","https://access.redhat.com/errata/RHSA-2026:5633","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6288","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-13465","https://bugzilla.redhat.com/show_bug.cgi?id=2431740","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-xxjr-mmjv-4gpg","versionConstraint":">=4.0.0,<=4.17.22 (semantic)"},"fix":{"suggestedVersion":"4.17.23"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=ba9b218e488409eb","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-xxjr-mmjv-4gpg","dataSource":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.17.23"],"state":"fixed","available":[{"version":"4.17.23","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":1.066455},"relatedVulnerabilities":[{"id":"CVE-2025-13465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:1845","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:2078","https://access.redhat.com/errata/RHSA-2026:2119","https://access.redhat.com/errata/RHSA-2026:2145","https://access.redhat.com/errata/RHSA-2026:2147","https://access.redhat.com/errata/RHSA-2026:2148","https://access.redhat.com/errata/RHSA-2026:2149","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:2438","https://access.redhat.com/errata/RHSA-2026:2452","https://access.redhat.com/errata/RHSA-2026:2462","https://access.redhat.com/errata/RHSA-2026:2465","https://access.redhat.com/errata/RHSA-2026:2469","https://access.redhat.com/errata/RHSA-2026:2484","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:2651","https://access.redhat.com/errata/RHSA-2026:2661","https://access.redhat.com/errata/RHSA-2026:2672","https://access.redhat.com/errata/RHSA-2026:2675","https://access.redhat.com/errata/RHSA-2026:2694","https://access.redhat.com/errata/RHSA-2026:2816","https://access.redhat.com/errata/RHSA-2026:2817","https://access.redhat.com/errata/RHSA-2026:2818","https://access.redhat.com/errata/RHSA-2026:2819","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:2984","https://access.redhat.com/errata/RHSA-2026:2990","https://access.redhat.com/errata/RHSA-2026:3087","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:3422","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3710","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3825","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3870","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3962","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:4423","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4630","https://access.redhat.com/errata/RHSA-2026:4782","https://access.redhat.com/errata/RHSA-2026:5633","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6288","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-13465","https://bugzilla.redhat.com/show_bug.cgi?id=2431740","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-xxjr-mmjv-4gpg","versionConstraint":">=4.0.0,<=4.17.22 (semantic)"},"fix":{"suggestedVersion":"4.17.23"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=c54a61e75e4999c4","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-xxjr-mmjv-4gpg","dataSource":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.17.23"],"state":"fixed","available":[{"version":"4.17.23","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":1.066455},"relatedVulnerabilities":[{"id":"CVE-2025-13465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:1845","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:2078","https://access.redhat.com/errata/RHSA-2026:2119","https://access.redhat.com/errata/RHSA-2026:2145","https://access.redhat.com/errata/RHSA-2026:2147","https://access.redhat.com/errata/RHSA-2026:2148","https://access.redhat.com/errata/RHSA-2026:2149","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:2438","https://access.redhat.com/errata/RHSA-2026:2452","https://access.redhat.com/errata/RHSA-2026:2462","https://access.redhat.com/errata/RHSA-2026:2465","https://access.redhat.com/errata/RHSA-2026:2469","https://access.redhat.com/errata/RHSA-2026:2484","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:2651","https://access.redhat.com/errata/RHSA-2026:2661","https://access.redhat.com/errata/RHSA-2026:2672","https://access.redhat.com/errata/RHSA-2026:2675","https://access.redhat.com/errata/RHSA-2026:2694","https://access.redhat.com/errata/RHSA-2026:2816","https://access.redhat.com/errata/RHSA-2026:2817","https://access.redhat.com/errata/RHSA-2026:2818","https://access.redhat.com/errata/RHSA-2026:2819","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:2984","https://access.redhat.com/errata/RHSA-2026:2990","https://access.redhat.com/errata/RHSA-2026:3087","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:3422","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3710","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3825","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3870","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3962","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:4423","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4630","https://access.redhat.com/errata/RHSA-2026:4782","https://access.redhat.com/errata/RHSA-2026:5633","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6288","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-13465","https://bugzilla.redhat.com/show_bug.cgi?id=2431740","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-xxjr-mmjv-4gpg","versionConstraint":">=4.0.0,<=4.17.22 (semantic)"},"fix":{"suggestedVersion":"4.17.23"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=018753b8823e0ec7","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-xxjr-mmjv-4gpg","dataSource":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.17.23"],"state":"fixed","available":[{"version":"4.17.23","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":1.066455},"relatedVulnerabilities":[{"id":"CVE-2025-13465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:1845","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:2078","https://access.redhat.com/errata/RHSA-2026:2119","https://access.redhat.com/errata/RHSA-2026:2145","https://access.redhat.com/errata/RHSA-2026:2147","https://access.redhat.com/errata/RHSA-2026:2148","https://access.redhat.com/errata/RHSA-2026:2149","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:2438","https://access.redhat.com/errata/RHSA-2026:2452","https://access.redhat.com/errata/RHSA-2026:2462","https://access.redhat.com/errata/RHSA-2026:2465","https://access.redhat.com/errata/RHSA-2026:2469","https://access.redhat.com/errata/RHSA-2026:2484","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:2651","https://access.redhat.com/errata/RHSA-2026:2661","https://access.redhat.com/errata/RHSA-2026:2672","https://access.redhat.com/errata/RHSA-2026:2675","https://access.redhat.com/errata/RHSA-2026:2694","https://access.redhat.com/errata/RHSA-2026:2816","https://access.redhat.com/errata/RHSA-2026:2817","https://access.redhat.com/errata/RHSA-2026:2818","https://access.redhat.com/errata/RHSA-2026:2819","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:2984","https://access.redhat.com/errata/RHSA-2026:2990","https://access.redhat.com/errata/RHSA-2026:3087","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:3422","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3710","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3825","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3870","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3962","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:4423","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4630","https://access.redhat.com/errata/RHSA-2026:4782","https://access.redhat.com/errata/RHSA-2026:5633","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6288","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-13465","https://bugzilla.redhat.com/show_bug.cgi?id=2431740","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.01823,"percentile":0.78783,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.21"}},"found":{"vulnerabilityID":"GHSA-xxjr-mmjv-4gpg","versionConstraint":">=4.0.0,<=4.17.22 (semantic)"},"fix":{"suggestedVersion":"4.17.23"}}],"artifact":{"id":"pkg:npm/lodash@4.17.21?package-id=cb6dfff11809ad1e","name":"lodash","version":"4.17.21","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.21","upstreams":[]}},{"vulnerability":{"id":"GHSA-3h5v-q93c-6h6q","dataSource":"https://github.com/advisories/GHSA-3h5v-q93c-6h6q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q","https://github.com/websockets/ws/issues/2230","https://github.com/websockets/ws/pull/2231","https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f","https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e","https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c","https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63"],"description":"ws affected by a DoS when handling a request with many HTTP headers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37890","epss":0.01357,"percentile":0.71669,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-37890","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.10"],"state":"fixed","available":[{"version":"7.5.10","date":"2024-06-18","kind":"first-observed"}]},"advisories":[],"risk":1.0584600000000002},"relatedVulnerabilities":[{"id":"CVE-2024-37890","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37890","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f","https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e","https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c","https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63","https://github.com/websockets/ws/issues/2230","https://github.com/websockets/ws/pull/2231","https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q","https://nodejs.org/api/http.html#servermaxheaderscount"],"description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37890","epss":0.01357,"percentile":0.71669,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-37890","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"7.4.6"}},"found":{"vulnerabilityID":"GHSA-3h5v-q93c-6h6q","versionConstraint":">=7.0.0,<7.5.10 (semantic)"},"fix":{"suggestedVersion":"7.5.10"}}],"artifact":{"id":"pkg:npm/ws@7.4.6?package-id=7decfcb4dbbffaef","name":"ws","version":"7.4.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ws_project:ws:7.4.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@7.4.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-4q6p-r6v2-jvc5","dataSource":"https://github.com/advisories/GHSA-4q6p-r6v2-jvc5","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/chaijs/get-func-name/security/advisories/GHSA-4q6p-r6v2-jvc5","https://nvd.nist.gov/vuln/detail/CVE-2023-43646","https://github.com/chaijs/get-func-name/commit/f934b228b5e2cb94d6c8576d3aac05493f667c69","https://github.com/chaijs/get-func-name/blob/78ad756441a83f3dc203e50f76c113ae3ac017dc/index.js#L15"],"description":"Chaijs/get-func-name vulnerable to ReDoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-43646","epss":0.01383,"percentile":0.72176,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-43646","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-43646","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2023-09-28","kind":"first-observed"}]},"advisories":[],"risk":1.03725},"relatedVulnerabilities":[{"id":"CVE-2023-43646","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-43646","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/chaijs/get-func-name/commit/f934b228b5e2cb94d6c8576d3aac05493f667c69","https://github.com/chaijs/get-func-name/security/advisories/GHSA-4q6p-r6v2-jvc5"],"description":"get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial of service (redos) vulnerability which may lead to a denial of service when parsing malicious input. This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\\t'.repeat(54773) + '\\t/function/i'. This issue has been addressed in commit `f934b228b` which has been included in releases from 2.0.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-43646","epss":0.01383,"percentile":0.72176,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-43646","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-43646","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"get-func-name","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-4q6p-r6v2-jvc5","versionConstraint":"<2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"pkg:npm/get-func-name@2.0.0?package-id=c6510fa58a9df4d3","name":"get-func-name","version":"2.0.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:get-func-name:get-func-name:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:get-func-name:get_func_name:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:get_func_name:get-func-name:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:get_func_name:get_func_name:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:get-func:get-func-name:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:get-func:get_func_name:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:get_func:get-func-name:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:get_func:get_func_name:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:get:get-func-name:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:get:get_func_name:2.0.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/get-func-name@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vh95-rmgr-6w4m","dataSource":"https://github.com/advisories/GHSA-vh95-rmgr-6w4m","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7598","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://www.npmjs.com/advisories/1179","https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68","https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab","https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95","https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.2.1"],"state":"fixed","available":[{"version":"0.2.1","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.0234300000000003},"relatedVulnerabilities":[{"id":"CVE-2020-7598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7598","namespace":"nvd:cpe","severity":"Medium","urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764"],"description":"minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"0.0.10"}},"found":{"vulnerabilityID":"GHSA-vh95-rmgr-6w4m","versionConstraint":"<0.2.1 (semantic)"},"fix":{"suggestedVersion":"0.2.1"}}],"artifact":{"id":"pkg:npm/minimist@0.0.10?package-id=afa454d6a75c818c","name":"minimist","version":"0.0.10","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:0.0.10:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@0.0.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-vh95-rmgr-6w4m","dataSource":"https://github.com/advisories/GHSA-vh95-rmgr-6w4m","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7598","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://www.npmjs.com/advisories/1179","https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68","https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab","https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95","https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.2.1"],"state":"fixed","available":[{"version":"0.2.1","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.0234300000000003},"relatedVulnerabilities":[{"id":"CVE-2020-7598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7598","namespace":"nvd:cpe","severity":"Medium","urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764"],"description":"minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"0.0.8"}},"found":{"vulnerabilityID":"GHSA-vh95-rmgr-6w4m","versionConstraint":"<0.2.1 (semantic)"},"fix":{"suggestedVersion":"0.2.1"}}],"artifact":{"id":"pkg:npm/minimist@0.0.8?package-id=4f68b30a302d2a75","name":"minimist","version":"0.0.8","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:0.0.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@0.0.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-vh95-rmgr-6w4m","dataSource":"https://github.com/advisories/GHSA-vh95-rmgr-6w4m","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7598","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://www.npmjs.com/advisories/1179","https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68","https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab","https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95","https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.2.1"],"state":"fixed","available":[{"version":"0.2.1","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.0234300000000003},"relatedVulnerabilities":[{"id":"CVE-2020-7598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7598","namespace":"nvd:cpe","severity":"Medium","urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764"],"description":"minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"0.0.8"}},"found":{"vulnerabilityID":"GHSA-vh95-rmgr-6w4m","versionConstraint":"<0.2.1 (semantic)"},"fix":{"suggestedVersion":"0.2.1"}}],"artifact":{"id":"pkg:npm/minimist@0.0.8?package-id=a1e50bdf96bae7b4","name":"minimist","version":"0.0.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:0.0.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@0.0.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-vh95-rmgr-6w4m","dataSource":"https://github.com/advisories/GHSA-vh95-rmgr-6w4m","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7598","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://www.npmjs.com/advisories/1179","https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68","https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab","https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95","https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.2.1"],"state":"fixed","available":[{"version":"0.2.1","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.0234300000000003},"relatedVulnerabilities":[{"id":"CVE-2020-7598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7598","namespace":"nvd:cpe","severity":"Medium","urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764"],"description":"minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"0.0.8"}},"found":{"vulnerabilityID":"GHSA-vh95-rmgr-6w4m","versionConstraint":"<0.2.1 (semantic)"},"fix":{"suggestedVersion":"0.2.1"}}],"artifact":{"id":"pkg:npm/minimist@0.0.8?package-id=fcfdadd30c7ba661","name":"minimist","version":"0.0.8","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:0.0.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@0.0.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-vh95-rmgr-6w4m","dataSource":"https://github.com/advisories/GHSA-vh95-rmgr-6w4m","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7598","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://www.npmjs.com/advisories/1179","https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68","https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab","https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95","https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.2.3"],"state":"fixed","available":[{"version":"1.2.3","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.0234300000000003},"relatedVulnerabilities":[{"id":"CVE-2020-7598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7598","namespace":"nvd:cpe","severity":"Medium","urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764"],"description":"minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"1.1.3"}},"found":{"vulnerabilityID":"GHSA-vh95-rmgr-6w4m","versionConstraint":">=1.0.0,<1.2.3 (semantic)"},"fix":{"suggestedVersion":"1.2.3"}}],"artifact":{"id":"pkg:npm/minimist@1.1.3?package-id=1900c889dca61237","name":"minimist","version":"1.1.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:1.1.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@1.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-vh95-rmgr-6w4m","dataSource":"https://github.com/advisories/GHSA-vh95-rmgr-6w4m","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7598","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://www.npmjs.com/advisories/1179","https://github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68","https://github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9ab","https://github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95","https://github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94"],"description":"Prototype Pollution in minimist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.2.3"],"state":"fixed","available":[{"version":"1.2.3","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":1.0234300000000003},"relatedVulnerabilities":[{"id":"CVE-2020-7598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7598","namespace":"nvd:cpe","severity":"Medium","urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://snyk.io/vuln/SNYK-JS-MINIMIST-559764"],"description":"minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7598","epss":0.01931,"percentile":0.80017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7598","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimist","version":"1.2.0"}},"found":{"vulnerabilityID":"GHSA-vh95-rmgr-6w4m","versionConstraint":">=1.0.0,<1.2.3 (semantic)"},"fix":{"suggestedVersion":"1.2.3"}}],"artifact":{"id":"pkg:npm/minimist@1.2.0?package-id=31eac31db3232a54","name":"minimist","version":"1.2.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimist:minimist:1.2.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/minimist@1.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5955-9wpr-37jh","dataSource":"https://github.com/advisories/GHSA-5955-9wpr-37jh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh","https://www.npmjs.com/package/tar","https://nvd.nist.gov/vuln/detail/CVE-2021-37713","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/isaacs/node-tar/commit/52b09e309bcae0c741a7eb79a17ef36e7828b946","https://github.com/isaacs/node-tar/commit/82eac952f7c10765969ed464e549375854b26edc","https://github.com/isaacs/node-tar/commit/875a37e3ec031186fc6599f6807341f56c584598"],"description":"Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-37713","epss":0.01273,"percentile":0.69896,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-37713","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37713","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.4.18"],"state":"fixed","available":[{"version":"4.4.18","date":"2021-09-01","kind":"first-observed"}]},"advisories":[],"risk":0.9993049999999998},"relatedVulnerabilities":[{"id":"CVE-2021-37713","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-37713","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh","https://www.npmjs.com/package/tar","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"The npm package \"tar\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\\path`. If the drive letter does not match the extraction target, for example `D:\\extraction\\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"exploitabilityScore":1.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.4,"exploitabilityScore":3.4,"impactScore":6.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-37713","epss":0.01273,"percentile":0.69896,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-37713","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37713","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-5955-9wpr-37jh","versionConstraint":"<4.4.18 (semantic)"},"fix":{"suggestedVersion":"4.4.18"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5955-9wpr-37jh","dataSource":"https://github.com/advisories/GHSA-5955-9wpr-37jh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh","https://www.npmjs.com/package/tar","https://nvd.nist.gov/vuln/detail/CVE-2021-37713","https://www.oracle.com/security-alerts/cpuoct2021.html","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/isaacs/node-tar/commit/52b09e309bcae0c741a7eb79a17ef36e7828b946","https://github.com/isaacs/node-tar/commit/82eac952f7c10765969ed464e549375854b26edc","https://github.com/isaacs/node-tar/commit/875a37e3ec031186fc6599f6807341f56c584598"],"description":"Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-37713","epss":0.01273,"percentile":0.69896,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-37713","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37713","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.4.18"],"state":"fixed","available":[{"version":"4.4.18","date":"2021-09-01","kind":"first-observed"}]},"advisories":[],"risk":0.9993049999999998},"relatedVulnerabilities":[{"id":"CVE-2021-37713","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-37713","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh","https://www.npmjs.com/package/tar","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"The npm package \"tar\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\\path`. If the drive letter does not match the extraction target, for example `D:\\extraction\\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"exploitabilityScore":1.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.4,"exploitabilityScore":3.4,"impactScore":6.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-37713","epss":0.01273,"percentile":0.69896,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-37713","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-37713","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-5955-9wpr-37jh","versionConstraint":"<4.4.18 (semantic)"},"fix":{"suggestedVersion":"4.4.18"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-c429-5p7v-vgjp","dataSource":"https://github.com/advisories/GHSA-c429-5p7v-vgjp","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36604","https://github.com/hapijs/hoek/issues/352","https://github.com/hapijs/hoek/commit/4d0804bc6135ad72afdc5e1ec002b935b2f5216a","https://github.com/hapijs/hoek/commit/948baf98634a5c206875b67d11368f133034fa90"],"description":"hoek subject to prototype pollution via the clone function.","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-36604","epss":0.01241,"percentile":0.69195,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-36604","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2020-36604","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.9679799999999998},"relatedVulnerabilities":[{"id":"CVE-2020-36604","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36604","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/hapijs/hoek/issues/352","https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452%29"],"description":"hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-36604","epss":0.01241,"percentile":0.69195,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-36604","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2020-36604","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hoek","version":"2.16.3"}},"found":{"vulnerabilityID":"GHSA-c429-5p7v-vgjp","versionConstraint":"<=6.1.3 (semantic)"}}],"artifact":{"id":"pkg:npm/hoek@2.16.3?package-id=8c4967f292409a05","name":"hoek","version":"2.16.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:hoek:hoek:2.16.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/hoek@2.16.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-gxpj-cx7g-858c","dataSource":"https://github.com/advisories/GHSA-gxpj-cx7g-858c","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-16137","https://github.com/visionmedia/debug/issues/501","https://github.com/visionmedia/debug/pull/504","https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E","https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E","https://github.com/debug-js/debug/issues/797","https://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020","https://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290","https://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac","https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a"],"description":"Regular Expression Denial of Service in debug","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16137","epss":0.02832,"percentile":0.8663,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.2.7"],"state":"fixed","available":[{"version":"3.2.7","date":"2023-10-03","kind":"first-observed"}]},"advisories":[],"risk":0.9487199999999999},"relatedVulnerabilities":[{"id":"CVE-2017-16137","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16137","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/visionmedia/debug/issues/501","https://github.com/visionmedia/debug/pull/504","https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E","https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E","https://nodesecurity.io/advisories/534"],"description":"The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16137","epss":0.02832,"percentile":0.8663,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"debug","version":"3.2.6"}},"found":{"vulnerabilityID":"GHSA-gxpj-cx7g-858c","versionConstraint":">=3.2.0,<3.2.7 (semantic)"},"fix":{"suggestedVersion":"3.2.7"}}],"artifact":{"id":"pkg:npm/debug@3.2.6?package-id=1a2f096bfcaeaa55","name":"debug","version":"3.2.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:debug_project:debug:3.2.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/debug@3.2.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-gxpj-cx7g-858c","dataSource":"https://github.com/advisories/GHSA-gxpj-cx7g-858c","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-16137","https://github.com/visionmedia/debug/issues/501","https://github.com/visionmedia/debug/pull/504","https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E","https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E","https://github.com/debug-js/debug/issues/797","https://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020","https://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290","https://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac","https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a"],"description":"Regular Expression Denial of Service in debug","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16137","epss":0.02832,"percentile":0.8663,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.2.7"],"state":"fixed","available":[{"version":"3.2.7","date":"2023-10-03","kind":"first-observed"}]},"advisories":[],"risk":0.9487199999999999},"relatedVulnerabilities":[{"id":"CVE-2017-16137","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16137","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/visionmedia/debug/issues/501","https://github.com/visionmedia/debug/pull/504","https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E","https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E","https://nodesecurity.io/advisories/534"],"description":"The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16137","epss":0.02832,"percentile":0.8663,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"debug","version":"3.2.6"}},"found":{"vulnerabilityID":"GHSA-gxpj-cx7g-858c","versionConstraint":">=3.2.0,<3.2.7 (semantic)"},"fix":{"suggestedVersion":"3.2.7"}}],"artifact":{"id":"pkg:npm/debug@3.2.6?package-id=237fb0d58a47348d","name":"debug","version":"3.2.6","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:debug_project:debug:3.2.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/debug@3.2.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-gxpj-cx7g-858c","dataSource":"https://github.com/advisories/GHSA-gxpj-cx7g-858c","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-16137","https://github.com/visionmedia/debug/issues/501","https://github.com/visionmedia/debug/pull/504","https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E","https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E","https://github.com/debug-js/debug/issues/797","https://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020","https://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290","https://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac","https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a"],"description":"Regular Expression Denial of Service in debug","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16137","epss":0.02832,"percentile":0.8663,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.3.1"],"state":"fixed","available":[{"version":"4.3.1","date":"2023-10-03","kind":"first-observed"}]},"advisories":[],"risk":0.9487199999999999},"relatedVulnerabilities":[{"id":"CVE-2017-16137","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16137","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/visionmedia/debug/issues/501","https://github.com/visionmedia/debug/pull/504","https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E","https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E","https://nodesecurity.io/advisories/534"],"description":"The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16137","epss":0.02832,"percentile":0.8663,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"debug","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-gxpj-cx7g-858c","versionConstraint":">=4.0.0,<4.3.1 (semantic)"},"fix":{"suggestedVersion":"4.3.1"}}],"artifact":{"id":"pkg:npm/debug@4.1.1?package-id=e1eff61228041064","name":"debug","version":"4.1.1","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:debug_project:debug:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/debug@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-gxpj-cx7g-858c","dataSource":"https://github.com/advisories/GHSA-gxpj-cx7g-858c","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-16137","https://github.com/visionmedia/debug/issues/501","https://github.com/visionmedia/debug/pull/504","https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E","https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E","https://github.com/debug-js/debug/issues/797","https://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020","https://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290","https://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac","https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a"],"description":"Regular Expression Denial of Service in debug","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16137","epss":0.02832,"percentile":0.8663,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.3.1"],"state":"fixed","available":[{"version":"4.3.1","date":"2023-10-03","kind":"first-observed"}]},"advisories":[],"risk":0.9487199999999999},"relatedVulnerabilities":[{"id":"CVE-2017-16137","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16137","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/visionmedia/debug/issues/501","https://github.com/visionmedia/debug/pull/504","https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E","https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E","https://nodesecurity.io/advisories/534"],"description":"The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16137","epss":0.02832,"percentile":0.8663,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16137","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"debug","version":"4.1.1"}},"found":{"vulnerabilityID":"GHSA-gxpj-cx7g-858c","versionConstraint":">=4.0.0,<4.3.1 (semantic)"},"fix":{"suggestedVersion":"4.3.1"}}],"artifact":{"id":"pkg:npm/debug@4.1.1?package-id=1443537c91a90108","name":"debug","version":"4.1.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:debug_project:debug:4.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/debug@4.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-x55w-vjjp-222r","dataSource":"https://github.com/advisories/GHSA-x55w-vjjp-222r","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3820","https://github.com/pksunkara/inflect/commit/a9a0a8e9561c3487854c7cae42565d9652ec858b","https://huntr.dev/bounties/4612b31a-072b-4f61-a916-c7e4cbc2042a"],"description":"inflect vulnerable to Inefficient Regular Expression Complexity","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3820","epss":0.01222,"percentile":0.68728,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3820","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3820","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.3.7"],"state":"fixed","available":[{"version":"0.3.7","date":"2021-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.9165},"relatedVulnerabilities":[{"id":"CVE-2021-3820","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3820","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pksunkara/inflect/commit/a9a0a8e9561c3487854c7cae42565d9652ec858b","https://huntr.dev/bounties/4612b31a-072b-4f61-a916-c7e4cbc2042a"],"description":"inflect is vulnerable to Inefficient Regular Expression Complexity","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security@huntr.dev","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-3820","epss":0.01222,"percentile":0.68728,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-3820","cwe":"CWE-1333","source":"security@huntr.dev","type":"Secondary"},{"cve":"CVE-2021-3820","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"i","version":"0.3.6"}},"found":{"vulnerabilityID":"GHSA-x55w-vjjp-222r","versionConstraint":"<0.3.7 (semantic)"},"fix":{"suggestedVersion":"0.3.7"}}],"artifact":{"id":"pkg:npm/i@0.3.6?package-id=fcdc8db34013c737","name":"i","version":"0.3.6","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:i:i:0.3.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/i@0.3.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-hvf8-h2qh-37m9","dataSource":"https://github.com/advisories/GHSA-hvf8-h2qh-37m9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-hvf8-h2qh-37m9","https://github.com/electron/electron/pull/26875","https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c","https://github.com/electron/electron/releases/tag/v9.4.0","https://www.electronjs.org/releases/stable?version=9#9.4.0","https://nvd.nist.gov/vuln/detail/CVE-2020-26272","https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208","https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2","https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc","https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd"],"description":"IPC messages delivered to the wrong frame in Electron","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-26272","epss":0.01746,"percentile":0.77806,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-26272","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.4.0"],"state":"fixed","available":[{"version":"9.4.0","date":"2021-01-30","kind":"first-observed"}]},"advisories":[],"risk":0.9079200000000001},"relatedVulnerabilities":[{"id":"CVE-2020-26272","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-26272","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c","https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208","https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2","https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc","https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd","https://github.com/electron/electron/pull/26875","https://github.com/electron/electron/releases/tag/v9.4.0","https://github.com/electron/electron/security/advisories/GHSA-hvf8-h2qh-37m9","https://www.electronjs.org/releases/stable?version=9#9.4.0"],"description":"The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue. This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no known workarounds for this issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"exploitabilityScore":10,"impactScore":5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-26272","epss":0.01746,"percentile":0.77806,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-26272","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-hvf8-h2qh-37m9","versionConstraint":"<9.4.0 (semantic)"},"fix":{"suggestedVersion":"9.4.0"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-j8xg-fqg3-53r7","dataSource":"https://github.com/advisories/GHSA-j8xg-fqg3-53r7","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-26115","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657","https://security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973","https://github.com/jonschlinkert/word-wrap/blob/master/index.js#L39","https://github.com/jonschlinkert/word-wrap/releases/tag/1.2.4","https://github.com/jonschlinkert/word-wrap/commit/420dce9a2412b21881202b73a3c34f0edc53cb2e","https://github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39","https://security.netapp.com/advisory/ntap-20240621-0006"],"description":"word-wrap vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26115","epss":0.01709,"percentile":0.77329,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26115","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26115","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.2.4"],"state":"fixed","available":[{"version":"1.2.4","date":"2023-07-19","kind":"first-observed"}]},"advisories":[],"risk":0.8801350000000001},"relatedVulnerabilities":[{"id":"CVE-2023-26115","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-26115","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jonschlinkert/word-wrap/blob/master/index.js%23L39","https://github.com/jonschlinkert/word-wrap/releases/tag/1.2.4","https://security.netapp.com/advisory/ntap-20240621-0006/","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657","https://security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973"],"description":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26115","epss":0.01709,"percentile":0.77329,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26115","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26115","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"word-wrap","version":"1.2.3"}},"found":{"vulnerabilityID":"GHSA-j8xg-fqg3-53r7","versionConstraint":"<1.2.4 (semantic)"},"fix":{"suggestedVersion":"1.2.4"}}],"artifact":{"id":"pkg:npm/word-wrap@1.2.3?package-id=a6e0920f580748ff","name":"word-wrap","version":"1.2.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:word-wrap_project:word-wrap:1.2.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/word-wrap@1.2.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-5fw9-fq32-wv5p","dataSource":"https://github.com/advisories/GHSA-5fw9-fq32-wv5p","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-7789","https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794","https://github.com/mikaelbr/node-notifier/commit/5d62799dab88505a709cd032653b2320c5813fce","https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371"],"description":"OS Command Injection in node-notifier","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7789","epss":0.01587,"percentile":0.75604,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7789","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["8.0.1"],"state":"fixed","available":[{"version":"8.0.1","date":"2020-12-22","kind":"first-observed"}]},"advisories":[],"risk":0.8411099999999999},"relatedVulnerabilities":[{"id":"CVE-2020-7789","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7789","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371","https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794"],"description":"This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7789","epss":0.01587,"percentile":0.75604,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7789","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"node-notifier","version":"5.4.5"}},"found":{"vulnerabilityID":"GHSA-5fw9-fq32-wv5p","versionConstraint":"<8.0.1 (semantic)"},"fix":{"suggestedVersion":"8.0.1"}}],"artifact":{"id":"pkg:npm/node-notifier@5.4.5?package-id=e2628d9a3ea9b4b8","name":"node-notifier","version":"5.4.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:node-notifier_project:node-notifier:5.4.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/node-notifier@5.4.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-44pw-h2cw-w3vq","dataSource":"https://github.com/advisories/GHSA-44pw-h2cw-w3vq","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq","https://nvd.nist.gov/vuln/detail/CVE-2022-29167","https://github.com/mozilla/hawk/pull/286","https://github.com/mozilla/hawk/commit/d10d72ca82db967f6c5fcf866ff78e3ca25ce1ab"],"description":"Uncontrolled Resource Consumption in Hawk","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-29167","epss":0.01101,"percentile":0.65704,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-29167","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-29167","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.1"],"state":"fixed","available":[{"version":"9.0.1","date":"2022-05-24","kind":"first-observed"}]},"advisories":[],"risk":0.820245},"relatedVulnerabilities":[{"id":"CVE-2022-29167","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29167","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/mozilla/hawk/pull/286","https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq"],"description":"Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-29167","epss":0.01101,"percentile":0.65704,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-29167","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-29167","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hawk","version":"3.1.3"}},"found":{"vulnerabilityID":"GHSA-44pw-h2cw-w3vq","versionConstraint":"<9.0.1 (semantic)"},"fix":{"suggestedVersion":"9.0.1"}}],"artifact":{"id":"pkg:npm/hawk@3.1.3?package-id=dadac98916f20a77","name":"hawk","version":"3.1.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:hawk:hawk:3.1.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/hawk@3.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-5fg8-2547-mr8q","dataSource":"https://github.com/advisories/GHSA-5fg8-2547-mr8q","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q","https://nvd.nist.gov/vuln/detail/CVE-2021-32796","https://github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8b","https://www.npmjs.com/package/@xmldom/xmldom","https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities","https://mattermost.com/blog/securing-xml-implementations-across-the-web"],"description":"Misinterpretation of malicious XML input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-32796","epss":0.01358,"percentile":0.71687,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-32796","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-32796","cwe":"CWE-91","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2021-32796","cwe":"CWE-116","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.7808499999999999},"relatedVulnerabilities":[{"id":"CVE-2021-32796","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-32796","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8b","https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q","https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/"],"description":"xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-32796","epss":0.01358,"percentile":0.71687,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-32796","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-32796","cwe":"CWE-91","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2021-32796","cwe":"CWE-116","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-5fg8-2547-mr8q","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-qpx9-hpmf-5gmw","dataSource":"https://github.com/advisories/GHSA-qpx9-hpmf-5gmw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw","https://github.com/jashkenas/underscore/issues/3011","https://underscorejs.org/#1.13.8","https://underscorejs.org/#flatten","https://underscorejs.org/#isEqual","https://nvd.nist.gov/vuln/detail/CVE-2026-27601","https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4","https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84"],"description":"Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27601","epss":0.01063,"percentile":0.6463,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27601","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.13.8"],"state":"fixed","available":[{"version":"1.13.8","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.7733325000000001},"relatedVulnerabilities":[{"id":"CVE-2026-27601","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27601","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jashkenas/underscore/commit/411e222eb0ca5d570cc4f6315c02c05b830ed2b4","https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84","https://github.com/jashkenas/underscore/security/advisories/GHSA-qpx9-hpmf-5gmw"],"description":"Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow. Untrusted input must be used to create a recursive datastructure, for example using JSON.parse, with no enforced depth limit. The datastructure thus created must be passed to _.flatten or _.isEqual. In the case of _.flatten, the vulnerability can only be exploited if it is possible for a remote client to prepare a datastructure that consists of arrays at all levels AND if no finite depth limit is passed as the second argument to _.flatten. In the case of _.isEqual, the vulnerability can only be exploited if there exists a code path in which two distinct datastructures that were submitted by the same remote client are compared using _.isEqual. For example, if a client submits data that are stored in a database, and the same client can later submit another datastructure that is then compared to the data that were saved in the database previously, OR if a client submits a single request, but its data are parsed twice, creating two non-identical but equivalent datastructures that are then compared. Exceptions originating from the call to _.flatten or _.isEqual, as a result of a stack overflow, are not being caught. This vulnerability is fixed in 1.13.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27601","epss":0.01063,"percentile":0.6463,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27601","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"underscore","version":"1.13.6"}},"found":{"vulnerabilityID":"GHSA-qpx9-hpmf-5gmw","versionConstraint":"<=1.13.7 (semantic)"},"fix":{"suggestedVersion":"1.13.8"}}],"artifact":{"id":"pkg:npm/underscore@1.13.6?package-id=49252d81d65a0672","name":"underscore","version":"1.13.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:underscorejs:underscore:1.13.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/underscore@1.13.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-h9jc-284h-533g","dataSource":"https://github.com/advisories/GHSA-h9jc-284h-533g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g","https://github.com/electron/electron/commit/b8e347709245d2dc5640fbb3044d9b21b4eaa6b0","https://nvd.nist.gov/vuln/detail/CVE-2020-4077","https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"],"description":"Context isolation bypass via contextBridge in Electron","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.7,"exploitabilityScore":3.2,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-4077","epss":0.01003,"percentile":0.62955,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-4077","cwe":"CWE-501","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-4077","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.2.4"],"state":"fixed","available":[{"version":"7.2.4","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":0.7622800000000001},"relatedVulnerabilities":[{"id":"CVE-2020-4077","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-4077","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g","https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"],"description":"In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"exploitabilityScore":3.2,"impactScore":6.1},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.7,"exploitabilityScore":3.2,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-4077","epss":0.01003,"percentile":0.62955,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-4077","cwe":"CWE-501","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-4077","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-h9jc-284h-533g","versionConstraint":"<7.2.4 (semantic)"},"fix":{"suggestedVersion":"7.2.4"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-8r5x-fm3f-whwj","dataSource":"https://github.com/advisories/GHSA-8r5x-fm3f-whwj","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj","https://nvd.nist.gov/vuln/detail/CVE-2026-106446","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106446","epss":0.00786,"percentile":0.56142,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106446","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.73884},"relatedVulnerabilities":[{"id":"CVE-2026-106446","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106446","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. The compiler emits those values into generated JavaScript, causing code execution in the server process when compile output renders or wherever precompile output is loaded. Applications that pass only template strings are not affected. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106446","epss":0.00786,"percentile":0.56142,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106446","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106446","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.7"}},"found":{"vulnerabilityID":"GHSA-8r5x-fm3f-whwj","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.7?package-id=94a6b0a915fbcc9f","name":"handlebars","version":"4.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.7:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2024-08-24","kind":"first-observed"}]},"advisories":[],"risk":0.735935},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"2.3.11"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"pkg:npm/micromatch@2.3.11?package-id=be167efd686a7a04","name":"micromatch","version":"2.3.11","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:micromatch:2.3.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/micromatch@2.3.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2024-08-24","kind":"first-observed"}]},"advisories":[],"risk":0.735935},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"3.1.10"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"pkg:npm/micromatch@3.1.10?package-id=7228601336b17257","name":"micromatch","version":"3.1.10","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:micromatch:3.1.10:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/micromatch@3.1.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2024-08-24","kind":"first-observed"}]},"advisories":[],"risk":0.735935},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"3.1.10"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"pkg:npm/micromatch@3.1.10?package-id=3501af2cf2e11dbf","name":"micromatch","version":"3.1.10","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:micromatch:3.1.10:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/micromatch@3.1.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2024-08-24","kind":"first-observed"}]},"advisories":[],"risk":0.735935},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"4.0.2"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"pkg:npm/micromatch@4.0.2?package-id=de505dada4b422d2","name":"micromatch","version":"4.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:micromatch:4.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/micromatch@4.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2024-08-24","kind":"first-observed"}]},"advisories":[],"risk":0.735935},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.01429,"percentile":0.73001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"4.0.5"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"pkg:npm/micromatch@4.0.5?package-id=2af99565e1869dc4","name":"micromatch","version":"4.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:micromatch:4.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/micromatch@4.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-776f-qx25-q3cc","dataSource":"https://github.com/advisories/GHSA-776f-qx25-q3cc","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-0842","https://github.com/Leonidas-from-XIV/node-xml2js/issues/663","https://github.com/Leonidas-from-XIV/node-xml2js/pull/603/commits/581b19a62d88f8a3c068b5a45f4542c2d6a495a5","https://fluidattacks.com/advisories/myers","https://github.com/Leonidas-from-XIV/node-xml2js","https://lists.debian.org/debian-lts-announce/2024/03/msg00013.html"],"description":"xml2js is vulnerable to prototype pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-0842","epss":0.01404,"percentile":0.72563,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-0842","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-0842","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.5.0"],"state":"fixed","available":[{"version":"0.5.0","date":"2023-04-11","kind":"first-observed"}]},"advisories":[],"risk":0.72306},"relatedVulnerabilities":[{"id":"CVE-2023-0842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0842","namespace":"nvd:cpe","severity":"Medium","urls":["https://fluidattacks.com/advisories/myers/","https://github.com/Leonidas-from-XIV/node-xml2js/","https://github.com/Leonidas-from-XIV/node-xml2js/releases/tag/0.6.2","https://lists.debian.org/debian-lts-announce/2024/03/msg00013.html"],"description":"xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-0842","epss":0.01404,"percentile":0.72563,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-0842","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-0842","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xml2js","version":"0.2.6"}},"found":{"vulnerabilityID":"GHSA-776f-qx25-q3cc","versionConstraint":"<0.5.0 (semantic)"},"fix":{"suggestedVersion":"0.5.0"}}],"artifact":{"id":"pkg:npm/xml2js@0.2.6?package-id=b6328fe25f3100cc","name":"xml2js","version":"0.2.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xml2js:xml2js:0.2.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/xml2js@0.2.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-776f-qx25-q3cc","dataSource":"https://github.com/advisories/GHSA-776f-qx25-q3cc","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-0842","https://github.com/Leonidas-from-XIV/node-xml2js/issues/663","https://github.com/Leonidas-from-XIV/node-xml2js/pull/603/commits/581b19a62d88f8a3c068b5a45f4542c2d6a495a5","https://fluidattacks.com/advisories/myers","https://github.com/Leonidas-from-XIV/node-xml2js","https://lists.debian.org/debian-lts-announce/2024/03/msg00013.html"],"description":"xml2js is vulnerable to prototype pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-0842","epss":0.01404,"percentile":0.72563,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-0842","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-0842","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.5.0"],"state":"fixed","available":[{"version":"0.5.0","date":"2023-04-11","kind":"first-observed"}]},"advisories":[],"risk":0.72306},"relatedVulnerabilities":[{"id":"CVE-2023-0842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0842","namespace":"nvd:cpe","severity":"Medium","urls":["https://fluidattacks.com/advisories/myers/","https://github.com/Leonidas-from-XIV/node-xml2js/","https://github.com/Leonidas-from-XIV/node-xml2js/releases/tag/0.6.2","https://lists.debian.org/debian-lts-announce/2024/03/msg00013.html"],"description":"xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-0842","epss":0.01404,"percentile":0.72563,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-0842","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-0842","cwe":"CWE-1321","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xml2js","version":"0.4.19"}},"found":{"vulnerabilityID":"GHSA-776f-qx25-q3cc","versionConstraint":"<0.5.0 (semantic)"},"fix":{"suggestedVersion":"0.5.0"}}],"artifact":{"id":"pkg:npm/xml2js@0.4.19?package-id=212444a8ea551e92","name":"xml2js","version":"0.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xml2js:xml2js:0.4.19:*:*:*:*:*:*:*"],"purl":"pkg:npm/xml2js@0.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-9wv6-86v2-598j","dataSource":"https://github.com/advisories/GHSA-9wv6-86v2-598j","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://nvd.nist.gov/vuln/detail/CVE-2024-45296","https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485","https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef","https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894","https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0","https://security.netapp.com/advisory/ntap-20250124-0001"],"description":"path-to-regexp outputs backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.1.10"],"state":"fixed","available":[{"version":"0.1.10","date":"2024-09-10","kind":"first-observed"}]},"advisories":[],"risk":0.7036600000000001},"relatedVulnerabilities":[{"id":"CVE-2024-45296","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45296","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://security.netapp.com/advisory/ntap-20250124-0001/"],"description":"path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"0.1.7"}},"found":{"vulnerabilityID":"GHSA-9wv6-86v2-598j","versionConstraint":"<0.1.10 (semantic)"},"fix":{"suggestedVersion":"0.1.10"}}],"artifact":{"id":"pkg:npm/path-to-regexp@0.1.7?package-id=a67dc2cc66b0e914","name":"path-to-regexp","version":"0.1.7","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:0.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@0.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-9wv6-86v2-598j","dataSource":"https://github.com/advisories/GHSA-9wv6-86v2-598j","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://nvd.nist.gov/vuln/detail/CVE-2024-45296","https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485","https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef","https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894","https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0","https://security.netapp.com/advisory/ntap-20250124-0001"],"description":"path-to-regexp outputs backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.1.10"],"state":"fixed","available":[{"version":"0.1.10","date":"2024-09-10","kind":"first-observed"}]},"advisories":[],"risk":0.7036600000000001},"relatedVulnerabilities":[{"id":"CVE-2024-45296","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45296","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://security.netapp.com/advisory/ntap-20250124-0001/"],"description":"path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45296","epss":0.00932,"percentile":0.60705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45296","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"0.1.7"}},"found":{"vulnerabilityID":"GHSA-9wv6-86v2-598j","versionConstraint":"<0.1.10 (semantic)"},"fix":{"suggestedVersion":"0.1.10"}}],"artifact":{"id":"pkg:npm/path-to-regexp@0.1.7?package-id=0fed262474b0e231","name":"path-to-regexp","version":"0.1.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:0.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@0.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-f9mq-jph6-9mhm","dataSource":"https://github.com/advisories/GHSA-f9mq-jph6-9mhm","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm","https://nvd.nist.gov/vuln/detail/CVE-2020-4075","https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"],"description":"Arbitrary file read via window-open IPC in Electron","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-4075","epss":0.01175,"percentile":0.67575,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-4075","cwe":"CWE-552","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-4075","cwe":"CWE-552","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.2.4"],"state":"fixed","available":[{"version":"7.2.4","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":0.6932499999999999},"relatedVulnerabilities":[{"id":"CVE-2020-4075","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-4075","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm","https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"],"description":"In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-4075","epss":0.01175,"percentile":0.67575,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-4075","cwe":"CWE-552","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-4075","cwe":"CWE-552","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-f9mq-jph6-9mhm","versionConstraint":"<7.2.4 (semantic)"},"fix":{"suggestedVersion":"7.2.4"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-rf6f-7fwh-wjgh","dataSource":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh","https://nvd.nist.gov/vuln/detail/CVE-2026-33228","https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802","https://github.com/WebReflection/flatted/releases/tag/v3.4.2","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-33228","https://bugzilla.redhat.com/show_bug.cgi?id=2449872"],"description":"Prototype Pollution via parse() in NodeJS flatted","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33228","epss":0.00838,"percentile":0.57795,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33228","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33228","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.4.2"],"state":"fixed","available":[{"version":"3.4.2","date":"2026-03-20","kind":"first-observed"}]},"advisories":[],"risk":0.6871600000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33228","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33228","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802","https://github.com/WebReflection/flatted/releases/tag/v3.4.2","https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-33228","https://bugzilla.redhat.com/show_bug.cgi?id=2449872","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33228.json"],"description":"flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key \"__proto__\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33228","epss":0.00838,"percentile":0.57795,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33228","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33228","cwe":"CWE-915","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"flatted","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-rf6f-7fwh-wjgh","versionConstraint":"<=3.4.1 (semantic)"},"fix":{"suggestedVersion":"3.4.2"}}],"artifact":{"id":"pkg:npm/flatted@2.0.2?package-id=88a778aaeee547ee","name":"flatted","version":"2.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:flatted:flatted:2.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/flatted@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.0.6"],"state":"fixed","available":[{"version":"6.0.6","date":"2024-11-19","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"5.1.0"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":"<6.0.6 (semantic)"},"fix":{"suggestedVersion":"6.0.6"}}],"artifact":{"id":"pkg:npm/cross-spawn@5.1.0?package-id=88c659fbe3059ac9","name":"cross-spawn","version":"5.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:5.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@5.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.0.6"],"state":"fixed","available":[{"version":"6.0.6","date":"2024-11-19","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"5.1.0"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":"<6.0.6 (semantic)"},"fix":{"suggestedVersion":"6.0.6"}}],"artifact":{"id":"pkg:npm/cross-spawn@5.1.0?package-id=9e1baee0617068f2","name":"cross-spawn","version":"5.1.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:5.1.0:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:5.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@5.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.0.6"],"state":"fixed","available":[{"version":"6.0.6","date":"2024-11-19","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"6.0.5"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":"<6.0.6 (semantic)"},"fix":{"suggestedVersion":"6.0.6"}}],"artifact":{"id":"pkg:npm/cross-spawn@6.0.5?package-id=62adeb9ab0c50012","name":"cross-spawn","version":"6.0.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:6.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@6.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["6.0.6"],"state":"fixed","available":[{"version":"6.0.6","date":"2024-11-19","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"6.0.5"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":"<6.0.6 (semantic)"},"fix":{"suggestedVersion":"6.0.6"}}],"artifact":{"id":"pkg:npm/cross-spawn@6.0.5?package-id=14e7ddc58d72dfba","name":"cross-spawn","version":"6.0.5","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:6.0.5:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:6.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@6.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-3xgq-45jj-v275","dataSource":"https://github.com/advisories/GHSA-3xgq-45jj-v275","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21538","https://github.com/moxystudio/node-cross-spawn/pull/160","https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230","https://github.com/moxystudio/node-cross-spawn/issues/165","https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349"],"description":"Regular Expression Denial of Service (ReDoS) in cross-spawn","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["7.0.5"],"state":"fixed","available":[{"version":"7.0.5","date":"2024-11-16","kind":"first-observed"}]},"advisories":[],"risk":0.65534},"relatedVulnerabilities":[{"id":"CVE-2024-21538","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21538","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff","https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f","https://github.com/moxystudio/node-cross-spawn/pull/160","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349","https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"],"description":"Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21538","epss":0.00868,"percentile":0.58749,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21538","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cross-spawn","version":"7.0.3"}},"found":{"vulnerabilityID":"GHSA-3xgq-45jj-v275","versionConstraint":">=7.0.0,<7.0.5 (semantic)"},"fix":{"suggestedVersion":"7.0.5"}}],"artifact":{"id":"pkg:npm/cross-spawn@7.0.3?package-id=be3a1024f4ee43be","name":"cross-spawn","version":"7.0.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cross-spawn:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross-spawn:cross_spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross_spawn:cross_spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross-spawn:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:cross:cross_spawn:7.0.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/cross-spawn@7.0.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-qwcr-r2fm-qrc7","dataSource":"https://github.com/advisories/GHSA-qwcr-r2fm-qrc7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7","https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce","https://nvd.nist.gov/vuln/detail/CVE-2024-45590"],"description":"body-parser vulnerable to denial of service when url encoding is enabled","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45590","epss":0.00824,"percentile":0.57388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45590","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.3"],"state":"fixed","available":[{"version":"1.20.3","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.6427200000000001},"relatedVulnerabilities":[{"id":"CVE-2024-45590","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45590","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce","https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7"],"description":"body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45590","epss":0.00824,"percentile":0.57388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45590","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.19.0"}},"found":{"vulnerabilityID":"GHSA-qwcr-r2fm-qrc7","versionConstraint":"<1.20.3 (semantic)"},"fix":{"suggestedVersion":"1.20.3"}}],"artifact":{"id":"pkg:npm/body-parser@1.19.0?package-id=18bd816c85cff5a3","name":"body-parser","version":"1.19.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:body-parser:1.19.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.19.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qwcr-r2fm-qrc7","dataSource":"https://github.com/advisories/GHSA-qwcr-r2fm-qrc7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7","https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce","https://nvd.nist.gov/vuln/detail/CVE-2024-45590"],"description":"body-parser vulnerable to denial of service when url encoding is enabled","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45590","epss":0.00824,"percentile":0.57388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45590","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.20.3"],"state":"fixed","available":[{"version":"1.20.3","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.6427200000000001},"relatedVulnerabilities":[{"id":"CVE-2024-45590","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45590","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce","https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7"],"description":"body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45590","epss":0.00824,"percentile":0.57388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-45590","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.20.1"}},"found":{"vulnerabilityID":"GHSA-qwcr-r2fm-qrc7","versionConstraint":"<1.20.3 (semantic)"},"fix":{"suggestedVersion":"1.20.3"}}],"artifact":{"id":"pkg:npm/body-parser@1.20.1?package-id=7f3f0b84d4a020ab","name":"body-parser","version":"1.20.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:body-parser:1.20.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.20.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-cqmj-92xf-r6r9","dataSource":"https://github.com/advisories/GHSA-cqmj-92xf-r6r9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9","https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3","https://github.com/socketio/socket.io-parser/commit/1c220ddbf45ea4b44bc8dbf6f9ae245f672ba1b9","https://nvd.nist.gov/vuln/detail/CVE-2023-32695","https://github.com/socketio/socket.io-parser/releases/tag/4.2.3","https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4"],"description":"Insufficient validation when decoding a Socket.IO packet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32695","epss":0.01059,"percentile":0.64545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-32695","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-32695","cwe":"CWE-754","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.3.4"],"state":"fixed","available":[{"version":"3.3.4","date":"2024-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.640695},"relatedVulnerabilities":[{"id":"CVE-2023-32695","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32695","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3","https://github.com/socketio/socket.io-parser/releases/tag/4.2.3","https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9"],"description":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32695","epss":0.01059,"percentile":0.64545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-32695","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-32695","cwe":"CWE-754","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io-parser","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-cqmj-92xf-r6r9","versionConstraint":"<3.3.4 (semantic)"},"fix":{"suggestedVersion":"3.3.4"}}],"artifact":{"id":"pkg:npm/socket.io-parser@3.3.3?package-id=2a8c8163abf9a442","name":"socket.io-parser","version":"3.3.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:socket:socket.io-parser:3.3.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io-parser@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-25h7-pfq9-p65f","dataSource":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","https://nvd.nist.gov/vuln/detail/CVE-2026-32141","https://github.com/WebReflection/flatted/pull/88","https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606"],"description":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-32141","epss":0.00839,"percentile":0.57851,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-32141","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-32141","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.4.0"],"state":"fixed","available":[{"version":"3.4.0","date":"2026-03-13","kind":"first-observed"}]},"advisories":[],"risk":0.62925},"relatedVulnerabilities":[{"id":"CVE-2026-32141","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32141","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606","https://github.com/WebReflection/flatted/pull/88","https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-32141","https://bugzilla.redhat.com/show_bug.cgi?id=2447083","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32141.json"],"description":"flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-32141","epss":0.00839,"percentile":0.57851,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-32141","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-32141","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"flatted","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-25h7-pfq9-p65f","versionConstraint":"<3.4.0 (semantic)"},"fix":{"suggestedVersion":"3.4.0"}}],"artifact":{"id":"pkg:npm/flatted@2.0.2?package-id=88a778aaeee547ee","name":"flatted","version":"2.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:flatted:flatted:2.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/flatted@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-h6q6-9hqw-rwfv","dataSource":"https://github.com/advisories/GHSA-h6q6-9hqw-rwfv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv","https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135","https://www.npmjs.com/package/xmldom","https://nvd.nist.gov/vuln/detail/CVE-2021-21366","https://github.com/xmldom/xmldom/releases/tag/0.5.0","https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"],"description":"Misinterpretation of malicious XML input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-21366","epss":0.0134,"percentile":0.71308,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-21366","cwe":"CWE-115","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-21366","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-21366","cwe":"CWE-436","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.5.0"],"state":"fixed","available":[{"version":"0.5.0","date":"2021-03-15","kind":"first-observed"}]},"advisories":[],"risk":0.6231},"relatedVulnerabilities":[{"id":"CVE-2021-21366","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-21366","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135","https://github.com/xmldom/xmldom/releases/tag/0.5.0","https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv","https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html","https://www.npmjs.com/package/xmldom"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-21366","epss":0.0134,"percentile":0.71308,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-21366","cwe":"CWE-115","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-21366","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-21366","cwe":"CWE-436","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-h6q6-9hqw-rwfv","versionConstraint":"<0.5.0 (semantic)"},"fix":{"suggestedVersion":"0.5.0"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-mpjm-v997-c4h4","dataSource":"https://github.com/advisories/GHSA-mpjm-v997-c4h4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-mpjm-v997-c4h4","https://github.com/electron/electron/pull/30728","https://nvd.nist.gov/vuln/detail/CVE-2021-39184","https://github.com/electron/electron/pull/30728/commits/8fed645bd671f359ee52d806c075ec4e07eda17f"],"description":"Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-39184","epss":0.0105,"percentile":0.64286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-39184","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-39184","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["11.5.0"],"state":"fixed","available":[{"version":"11.5.0","date":"2021-10-13","kind":"first-observed"}]},"advisories":[],"risk":0.6195},"relatedVulnerabilities":[{"id":"CVE-2021-39184","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-39184","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/pull/30728","https://github.com/electron/electron/security/advisories/GHSA-mpjm-v997-c4h4"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a \"thumbnail\" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. Versions 15.0.0-alpha.10, 14.0.0, 13.3.0, 12.1.0, and 11.5.0 all contain a fix for the vulnerability. Two workarounds aside from upgrading are available. One may make the vulnerability significantly more difficult for an attacker to exploit by enabling `contextIsolation` in one's app. One may also disable the functionality of the `createThumbnailFromPath` API if one does not need it.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-39184","epss":0.0105,"percentile":0.64286,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2021-39184","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2021-39184","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-mpjm-v997-c4h4","versionConstraint":"<11.5.0 (semantic)"},"fix":{"suggestedVersion":"11.5.0"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-332q-7ff2-57h2","dataSource":"https://github.com/advisories/GHSA-332q-7ff2-57h2","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-10795","https://github.com/remy/undefsafe/commit/f272681b3a50e2c4cbb6a8533795e1453382c822","https://snyk.io/vuln/SNYK-JS-UNDEFSAFE-548940"],"description":"Prototype Pollution in undefsafe","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10795","epss":0.01089,"percentile":0.65346,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-10795","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.0.3"],"state":"fixed","available":[{"version":"2.0.3","date":"2022-02-10","kind":"first-observed"}]},"advisories":[],"risk":0.615285},"relatedVulnerabilities":[{"id":"CVE-2019-10795","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10795","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/remy/undefsafe/commit/f272681b3a50e2c4cbb6a8533795e1453382c822","https://snyk.io/vuln/SNYK-JS-UNDEFSAFE-548940"],"description":"undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10795","epss":0.01089,"percentile":0.65346,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2019-10795","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"undefsafe","version":"2.0.2"}},"found":{"vulnerabilityID":"GHSA-332q-7ff2-57h2","versionConstraint":"<2.0.3 (semantic)"},"fix":{"suggestedVersion":"2.0.3"}}],"artifact":{"id":"pkg:npm/undefsafe@2.0.2?package-id=dc4fcd87e1d0e470","name":"undefsafe","version":"2.0.2","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:undefsafe_project:undefsafe:2.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/undefsafe@2.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-cxjh-pqwp-8mfp","dataSource":"https://github.com/advisories/GHSA-cxjh-pqwp-8mfp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp","https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b","https://fetch.spec.whatwg.org/#authentication-entries","https://nvd.nist.gov/vuln/detail/CVE-2024-28849","https://github.com/psf/requests/issues/1885","https://hackerone.com/reports/2390009","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z"],"description":"follow-redirects' Proxy-Authorization header kept across hosts","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28849","epss":0.01044,"percentile":0.64155,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-28849","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.15.6"],"state":"fixed","available":[{"version":"1.15.6","date":"2024-03-15","kind":"first-observed"}]},"advisories":[],"risk":0.6003},"relatedVulnerabilities":[{"id":"CVE-2024-28849","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28849","namespace":"nvd:cpe","severity":"Medium","urls":["https://fetch.spec.whatwg.org/#authentication-entries","https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b","https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp","https://github.com/psf/requests/issues/1885","https://hackerone.com/reports/2390009","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z/"],"description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28849","epss":0.01044,"percentile":0.64155,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-28849","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.15.2"}},"found":{"vulnerabilityID":"GHSA-cxjh-pqwp-8mfp","versionConstraint":"<=1.15.5 (semantic)"},"fix":{"suggestedVersion":"1.15.6"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.15.2?package-id=dc7623ae1813c8e8","name":"follow-redirects","version":"1.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.15.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rhx6-c78j-4q9w","dataSource":"https://github.com/advisories/GHSA-rhx6-c78j-4q9w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w","https://blakeembrey.com/posts/2024-09-web-redos","https://nvd.nist.gov/vuln/detail/CVE-2024-52798","https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4","https://security.netapp.com/advisory/ntap-20250124-0002"],"description":"path-to-regexp contains a ReDoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-52798","epss":0.00787,"percentile":0.56157,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-52798","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.1.12"],"state":"fixed","available":[{"version":"0.1.12","date":"2024-12-06","kind":"first-observed"}]},"advisories":[],"risk":0.5941850000000001},"relatedVulnerabilities":[{"id":"CVE-2024-52798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52798","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4","https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w","https://security.netapp.com/advisory/ntap-20250124-0002/"],"description":"path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-52798","epss":0.00787,"percentile":0.56157,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-52798","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"0.1.7"}},"found":{"vulnerabilityID":"GHSA-rhx6-c78j-4q9w","versionConstraint":"<0.1.12 (semantic)"},"fix":{"suggestedVersion":"0.1.12"}}],"artifact":{"id":"pkg:npm/path-to-regexp@0.1.7?package-id=a67dc2cc66b0e914","name":"path-to-regexp","version":"0.1.7","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:0.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@0.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-rhx6-c78j-4q9w","dataSource":"https://github.com/advisories/GHSA-rhx6-c78j-4q9w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w","https://blakeembrey.com/posts/2024-09-web-redos","https://nvd.nist.gov/vuln/detail/CVE-2024-52798","https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4","https://security.netapp.com/advisory/ntap-20250124-0002"],"description":"path-to-regexp contains a ReDoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-52798","epss":0.00787,"percentile":0.56157,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-52798","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.1.12"],"state":"fixed","available":[{"version":"0.1.12","date":"2024-12-06","kind":"first-observed"}]},"advisories":[],"risk":0.5941850000000001},"relatedVulnerabilities":[{"id":"CVE-2024-52798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52798","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4","https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w","https://security.netapp.com/advisory/ntap-20250124-0002/"],"description":"path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-52798","epss":0.00787,"percentile":0.56157,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-52798","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"0.1.7"}},"found":{"vulnerabilityID":"GHSA-rhx6-c78j-4q9w","versionConstraint":"<0.1.12 (semantic)"},"fix":{"suggestedVersion":"0.1.12"}}],"artifact":{"id":"pkg:npm/path-to-regexp@0.1.7?package-id=0fed262474b0e231","name":"path-to-regexp","version":"0.1.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:0.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@0.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-3mfm-83xf-c92r","dataSource":"https://github.com/advisories/GHSA-3mfm-83xf-c92r","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33938"],"description":"Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33938","epss":0.00721,"percentile":0.5398,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33938","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-917","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.56238},"relatedVulnerabilities":[{"id":"CVE-2026-33938","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33938","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33938","https://bugzilla.redhat.com/show_bug.cgi?id=2452525","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33938.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{> @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). The `compile()` method is  absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers  should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as `handlebars-helpers`) in  contexts where templates or context data can be influenced by untrusted input.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33938","epss":0.00721,"percentile":0.5398,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33938","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33938","cwe":"CWE-917","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.7"}},"found":{"vulnerabilityID":"GHSA-3mfm-83xf-c92r","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.7?package-id=94a6b0a915fbcc9f","name":"handlebars","version":"4.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.7:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-xhpv-hc6g-r9c6","dataSource":"https://github.com/advisories/GHSA-xhpv-hc6g-r9c6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33940"],"description":"Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33940","epss":0.00715,"percentile":0.53771,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.5577000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33940","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33940","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33940","https://bugzilla.redhat.com/show_bug.cgi?id=2452521","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33940.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). Without `compile()`,  the fallback compilation path in `invokePartial` is unreachable. Second, sanitize context data before rendering: Ensure no value in the context is a non-primitive  object that could be passed to a dynamic partial. Third, avoid dynamic partial lookups (`{{> (lookup ...)}}`) when context data is user-controlled.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33940","epss":0.00715,"percentile":0.53771,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33940","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.7"}},"found":{"vulnerabilityID":"GHSA-xhpv-hc6g-r9c6","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.7?package-id=94a6b0a915fbcc9f","name":"handlebars","version":"4.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.7:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-gcx4-mw62-g8wm","dataSource":"https://github.com/advisories/GHSA-gcx4-mw62-g8wm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm","https://nvd.nist.gov/vuln/detail/CVE-2024-47068","https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4","https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541","https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162","https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185"],"description":"DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47068","epss":0.00742,"percentile":0.54707,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47068","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.79.2"],"state":"fixed","available":[{"version":"2.79.2","date":"2024-09-27","kind":"first-observed"}]},"advisories":[],"risk":0.5509350000000001},"relatedVulnerabilities":[{"id":"CVE-2024-47068","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47068","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162","https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185","https://github.com/rollup/rollup/commit/2ef77c00ec2635d42697cff2c0567ccc8db34fb4","https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541","https://github.com/rollup/rollup/security/advisories/GHSA-gcx4-mw62-g8wm"],"description":"Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4  contain a patch for the vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47068","epss":0.00742,"percentile":0.54707,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47068","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"rollup","version":"1.32.1"}},"found":{"vulnerabilityID":"GHSA-gcx4-mw62-g8wm","versionConstraint":"<2.79.2 (semantic)"},"fix":{"suggestedVersion":"2.79.2"}}],"artifact":{"id":"pkg:npm/rollup@1.32.1?package-id=11d4fdab28eaa257","name":"rollup","version":"1.32.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:rollupjs:rollup:1.32.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/rollup@1.32.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-p8wg-vrv2-v86f","dataSource":"https://github.com/advisories/GHSA-p8wg-vrv2-v86f","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f","https://nvd.nist.gov/vuln/detail/CVE-2026-106445","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via Own Property Check Bypass","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106445","epss":0.00589,"percentile":0.48165,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.53599},"relatedVulnerabilities":[{"id":"CVE-2026-106445","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106445","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106445","epss":0.00589,"percentile":0.48165,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106445","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-106445","cwe":"CWE-1289","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.7"}},"found":{"vulnerabilityID":"GHSA-p8wg-vrv2-v86f","versionConstraint":">=3.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.7?package-id=94a6b0a915fbcc9f","name":"handlebars","version":"4.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.7:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-f5x3-32g6-xq36","dataSource":"https://github.com/advisories/GHSA-f5x3-32g6-xq36","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://nvd.nist.gov/vuln/detail/CVE-2024-28863","https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://security.netapp.com/advisory/ntap-20240524-0005"],"description":"Denial of service while parsing a tar file due to lack of folders count validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.00929,"percentile":0.6059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.2.1"],"state":"fixed","available":[{"version":"6.2.1","date":"2024-04-10","kind":"first-observed"}]},"advisories":[],"risk":0.534175},"relatedVulnerabilities":[{"id":"CVE-2024-28863","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28863","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://security.netapp.com/advisory/ntap-20240524-0005/"],"description":"node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.00929,"percentile":0.6059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-f5x3-32g6-xq36","versionConstraint":"<6.2.1 (semantic)"},"fix":{"suggestedVersion":"6.2.1"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-f5x3-32g6-xq36","dataSource":"https://github.com/advisories/GHSA-f5x3-32g6-xq36","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://nvd.nist.gov/vuln/detail/CVE-2024-28863","https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://security.netapp.com/advisory/ntap-20240524-0005"],"description":"Denial of service while parsing a tar file due to lack of folders count validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.00929,"percentile":0.6059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.2.1"],"state":"fixed","available":[{"version":"6.2.1","date":"2024-04-10","kind":"first-observed"}]},"advisories":[],"risk":0.534175},"relatedVulnerabilities":[{"id":"CVE-2024-28863","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28863","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://security.netapp.com/advisory/ntap-20240524-0005/"],"description":"node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.00929,"percentile":0.6059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-f5x3-32g6-xq36","versionConstraint":"<6.2.1 (semantic)"},"fix":{"suggestedVersion":"6.2.1"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-f5x3-32g6-xq36","dataSource":"https://github.com/advisories/GHSA-f5x3-32g6-xq36","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://nvd.nist.gov/vuln/detail/CVE-2024-28863","https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://security.netapp.com/advisory/ntap-20240524-0005"],"description":"Denial of service while parsing a tar file due to lack of folders count validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.00929,"percentile":0.6059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.2.1"],"state":"fixed","available":[{"version":"6.2.1","date":"2024-04-10","kind":"first-observed"}]},"advisories":[],"risk":0.534175},"relatedVulnerabilities":[{"id":"CVE-2024-28863","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28863","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://security.netapp.com/advisory/ntap-20240524-0005/"],"description":"node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.00929,"percentile":0.6059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-f5x3-32g6-xq36","versionConstraint":"<6.2.1 (semantic)"},"fix":{"suggestedVersion":"6.2.1"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-77xc-hjv8-ww97","dataSource":"https://github.com/advisories/GHSA-77xc-hjv8-ww97","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-77xc-hjv8-ww97","https://nvd.nist.gov/vuln/detail/CVE-2022-29257"],"description":"AutoUpdater module fails to validate certain nested components of the bundle","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-29257","epss":0.00916,"percentile":0.60197,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-29257","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["15.5.0"],"state":"fixed","available":[{"version":"15.5.0","date":"2022-06-17","kind":"first-observed"}]},"advisories":[],"risk":0.53128},"relatedVulnerabilities":[{"id":"CVE-2022-29257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-77xc-hjv8-ww97"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components. This kind of attack would require significant privileges in a potential victim's own auto updating infrastructure and the ease of that attack entirely depends on the potential victim's infrastructure security. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. There are no known workarounds.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-29257","epss":0.00916,"percentile":0.60197,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-29257","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-77xc-hjv8-ww97","versionConstraint":"<15.5.0 (semantic)"},"fix":{"suggestedVersion":"15.5.0"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-hmw2-7cc7-3qxx","dataSource":"https://github.com/advisories/GHSA-hmw2-7cc7-3qxx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://nvd.nist.gov/vuln/detail/CVE-2026-12143","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data"],"description":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["2.5.6"],"state":"fixed","available":[{"version":"2.5.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.5218200000000001},"relatedVulnerabilities":[{"id":"CVE-2026-12143","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","namespace":"nvd:cpe","severity":"High","urls":["https://cwe.mitre.org/data/definitions/93.html","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54770","https://access.redhat.com/errata/RHSA-2026:56338","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59136","https://access.redhat.com/errata/RHSA-2026:59153","https://access.redhat.com/errata/RHSA-2026:59155","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60389","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63355","https://access.redhat.com/errata/RHSA-2026:63373","https://access.redhat.com/errata/RHSA-2026:66003","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-12143","https://bugzilla.redhat.com/show_bug.cgi?id=2488480","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json"],"description":"form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `\"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"form-data","version":"2.1.4"}},"found":{"vulnerabilityID":"GHSA-hmw2-7cc7-3qxx","versionConstraint":"<2.5.6 (semantic)"},"fix":{"suggestedVersion":"2.5.6"}}],"artifact":{"id":"pkg:npm/form-data@2.1.4?package-id=2dbe8da4f13eb60c","name":"form-data","version":"2.1.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:form-data:form-data:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:form-data:form_data:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form-data:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form_data:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:form:form-data:2.1.4:*:*:*:*:*:*:*","cpe:2.3:a:form:form_data:2.1.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/form-data@2.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-hmw2-7cc7-3qxx","dataSource":"https://github.com/advisories/GHSA-hmw2-7cc7-3qxx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://nvd.nist.gov/vuln/detail/CVE-2026-12143","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data"],"description":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["2.5.6"],"state":"fixed","available":[{"version":"2.5.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.5218200000000001},"relatedVulnerabilities":[{"id":"CVE-2026-12143","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","namespace":"nvd:cpe","severity":"High","urls":["https://cwe.mitre.org/data/definitions/93.html","https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","https://www.npmjs.com/package/form-data","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41929","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:44263","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:48124","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:54770","https://access.redhat.com/errata/RHSA-2026:56338","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59136","https://access.redhat.com/errata/RHSA-2026:59153","https://access.redhat.com/errata/RHSA-2026:59155","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60389","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63355","https://access.redhat.com/errata/RHSA-2026:63373","https://access.redhat.com/errata/RHSA-2026:66003","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-12143","https://bugzilla.redhat.com/show_bug.cgi?id=2488480","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12143.json"],"description":"form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `\"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12143","epss":0.00669,"percentile":0.51971,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-12143","cwe":"CWE-93","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"form-data","version":"2.3.3"}},"found":{"vulnerabilityID":"GHSA-hmw2-7cc7-3qxx","versionConstraint":"<2.5.6 (semantic)"},"fix":{"suggestedVersion":"2.5.6"}}],"artifact":{"id":"pkg:npm/form-data@2.3.3?package-id=2fdb266fa204cae0","name":"form-data","version":"2.3.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:form-data:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form-data:form_data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form_data:form_data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form:form-data:2.3.3:*:*:*:*:*:*:*","cpe:2.3:a:form:form_data:2.3.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/form-data@2.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-2v35-w6hq-6mfw","dataSource":"https://github.com/advisories/GHSA-2v35-w6hq-6mfw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw","https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa","https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597","https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f","https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a","https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe","https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3","https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112","https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb","https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10","https://nvd.nist.gov/vuln/detail/CVE-2026-41673"],"description":"xmldom: Uncontrolled recursion in XML serialization leads to DoS","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41673","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41673","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41673","cwe":"CWE-776","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.52083},"relatedVulnerabilities":[{"id":"CVE-2026-41673","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41673","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa","https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597","https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f","https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a","https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe","https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3","https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112","https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb","https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10","https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/security/cve/CVE-2026-41673","https://bugzilla.redhat.com/show_bug.cgi?id=2467630","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41673.json"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41673","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41673","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41673","cwe":"CWE-776","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-2v35-w6hq-6mfw","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-23hp-3jrh-7fpw","dataSource":"https://github.com/advisories/GHSA-23hp-3jrh-7fpw","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","https://nvd.nist.gov/vuln/detail/CVE-2026-59873","https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19"],"description":"node-tar: Decompression/parse DoS via unlimited input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.19"],"state":"fixed","available":[{"version":"7.5.19","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.5048849999999999},"relatedVulnerabilities":[{"id":"CVE-2026-59873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19","https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-23hp-3jrh-7fpw","versionConstraint":"<=7.5.18 (semantic)"},"fix":{"suggestedVersion":"7.5.19"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23hp-3jrh-7fpw","dataSource":"https://github.com/advisories/GHSA-23hp-3jrh-7fpw","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","https://nvd.nist.gov/vuln/detail/CVE-2026-59873","https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19"],"description":"node-tar: Decompression/parse DoS via unlimited input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.19"],"state":"fixed","available":[{"version":"7.5.19","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.5048849999999999},"relatedVulnerabilities":[{"id":"CVE-2026-59873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19","https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-23hp-3jrh-7fpw","versionConstraint":"<=7.5.18 (semantic)"},"fix":{"suggestedVersion":"7.5.19"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-23hp-3jrh-7fpw","dataSource":"https://github.com/advisories/GHSA-23hp-3jrh-7fpw","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw","https://nvd.nist.gov/vuln/detail/CVE-2026-59873","https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19"],"description":"node-tar: Decompression/parse DoS via unlimited input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.19"],"state":"fixed","available":[{"version":"7.5.19","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.5048849999999999},"relatedVulnerabilities":[{"id":"CVE-2026-59873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3","https://github.com/isaacs/node-tar/releases/tag/v7.5.19","https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59873","epss":0.00582,"percentile":0.47813,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59873","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-23hp-3jrh-7fpw","versionConstraint":"<=7.5.18 (semantic)"},"fix":{"suggestedVersion":"7.5.19"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-7fh5-64p2-3v2j","dataSource":"https://github.com/advisories/GHSA-7fh5-64p2-3v2j","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-44270","https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5","https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25","https://github.com/postcss/postcss/releases/tag/8.4.31","https://github.com/github/advisory-database/issues/2820","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html"],"description":"PostCSS line return parsing error","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-44270","epss":0.00973,"percentile":0.62033,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-44270","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["8.4.31"],"state":"fixed","available":[{"version":"8.4.31","date":"2023-10-04","kind":"first-observed"}]},"advisories":[],"risk":0.5010950000000001},"relatedVulnerabilities":[{"id":"CVE-2023-44270","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44270","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/github/advisory-database/issues/2820","https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25","https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5","https://github.com/postcss/postcss/releases/tag/8.4.31","https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html"],"description":"An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-44270","epss":0.00973,"percentile":0.62033,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-44270","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"5.2.18"}},"found":{"vulnerabilityID":"GHSA-7fh5-64p2-3v2j","versionConstraint":"<8.4.31 (semantic)"},"fix":{"suggestedVersion":"8.4.31"}}],"artifact":{"id":"pkg:npm/postcss@5.2.18?package-id=a2216b0d3db52a78","name":"postcss","version":"5.2.18","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:postcss:postcss:5.2.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@5.2.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-4w3w-2rp5-g8jm","dataSource":"https://github.com/advisories/GHSA-4w3w-2rp5-g8jm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm","https://nvd.nist.gov/vuln/detail/CVE-2026-83605","https://github.com/xmldom/xmldom/pull/1043","https://github.com/xmldom/xmldom/pull/1050","https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e","https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44","https://github.com/xmldom/xmldom/releases/tag/0.8.14","https://github.com/xmldom/xmldom/releases/tag/0.9.11"],"description":"xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83605","epss":0.00612,"percentile":0.49309,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83605","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.49571999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-83605","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83605","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e","https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44","https://github.com/xmldom/xmldom/pull/1043","https://github.com/xmldom/xmldom/pull/1050","https://github.com/xmldom/xmldom/releases/tag/0.8.14","https://github.com/xmldom/xmldom/releases/tag/0.9.11","https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83605","epss":0.00612,"percentile":0.49309,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83605","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-4w3w-2rp5-g8jm","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-c7q8-3ch8-vqpv","dataSource":"https://github.com/advisories/GHSA-c7q8-3ch8-vqpv","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv","https://nvd.nist.gov/vuln/detail/CVE-2026-83616","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9","https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12"],"description":"xmldom: Processing Instruction Target Injection Bypasses requireWellFormed","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83616","epss":0.00612,"percentile":0.49309,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83616","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.49571999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-83616","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83616","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9","https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12","https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x. Because serialization emits <?target data?>, a target containing >, ?, whitespace, or another invalid XML-name character can break the processing-instruction boundary and inject XML structure. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83616","epss":0.00612,"percentile":0.49309,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83616","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-c7q8-3ch8-vqpv","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-w2rr-34g9-rvrj","dataSource":"https://github.com/advisories/GHSA-w2rr-34g9-rvrj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj","https://nvd.nist.gov/vuln/detail/CVE-2026-83607","https://github.com/xmldom/xmldom/pull/1043","https://github.com/xmldom/xmldom/pull/1050","https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e","https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44","https://github.com/xmldom/xmldom/releases/tag/0.8.14","https://github.com/xmldom/xmldom/releases/tag/0.9.11"],"description":"xmldom: Element name injection via createElement() bypasses requireWellFormed","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83607","epss":0.00612,"percentile":0.49309,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83607","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.49571999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-83607","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83607","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/xmldom/xmldom/commit/cba1321218b069182695813fa7565653708e172e","https://github.com/xmldom/xmldom/commit/d8212e632507eaf1d9f609657dd4c56abeb12d44","https://github.com/xmldom/xmldom/pull/1043","https://github.com/xmldom/xmldom/pull/1050","https://github.com/xmldom/xmldom/releases/tag/0.8.14","https://github.com/xmldom/xmldom/releases/tag/0.9.11","https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83607","epss":0.00612,"percentile":0.49309,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83607","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-w2rr-34g9-rvrj","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-27p8-2357-5qqv","dataSource":"https://github.com/advisories/GHSA-27p8-2357-5qqv","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv","https://nvd.nist.gov/vuln/detail/CVE-2026-83608","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e","https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12"],"description":"xmldom: DocType `name` Injection Bypasses requireWellFormed","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83608","epss":0.00612,"percentile":0.49308,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83608","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.49571999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-83608","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83608","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e","https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12","https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the <!DOCTYPE ...> declaration and inject sibling markup; the value can be supplied through createDocumentType() on the 0.8.x and unscoped lines or through a direct DocumentType.name property write on every affected line. The default path and legacy creation-time behavior remain permissive, while the vulnerable strict path fails to enforce an XML Name. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83608","epss":0.00612,"percentile":0.49308,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83608","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-27p8-2357-5qqv","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"1.7.7"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@1.7.7?package-id=a22ff3432a45a094","name":"browserslist","version":"1.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:1.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@1.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"3.2.8"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@3.2.8?package-id=c62bc9578bdd0eb3","name":"browserslist","version":"3.2.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:3.2.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@3.2.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.16.3"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.16.3?package-id=3ec28aaee5ad11f1","name":"browserslist","version":"4.16.3","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.16.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.16.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.16.3"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.16.3?package-id=6051dad1be54c1ee","name":"browserslist","version":"4.16.3","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.16.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.16.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.21.10"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.21.10?package-id=2fd63354c9869838","name":"browserslist","version":"4.21.10","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.21.10:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.21.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-73wf-gq98-2v4g","dataSource":"https://github.com/advisories/GHSA-73wf-gq98-2v4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g","https://nvd.nist.gov/vuln/detail/CVE-2026-73088","https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.4935},"relatedVulnerabilities":[{"id":"CVE-2026-73088","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73088","epss":0.00658,"percentile":0.51501,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73088","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73088","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.21.5"}},"found":{"vulnerabilityID":"GHSA-73wf-gq98-2v4g","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.21.5?package-id=f924423fe3f6082c","name":"browserslist","version":"4.21.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.21.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.21.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"1.7.7"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@1.7.7?package-id=a22ff3432a45a094","name":"browserslist","version":"1.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:1.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@1.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"3.2.8"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@3.2.8?package-id=c62bc9578bdd0eb3","name":"browserslist","version":"3.2.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:3.2.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@3.2.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.16.3"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.16.3?package-id=3ec28aaee5ad11f1","name":"browserslist","version":"4.16.3","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.16.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.16.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.16.3"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.16.3?package-id=6051dad1be54c1ee","name":"browserslist","version":"4.16.3","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.16.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.16.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.21.10"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.21.10?package-id=2fd63354c9869838","name":"browserslist","version":"4.21.10","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.21.10:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.21.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-c83g-rgw3-j3cx","dataSource":"https://github.com/advisories/GHSA-c83g-rgw3-j3cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx","https://nvd.nist.gov/vuln/detail/CVE-2026-73089","https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7"],"description":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.28.7"],"state":"fixed","available":[{"version":"4.28.7","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49125},"relatedVulnerabilities":[{"id":"CVE-2026-73089","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405","https://github.com/browserslist/browserslist/releases/tag/4.28.7","https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"],"description":"Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73089","epss":0.00655,"percentile":0.51388,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73089","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"browserslist","version":"4.21.5"}},"found":{"vulnerabilityID":"GHSA-c83g-rgw3-j3cx","versionConstraint":"<=4.28.6 (semantic)"},"fix":{"suggestedVersion":"4.28.7"}}],"artifact":{"id":"pkg:npm/browserslist@4.21.5?package-id=f924423fe3f6082c","name":"browserslist","version":"4.21.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:browserslist_project:browserslist:4.21.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/browserslist@4.21.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-8344-3jmq-59r6","dataSource":"https://github.com/advisories/GHSA-8344-3jmq-59r6","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv","https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6","https://nvd.nist.gov/vuln/detail/CVE-2026-83613","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213","https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12"],"description":"xmldom: Quadratic-time attribute deduplication","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83613","epss":0.00604,"percentile":0.48897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83613","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.48924},"relatedVulnerabilities":[{"id":"CVE-2026-83613","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83613","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213","https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12","https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6","https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83613","epss":0.00604,"percentile":0.48897,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83613","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-8344-3jmq-59r6","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-25hc-qcg6-38wj","dataSource":"https://github.com/advisories/GHSA-25hc-qcg6-38wj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj","https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115","https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c","https://nvd.nist.gov/vuln/detail/CVE-2024-38355"],"description":"socket.io has an unhandled 'error' event","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-38355","epss":0.00807,"percentile":0.56841,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-38355","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-38355","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.5.1"],"state":"fixed","available":[{"version":"2.5.1","date":"2024-06-20","kind":"first-observed"}]},"advisories":[],"risk":0.4882350000000001},"relatedVulnerabilities":[{"id":"CVE-2024-38355","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38355","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115","https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c","https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj","https://www.vicarius.io/vsociety/posts/unhandled-exception-in-socketio-cve-2024-38355"],"description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\" event to catch these errors.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-38355","epss":0.00807,"percentile":0.56841,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-38355","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-38355","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io","version":"2.5.0"}},"found":{"vulnerabilityID":"GHSA-25hc-qcg6-38wj","versionConstraint":"<2.5.1 (semantic)"},"fix":{"suggestedVersion":"2.5.1"}}],"artifact":{"id":"pkg:npm/socket.io@2.5.0?package-id=a9ea25aa6731c2d6","name":"socket.io","version":"2.5.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:socket:socket.io:2.5.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io@2.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2371e2ddff0f5bc0","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=7059a7b443401e23","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=374d713d4d50aa6f","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-rgw5-rvv9-x895","dataSource":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://nvd.nist.gov/vuln/detail/CVE-2026-69152"],"description":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.18"],"state":"fixed","available":[{"version":"1.1.18","date":"2026-08-03","kind":"first-observed"}]},"advisories":[],"risk":0.48525},"relatedVulnerabilities":[{"id":"CVE-2026-69152","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69152","epss":0.00647,"percentile":0.51007,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69152","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69152","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-rgw5-rvv9-x895","versionConstraint":"<1.1.18 (semantic)"},"fix":{"suggestedVersion":"1.1.18"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2b36477cae56122e","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2b36477cae56122e","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=374d713d4d50aa6f","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=7059a7b443401e23","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh99-v99m-4gvg","dataSource":"https://github.com/advisories/GHSA-mh99-v99m-4gvg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"],"description":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.17"],"state":"fixed","available":[{"version":"1.1.17","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.48225000000000007},"relatedVulnerabilities":[{"id":"CVE-2026-14257","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-14257","epss":0.00643,"percentile":0.5082,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-14257","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-14257","cwe":"CWE-770","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-mh99-v99m-4gvg","versionConstraint":"<1.1.17 (semantic)"},"fix":{"suggestedVersion":"1.1.17"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2371e2ddff0f5bc0","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-67hx-6x53-jw92","dataSource":"https://github.com/advisories/GHSA-67hx-6x53-jw92","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://nvd.nist.gov/vuln/detail/CVE-2023-45133","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://www.debian.org/security/2023/dsa-5528","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://babeljs.io/blog/2023/10/16/cve-2023-45133"],"description":"Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.23.2"],"state":"fixed","available":[{"version":"7.23.2","date":"2023-10-17","kind":"first-observed"}]},"advisories":[],"risk":0.48037500000000005},"relatedVulnerabilities":[{"id":"CVE-2023-45133","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45133","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://www.debian.org/security/2023/dsa-5528"],"description":"Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any \"polyfill provider\" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/traverse","version":"7.12.17"}},"found":{"vulnerabilityID":"GHSA-67hx-6x53-jw92","versionConstraint":"<7.23.2 (semantic)"},"fix":{"suggestedVersion":"7.23.2"}}],"artifact":{"id":"pkg:npm/%40babel/traverse@7.12.17?package-id=76b0516005db13e0","name":"@babel/traverse","version":"7.12.17","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/traverse:\\@babel\\/traverse:7.12.17:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/traverse@7.12.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-67hx-6x53-jw92","dataSource":"https://github.com/advisories/GHSA-67hx-6x53-jw92","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://nvd.nist.gov/vuln/detail/CVE-2023-45133","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://www.debian.org/security/2023/dsa-5528","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://babeljs.io/blog/2023/10/16/cve-2023-45133"],"description":"Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.23.2"],"state":"fixed","available":[{"version":"7.23.2","date":"2023-10-17","kind":"first-observed"}]},"advisories":[],"risk":0.48037500000000005},"relatedVulnerabilities":[{"id":"CVE-2023-45133","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45133","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://www.debian.org/security/2023/dsa-5528"],"description":"Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any \"polyfill provider\" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/traverse","version":"7.12.17"}},"found":{"vulnerabilityID":"GHSA-67hx-6x53-jw92","versionConstraint":"<7.23.2 (semantic)"},"fix":{"suggestedVersion":"7.23.2"}}],"artifact":{"id":"pkg:npm/%40babel/traverse@7.12.17?package-id=e1168f579aa57421","name":"@babel/traverse","version":"7.12.17","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/traverse:\\@babel\\/traverse:7.12.17:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/traverse@7.12.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-67hx-6x53-jw92","dataSource":"https://github.com/advisories/GHSA-67hx-6x53-jw92","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://nvd.nist.gov/vuln/detail/CVE-2023-45133","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://www.debian.org/security/2023/dsa-5528","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://babeljs.io/blog/2023/10/16/cve-2023-45133"],"description":"Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.23.2"],"state":"fixed","available":[{"version":"7.23.2","date":"2023-10-17","kind":"first-observed"}]},"advisories":[],"risk":0.48037500000000005},"relatedVulnerabilities":[{"id":"CVE-2023-45133","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45133","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://www.debian.org/security/2023/dsa-5528"],"description":"Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any \"polyfill provider\" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/traverse","version":"7.12.17"}},"found":{"vulnerabilityID":"GHSA-67hx-6x53-jw92","versionConstraint":"<7.23.2 (semantic)"},"fix":{"suggestedVersion":"7.23.2"}}],"artifact":{"id":"pkg:npm/%40babel/traverse@7.12.17?package-id=ee375421bacadcf8","name":"@babel/traverse","version":"7.12.17","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/traverse:\\@babel\\/traverse:7.12.17:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/traverse@7.12.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-67hx-6x53-jw92","dataSource":"https://github.com/advisories/GHSA-67hx-6x53-jw92","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://nvd.nist.gov/vuln/detail/CVE-2023-45133","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://www.debian.org/security/2023/dsa-5528","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://babeljs.io/blog/2023/10/16/cve-2023-45133"],"description":"Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.23.2"],"state":"fixed","available":[{"version":"7.23.2","date":"2023-10-17","kind":"first-observed"}]},"advisories":[],"risk":0.48037500000000005},"relatedVulnerabilities":[{"id":"CVE-2023-45133","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45133","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://www.debian.org/security/2023/dsa-5528"],"description":"Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any \"polyfill provider\" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/traverse","version":"7.21.5"}},"found":{"vulnerabilityID":"GHSA-67hx-6x53-jw92","versionConstraint":"<7.23.2 (semantic)"},"fix":{"suggestedVersion":"7.23.2"}}],"artifact":{"id":"pkg:npm/%40babel/traverse@7.21.5?package-id=10be1226d3c357e3","name":"@babel/traverse","version":"7.21.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/traverse:\\@babel\\/traverse:7.21.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/traverse@7.21.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-67hx-6x53-jw92","dataSource":"https://github.com/advisories/GHSA-67hx-6x53-jw92","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://nvd.nist.gov/vuln/detail/CVE-2023-45133","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://www.debian.org/security/2023/dsa-5528","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://babeljs.io/blog/2023/10/16/cve-2023-45133"],"description":"Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.48037500000000005},"relatedVulnerabilities":[{"id":"CVE-2023-45133","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45133","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/babel/babel/commit/b13376b346946e3f62fc0848c1d2a23223314c82","https://github.com/babel/babel/pull/16033","https://github.com/babel/babel/releases/tag/v7.23.2","https://github.com/babel/babel/releases/tag/v8.0.0-alpha.4","https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92","https://lists.debian.org/debian-lts-announce/2023/10/msg00026.html","https://www.debian.org/security/2023/dsa-5528"],"description":"Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any \"polyfill provider\" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.3,"exploitabilityScore":2.6,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45133","epss":0.00525,"percentile":0.44511,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-45133","cwe":"CWE-184","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-45133","cwe":"CWE-697","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"babel-traverse","version":"6.26.0"}},"found":{"vulnerabilityID":"GHSA-67hx-6x53-jw92","versionConstraint":"<7.23.2 (semantic)"}}],"artifact":{"id":"pkg:npm/babel-traverse@6.26.0?package-id=0674579b9bacd736","name":"babel-traverse","version":"6.26.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:babel-traverse:babel-traverse:6.26.0:*:*:*:*:*:*:*","cpe:2.3:a:babel-traverse:babel_traverse:6.26.0:*:*:*:*:*:*:*","cpe:2.3:a:babel_traverse:babel-traverse:6.26.0:*:*:*:*:*:*:*","cpe:2.3:a:babel_traverse:babel_traverse:6.26.0:*:*:*:*:*:*:*","cpe:2.3:a:babel:babel-traverse:6.26.0:*:*:*:*:*:*:*","cpe:2.3:a:babel:babel_traverse:6.26.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/babel-traverse@6.26.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-965w-775f-mr7g","dataSource":"https://github.com/advisories/GHSA-965w-775f-mr7g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g","https://nvd.nist.gov/vuln/detail/CVE-2026-83615","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d","https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12"],"description":"xmldom: Quadratic-memory consumption","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83615","epss":0.0059,"percentile":0.48218,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83615","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.47789999999999994},"relatedVulnerabilities":[{"id":"CVE-2026-83615","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83615","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d","https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12","https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses _copy to clone the complete currentNSMap for each nested element that declares a new namespace prefix. Keeping every ancestor map live on the parse stack creates quadratic peak namespace-map storage, so a small highly compressible XML document can exhaust the process heap before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83615","epss":0.0059,"percentile":0.48218,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83615","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-965w-775f-mr7g","versionConstraint":">=0.1.5,<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-01-29","kind":"first-observed"}]},"advisories":[],"risk":0.47728},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-24842","https://bugzilla.redhat.com/show_bug.cgi?id=2433645","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-01-29","kind":"first-observed"}]},"advisories":[],"risk":0.47728},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-24842","https://bugzilla.redhat.com/show_bug.cgi?id=2433645","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-01-29","kind":"first-observed"}]},"advisories":[],"risk":0.47728},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-24842","https://bugzilla.redhat.com/show_bug.cgi?id=2433645","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24842.json"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00608,"percentile":0.49105,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-2m8v-j782-fhvr","dataSource":"https://github.com/advisories/GHSA-2m8v-j782-fhvr","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr","https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4","https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240","https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291"],"description":"Socket.IO: Zero-attachment Memory Exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69185","epss":0.0063,"percentile":0.50188,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69185","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69185","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.3.6"],"state":"fixed","available":[{"version":"3.3.6","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.47250000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-69185","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69185","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4","https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240","https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291","https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr"],"description":"Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69185","epss":0.0063,"percentile":0.50188,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69185","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69185","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io-parser","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-2m8v-j782-fhvr","versionConstraint":"<3.3.6 (semantic)"},"fix":{"suggestedVersion":"3.3.6"}}],"artifact":{"id":"pkg:npm/socket.io-parser@3.3.3?package-id=2a8c8163abf9a442","name":"socket.io-parser","version":"3.3.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:socket:socket.io-parser:3.3.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io-parser@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-2m8v-j782-fhvr","dataSource":"https://github.com/advisories/GHSA-2m8v-j782-fhvr","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr","https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4","https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240","https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291"],"description":"Socket.IO: Zero-attachment Memory Exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69185","epss":0.0063,"percentile":0.50188,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69185","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69185","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.4.5"],"state":"fixed","available":[{"version":"3.4.5","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.47250000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-69185","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69185","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4","https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240","https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291","https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr"],"description":"Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69185","epss":0.0063,"percentile":0.50188,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69185","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69185","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io-parser","version":"3.4.3"}},"found":{"vulnerabilityID":"GHSA-2m8v-j782-fhvr","versionConstraint":">=3.4.0,<3.4.5 (semantic)"},"fix":{"suggestedVersion":"3.4.5"}}],"artifact":{"id":"pkg:npm/socket.io-parser@3.4.3?package-id=5df0bbcfa7b7404c","name":"socket.io-parser","version":"3.4.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:socket:socket.io-parser:3.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io-parser@3.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-9cx6-37pm-9jff","dataSource":"https://github.com/advisories/GHSA-9cx6-37pm-9jff","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33939"],"description":"Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33939","epss":0.00627,"percentile":0.50068,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33939","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33939","cwe":"CWE-248","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.47025},"relatedVulnerabilities":[{"id":"CVE-2026-33939","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33939","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33939","https://bugzilla.redhat.com/show_bug.cgi?id=2452508","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33939.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, \"n\")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service. Version 4.7.9 fixes the issue. Some workarounds are available. Wrap compilation and rendering in `try/catch`. Validate template input before passing it to `compile()`; reject templates containing  decorator syntax (`{{*...}}`) if decorators are not used in your application. Use the pre-compilation workflow; compile templates at build time and serve only pre-compiled  templates; do not call `compile()` at request time.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33939","epss":0.00627,"percentile":0.50068,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33939","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33939","cwe":"CWE-248","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.7"}},"found":{"vulnerabilityID":"GHSA-9cx6-37pm-9jff","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.7?package-id=94a6b0a915fbcc9f","name":"handlebars","version":"4.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.7:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"0.3.0"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@0.3.0?package-id=b5eda2de6c0adccc","name":"minimatch","version":"0.3.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:0.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@0.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=c0db5736107463f9","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=6c204b89569ec56b","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=70a0bfe47d5139e6","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.46736999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00577,"percentile":0.47578,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=ad726dd19b0b9889","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-f6ww-3ggp-fr8h","dataSource":"https://github.com/advisories/GHSA-f6ww-3ggp-fr8h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h","https://github.com/xmldom/xmldom/commit/372008f9ae0e20fd69f761c7b79e202598267314","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10","https://nvd.nist.gov/vuln/detail/CVE-2026-41674"],"description":"xmldom has XML injection through unvalidated DocumentType serialization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41674","epss":0.00565,"percentile":0.46968,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41674","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41674","cwe":"CWE-91","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.4576499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41674","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41674","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/xmldom/xmldom/commit/372008f9ae0e20fd69f761c7b79e202598267314","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10","https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h","https://access.redhat.com/errata/RHSA-2026:20034","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21703","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/security/cve/CVE-2026-41674","https://bugzilla.redhat.com/show_bug.cgi?id=2467620","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41674.json"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41674","epss":0.00565,"percentile":0.46968,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41674","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41674","cwe":"CWE-91","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-f6ww-3ggp-fr8h","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-6g55-p6wh-862q","dataSource":"https://github.com/advisories/GHSA-6g55-p6wh-862q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad","https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3","https://github.com/postcss/postcss/releases/tag/8.5.12"],"description":"PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["8.5.12"],"state":"fixed","available":[{"version":"8.5.12","date":"2026-07-23","kind":"first-observed"}]},"advisories":[],"risk":0.45599999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-45623","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45623","epss":0.00608,"percentile":0.4909,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45623","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-45623","cwe":"CWE-200","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"5.2.18"}},"found":{"vulnerabilityID":"GHSA-6g55-p6wh-862q","versionConstraint":"<=8.5.11 (semantic)"},"fix":{"suggestedVersion":"8.5.12"}}],"artifact":{"id":"pkg:npm/postcss@5.2.18?package-id=a2216b0d3db52a78","name":"postcss","version":"5.2.18","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:postcss:postcss:5.2.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@5.2.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-r7fv-28h4-cvq7","dataSource":"https://github.com/advisories/GHSA-r7fv-28h4-cvq7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7","https://nvd.nist.gov/vuln/detail/CVE-2026-111759","https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2"],"description":"markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111759","epss":0.00591,"percentile":0.48256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111759","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.3.2"],"state":"fixed","available":[{"version":"14.3.2","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.4432500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-111759","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111759","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670","https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152","https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162","https://github.com/markdown-it/markdown-it/releases/tag/14.3.2","https://github.com/markdown-it/markdown-it/releases/tag/15.0.2","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7"],"description":"markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111759","epss":0.00591,"percentile":0.48256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111759","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111759","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"8.4.2"}},"found":{"vulnerabilityID":"GHSA-r7fv-28h4-cvq7","versionConstraint":"<14.3.2 (semantic)"},"fix":{"suggestedVersion":"14.3.2"}}],"artifact":{"id":"pkg:npm/markdown-it@8.4.2?package-id=26992563bba8d2e3","name":"markdown-it","version":"8.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:8.4.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@8.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-jchw-25xp-jwwc","dataSource":"https://github.com/advisories/GHSA-jchw-25xp-jwwc","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-26159","https://github.com/follow-redirects/follow-redirects/issues/235","https://github.com/follow-redirects/follow-redirects/pull/236","https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137","https://github.com/follow-redirects/follow-redirects/commit/7a6567e16dfa9ad18a70bfe91784c28653fbf19d","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM","https://security.netapp.com/advisory/ntap-20241108-0002"],"description":"Follow Redirects improperly handles URLs in the url.parse() function","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26159","epss":0.00797,"percentile":0.56507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26159","cwe":"CWE-20","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26159","cwe":"CWE-601","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-26159","cwe":"CWE-601","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["1.15.4"],"state":"fixed","available":[{"version":"1.15.4","date":"2024-01-09","kind":"first-observed"}]},"advisories":[],"risk":0.4423349999999999},"relatedVulnerabilities":[{"id":"CVE-2023-26159","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-26159","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/follow-redirects/follow-redirects/issues/235","https://github.com/follow-redirects/follow-redirects/pull/236","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM/","https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137","https://security.netapp.com/advisory/ntap-20241108-0002/"],"description":"Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-26159","epss":0.00797,"percentile":0.56507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-26159","cwe":"CWE-20","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2023-26159","cwe":"CWE-601","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2023-26159","cwe":"CWE-601","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.15.2"}},"found":{"vulnerabilityID":"GHSA-jchw-25xp-jwwc","versionConstraint":"<1.15.4 (semantic)"},"fix":{"suggestedVersion":"1.15.4"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.15.2?package-id=dc7623ae1813c8e8","name":"follow-redirects","version":"1.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.15.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.13.1"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=3.0.0,<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.13.1?package-id=d33db3c848bbbd0c","name":"js-yaml","version":"3.13.1","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.13.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=3.0.0,<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=7f4e23ed36f92339","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.6.1"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=3.0.0,<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.6.1?package-id=30d141a9595f949a","name":"js-yaml","version":"3.6.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.6.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-52cp-r559-cp3m","dataSource":"https://github.com/advisories/GHSA-52cp-r559-cp3m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0"],"description":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.43875},"relatedVulnerabilities":[{"id":"CVE-2026-59869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59869","epss":0.00585,"percentile":0.47999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59869","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.7.0"}},"found":{"vulnerabilityID":"GHSA-52cp-r559-cp3m","versionConstraint":">=3.0.0,<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.7.0?package-id=a0f85ddb9679f590","name":"js-yaml","version":"3.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rv95-896h-c2vc","dataSource":"https://github.com/advisories/GHSA-rv95-896h-c2vc","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc","https://github.com/koajs/koa/issues/1800","https://github.com/expressjs/express/pull/5539","https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd","https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94","https://expressjs.com/en/4x/api.html#res.location","https://nvd.nist.gov/vuln/detail/CVE-2024-29041"],"description":"Express.js Open Redirect in malformed URLs","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29041","epss":0.00786,"percentile":0.56127,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-29041","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-29041","cwe":"CWE-1286","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.19.2"],"state":"fixed","available":[{"version":"4.19.2","date":"2024-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.43622999999999995},"relatedVulnerabilities":[{"id":"CVE-2024-29041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29041","namespace":"nvd:cpe","severity":"Medium","urls":["https://expressjs.com/en/4x/api.html#res.location","https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd","https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94","https://github.com/expressjs/express/pull/5539","https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc","https://github.com/koajs/koa/issues/1800"],"description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29041","epss":0.00786,"percentile":0.56127,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-29041","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-29041","cwe":"CWE-1286","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"express","version":"4.17.0"}},"found":{"vulnerabilityID":"GHSA-rv95-896h-c2vc","versionConstraint":"<4.19.2 (semantic)"},"fix":{"suggestedVersion":"4.19.2"}}],"artifact":{"id":"pkg:npm/express@4.17.0?package-id=c8eeb28a79af5142","name":"express","version":"4.17.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:express:4.17.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/express@4.17.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rv95-896h-c2vc","dataSource":"https://github.com/advisories/GHSA-rv95-896h-c2vc","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc","https://github.com/koajs/koa/issues/1800","https://github.com/expressjs/express/pull/5539","https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd","https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94","https://expressjs.com/en/4x/api.html#res.location","https://nvd.nist.gov/vuln/detail/CVE-2024-29041"],"description":"Express.js Open Redirect in malformed URLs","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29041","epss":0.00786,"percentile":0.56127,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-29041","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-29041","cwe":"CWE-1286","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.19.2"],"state":"fixed","available":[{"version":"4.19.2","date":"2024-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.43622999999999995},"relatedVulnerabilities":[{"id":"CVE-2024-29041","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29041","namespace":"nvd:cpe","severity":"Medium","urls":["https://expressjs.com/en/4x/api.html#res.location","https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd","https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94","https://github.com/expressjs/express/pull/5539","https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc","https://github.com/koajs/koa/issues/1800"],"description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29041","epss":0.00786,"percentile":0.56127,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-29041","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-29041","cwe":"CWE-1286","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"express","version":"4.18.2"}},"found":{"vulnerabilityID":"GHSA-rv95-896h-c2vc","versionConstraint":"<4.19.2 (semantic)"},"fix":{"suggestedVersion":"4.19.2"}}],"artifact":{"id":"pkg:npm/express@4.18.2?package-id=0e91afbebe92fb67","name":"express","version":"4.18.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:express:4.18.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/express@4.18.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"0.3.0"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@0.3.0?package-id=b5eda2de6c0adccc","name":"minimatch","version":"0.3.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:0.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@0.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=6c204b89569ec56b","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=70a0bfe47d5139e6","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=c0db5736107463f9","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.432},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00576,"percentile":0.47498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=ad726dd19b0b9889","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-677m-j7p3-52f9","dataSource":"https://github.com/advisories/GHSA-677m-j7p3-52f9","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9","https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4","https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faaf","https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78","https://nvd.nist.gov/vuln/detail/CVE-2026-33151"],"description":"socket.io allows an unbounded number of binary attachments","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33151","epss":0.00523,"percentile":0.44392,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33151","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33151","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.3.5"],"state":"fixed","available":[{"version":"3.3.5","date":"2026-03-19","kind":"first-observed"}]},"advisories":[],"risk":0.42363},"relatedVulnerabilities":[{"id":"CVE-2026-33151","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33151","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4","https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faaf","https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78","https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9"],"description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33151","epss":0.00523,"percentile":0.44392,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33151","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33151","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io-parser","version":"3.3.3"}},"found":{"vulnerabilityID":"GHSA-677m-j7p3-52f9","versionConstraint":"<3.3.5 (semantic)"},"fix":{"suggestedVersion":"3.3.5"}}],"artifact":{"id":"pkg:npm/socket.io-parser@3.3.3?package-id=2a8c8163abf9a442","name":"socket.io-parser","version":"3.3.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:socket:socket.io-parser:3.3.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io-parser@3.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-677m-j7p3-52f9","dataSource":"https://github.com/advisories/GHSA-677m-j7p3-52f9","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9","https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4","https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faaf","https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78","https://nvd.nist.gov/vuln/detail/CVE-2026-33151"],"description":"socket.io allows an unbounded number of binary attachments","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33151","epss":0.00523,"percentile":0.44392,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33151","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33151","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.4.4"],"state":"fixed","available":[{"version":"3.4.4","date":"2026-03-19","kind":"first-observed"}]},"advisories":[],"risk":0.42363},"relatedVulnerabilities":[{"id":"CVE-2026-33151","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33151","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io/commit/719f9ebab0772ffb882bd614b387e585c1aa75d4","https://github.com/socketio/socket.io/commit/9d39f1f080510f036782f2177fac701cc041faaf","https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78","https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9"],"description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33151","epss":0.00523,"percentile":0.44392,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33151","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33151","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io-parser","version":"3.4.3"}},"found":{"vulnerabilityID":"GHSA-677m-j7p3-52f9","versionConstraint":">=3.4.0,<3.4.4 (semantic)"},"fix":{"suggestedVersion":"3.4.4"}}],"artifact":{"id":"pkg:npm/socket.io-parser@3.4.3?package-id=5df0bbcfa7b7404c","name":"socket.io-parser","version":"3.4.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:socket:socket.io-parser:3.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io-parser@3.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-jmr9-qjv8-65gv","dataSource":"https://github.com/advisories/GHSA-jmr9-qjv8-65gv","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf","https://nvd.nist.gov/vuln/detail/CVE-2026-56876","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json","https://www.cve.org/CVERecord?id=CVE-2026-56876"],"description":"extract-zip unvalidated symlink path traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56876","epss":0.00526,"percentile":0.44573,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56876","cwe":"CWE-22","source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"},{"cve":"CVE-2026-56876","cwe":"CWE-61","source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.416855},"relatedVulnerabilities":[{"id":"CVE-2026-56876","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56876","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json","https://www.cve.org/CVERecord?id=CVE-2026-56876"],"description":"extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.","cvss":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"vendorMetadata":{}},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56876","epss":0.00526,"percentile":0.44573,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56876","cwe":"CWE-22","source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"},{"cve":"CVE-2026-56876","cwe":"CWE-61","source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"extract-zip","version":"1.7.0"}},"found":{"vulnerabilityID":"GHSA-jmr9-qjv8-65gv","versionConstraint":"<=2.0.1 (semantic)"}}],"artifact":{"id":"pkg:npm/extract-zip@1.7.0?package-id=55927e7059f30d33","name":"extract-zip","version":"1.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:max-mapper:extract-zip:1.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/extract-zip@1.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.2"],"state":"fixed","available":[{"version":"3.15.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.13.1"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=3.0.0,<3.15.2 (semantic)"},"fix":{"suggestedVersion":"3.15.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.13.1?package-id=d33db3c848bbbd0c","name":"js-yaml","version":"3.13.1","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.13.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.2"],"state":"fixed","available":[{"version":"3.15.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=3.0.0,<3.15.2 (semantic)"},"fix":{"suggestedVersion":"3.15.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=7f4e23ed36f92339","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.2"],"state":"fixed","available":[{"version":"3.15.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.6.1"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=3.0.0,<3.15.2 (semantic)"},"fix":{"suggestedVersion":"3.15.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.6.1?package-id=30d141a9595f949a","name":"js-yaml","version":"3.6.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.6.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.2"],"state":"fixed","available":[{"version":"3.15.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.7.0"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=3.0.0,<3.15.2 (semantic)"},"fix":{"suggestedVersion":"3.15.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.7.0?package-id=a0f85ddb9679f590","name":"js-yaml","version":"3.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p8p7-x288-28g6","dataSource":"https://github.com/advisories/GHSA-p8p7-x288-28g6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-28155","https://github.com/request/request/issues/3442","https://github.com/request/request/pull/3444","https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf","https://github.com/github/advisory-database/pull/2500","https://github.com/cypress-io/request/blob/master/lib/redirect.js#L116","https://github.com/request/request/blob/master/lib/redirect.js#L111","https://github.com/cypress-io/request/pull/28","https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f","https://github.com/cypress-io/request/releases/tag/v3.0.0","https://security.netapp.com/advisory/ntap-20230413-0007"],"description":"Server-Side Request Forgery in Request","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-28155","epss":0.00719,"percentile":0.53916,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-28155","cwe":"CWE-918","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.399045},"relatedVulnerabilities":[{"id":"CVE-2023-28155","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-28155","namespace":"nvd:cpe","severity":"Medium","urls":["https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf","https://github.com/request/request/issues/3442","https://github.com/request/request/pull/3444","https://security.netapp.com/advisory/ntap-20230413-0007/"],"description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-28155","epss":0.00719,"percentile":0.53916,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-28155","cwe":"CWE-918","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"request","version":"2.81.0"}},"found":{"vulnerabilityID":"GHSA-p8p7-x288-28g6","versionConstraint":"<=2.88.2 (semantic)"}}],"artifact":{"id":"pkg:npm/request@2.81.0?package-id=14b287d394af244f","name":"request","version":"2.81.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:request_project:request:2.81.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/request@2.81.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p8p7-x288-28g6","dataSource":"https://github.com/advisories/GHSA-p8p7-x288-28g6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-28155","https://github.com/request/request/issues/3442","https://github.com/request/request/pull/3444","https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf","https://github.com/github/advisory-database/pull/2500","https://github.com/cypress-io/request/blob/master/lib/redirect.js#L116","https://github.com/request/request/blob/master/lib/redirect.js#L111","https://github.com/cypress-io/request/pull/28","https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f","https://github.com/cypress-io/request/releases/tag/v3.0.0","https://security.netapp.com/advisory/ntap-20230413-0007"],"description":"Server-Side Request Forgery in Request","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-28155","epss":0.00719,"percentile":0.53916,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-28155","cwe":"CWE-918","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.399045},"relatedVulnerabilities":[{"id":"CVE-2023-28155","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-28155","namespace":"nvd:cpe","severity":"Medium","urls":["https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf","https://github.com/request/request/issues/3442","https://github.com/request/request/pull/3444","https://security.netapp.com/advisory/ntap-20230413-0007/"],"description":"The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-28155","epss":0.00719,"percentile":0.53916,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-28155","cwe":"CWE-918","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"request","version":"2.88.0"}},"found":{"vulnerabilityID":"GHSA-p8p7-x288-28g6","versionConstraint":"<=2.88.2 (semantic)"}}],"artifact":{"id":"pkg:npm/request@2.88.0?package-id=666e766441ef716e","name":"request","version":"2.88.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:request_project:request:2.88.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/request@2.88.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-r292-9mhp-454m","dataSource":"https://github.com/advisories/GHSA-r292-9mhp-454m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m","https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/releases/tag/v7.5.21","https://nvd.nist.gov/vuln/detail/CVE-2026-73566"],"description":"node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.21"],"state":"fixed","available":[{"version":"7.5.21","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.39825},"relatedVulnerabilities":[{"id":"CVE-2026-73566","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73566","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-r292-9mhp-454m","versionConstraint":"<=7.5.20 (semantic)"},"fix":{"suggestedVersion":"7.5.21"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-r292-9mhp-454m","dataSource":"https://github.com/advisories/GHSA-r292-9mhp-454m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m","https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/releases/tag/v7.5.21","https://nvd.nist.gov/vuln/detail/CVE-2026-73566"],"description":"node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.21"],"state":"fixed","available":[{"version":"7.5.21","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.39825},"relatedVulnerabilities":[{"id":"CVE-2026-73566","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73566","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-r292-9mhp-454m","versionConstraint":"<=7.5.20 (semantic)"},"fix":{"suggestedVersion":"7.5.21"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-r292-9mhp-454m","dataSource":"https://github.com/advisories/GHSA-r292-9mhp-454m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m","https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/releases/tag/v7.5.21","https://nvd.nist.gov/vuln/detail/CVE-2026-73566"],"description":"node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.21"],"state":"fixed","available":[{"version":"7.5.21","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.39825},"relatedVulnerabilities":[{"id":"CVE-2026-73566","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73566","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a","https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73566","epss":0.00531,"percentile":0.44907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73566","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-73566","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-r292-9mhp-454m","versionConstraint":"<=7.5.20 (semantic)"},"fix":{"suggestedVersion":"7.5.21"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-r28c-9q8g-f849","dataSource":"https://github.com/advisories/GHSA-r28c-9q8g-f849","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18"],"description":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.18"],"state":"fixed","available":[{"version":"8.5.18","date":"2026-07-24","kind":"first-observed"}]},"advisories":[],"risk":0.3975},"relatedVulnerabilities":[{"id":"CVE-2026-73646","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","https://github.com/postcss/postcss/releases/tag/8.5.18","https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-73646","epss":0.0053,"percentile":0.44819,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-73646","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"5.2.18"}},"found":{"vulnerabilityID":"GHSA-r28c-9q8g-f849","versionConstraint":"<=8.5.17 (semantic)"},"fix":{"suggestedVersion":"8.5.18"}}],"artifact":{"id":"pkg:npm/postcss@5.2.18?package-id=a2216b0d3db52a78","name":"postcss","version":"5.2.18","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:postcss:postcss:5.2.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@5.2.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-6vrv-94jv-crrg","dataSource":"https://github.com/advisories/GHSA-6vrv-94jv-crrg","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-6vrv-94jv-crrg","https://nvd.nist.gov/vuln/detail/CVE-2020-15096","https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"],"description":"Context isolation bypass via Promise in Electron","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15096","epss":0.0081,"percentile":0.56932,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-15096","cwe":"CWE-501","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-15096","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["6.1.11"],"state":"fixed","available":[{"version":"6.1.11","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":0.3968999999999999},"relatedVulnerabilities":[{"id":"CVE-2020-15096","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15096","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-6vrv-94jv-crrg","https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"],"description":"In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using \"contextIsolation\" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15096","epss":0.0081,"percentile":0.56932,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-15096","cwe":"CWE-501","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-15096","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-6vrv-94jv-crrg","versionConstraint":"<6.1.11 (semantic)"},"fix":{"suggestedVersion":"6.1.11"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"0.3.0"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@0.3.0?package-id=b5eda2de6c0adccc","name":"minimatch","version":"0.3.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:0.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@0.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=6c204b89569ec56b","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=70a0bfe47d5139e6","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=c0db5736107463f9","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.39375},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.00525,"percentile":0.4453,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=ad726dd19b0b9889","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-37ch-88jc-xwx2","dataSource":"https://github.com/advisories/GHSA-37ch-88jc-xwx2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2","https://nvd.nist.gov/vuln/detail/CVE-2026-4867","https://blakeembrey.com/posts/2024-09-web-redos","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13"],"description":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4867","epss":0.00515,"percentile":0.43912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4867","cwe":"CWE-1333","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["0.1.13"],"state":"fixed","available":[{"version":"0.1.13","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.38625},"relatedVulnerabilities":[{"id":"CVE-2026-4867","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4867","namespace":"nvd:cpe","severity":"High","urls":["https://blakeembrey.com/posts/2024-09-web-redos","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-9wv6-86v2-598j"],"description":"Impact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\nCustom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.\n\nWorkarounds:\n\nAll versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).\n\nIf paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4867","epss":0.00515,"percentile":0.43912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4867","cwe":"CWE-1333","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"0.1.7"}},"found":{"vulnerabilityID":"GHSA-37ch-88jc-xwx2","versionConstraint":"<0.1.13 (semantic)"},"fix":{"suggestedVersion":"0.1.13"}}],"artifact":{"id":"pkg:npm/path-to-regexp@0.1.7?package-id=0fed262474b0e231","name":"path-to-regexp","version":"0.1.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:0.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@0.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-37ch-88jc-xwx2","dataSource":"https://github.com/advisories/GHSA-37ch-88jc-xwx2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2","https://nvd.nist.gov/vuln/detail/CVE-2026-4867","https://blakeembrey.com/posts/2024-09-web-redos","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13"],"description":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4867","epss":0.00515,"percentile":0.43912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4867","cwe":"CWE-1333","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["0.1.13"],"state":"fixed","available":[{"version":"0.1.13","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.38625},"relatedVulnerabilities":[{"id":"CVE-2026-4867","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4867","namespace":"nvd:cpe","severity":"High","urls":["https://blakeembrey.com/posts/2024-09-web-redos","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-9wv6-86v2-598j"],"description":"Impact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\nCustom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.\n\nWorkarounds:\n\nAll versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).\n\nIf paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4867","epss":0.00515,"percentile":0.43912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4867","cwe":"CWE-1333","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"path-to-regexp","version":"0.1.7"}},"found":{"vulnerabilityID":"GHSA-37ch-88jc-xwx2","versionConstraint":"<0.1.13 (semantic)"},"fix":{"suggestedVersion":"0.1.13"}}],"artifact":{"id":"pkg:npm/path-to-regexp@0.1.7?package-id=a67dc2cc66b0e914","name":"path-to-regexp","version":"0.1.7","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:pillarjs:path-to-regexp:0.1.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/path-to-regexp@0.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-x6wf-f3px-wcqx","dataSource":"https://github.com/advisories/GHSA-x6wf-f3px-wcqx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx","https://github.com/xmldom/xmldom/commit/7207a4b0e0bcc228868075ed991665ef9f73b1c2","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10","https://nvd.nist.gov/vuln/detail/CVE-2026-41675"],"description":"xmldom has XML node injection through unvalidated processing instruction serialization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41675","epss":0.0047,"percentile":0.40707,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41675","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41675","cwe":"CWE-91","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.3807},"relatedVulnerabilities":[{"id":"CVE-2026-41675","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41675","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/xmldom/xmldom/commit/7207a4b0e0bcc228868075ed991665ef9f73b1c2","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10","https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/security/cve/CVE-2026-41675","https://bugzilla.redhat.com/show_bug.cgi?id=2467629","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41675.json"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41675","epss":0.0047,"percentile":0.40707,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41675","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41675","cwe":"CWE-91","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-x6wf-f3px-wcqx","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-9qh4-3jw8-366w","dataSource":"https://github.com/advisories/GHSA-9qh4-3jw8-366w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w","https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2","https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671","https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886","https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae","https://github.com/electron/electron/releases/tag/v41.10.6","https://github.com/electron/electron/releases/tag/v42.9.2","https://github.com/electron/electron/releases/tag/v43.4.1","https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"],"description":"Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"exploitabilityScore":1.7,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102676","epss":0.00479,"percentile":0.41349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102676","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102676","cwe":"CWE-1188","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["41.10.6"],"state":"fixed","available":[{"version":"41.10.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.37841},"relatedVulnerabilities":[{"id":"CVE-2026-102676","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102676","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2","https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671","https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886","https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae","https://github.com/electron/electron/releases/tag/v41.10.6","https://github.com/electron/electron/releases/tag/v42.9.2","https://github.com/electron/electron/releases/tag/v43.4.1","https://github.com/electron/electron/releases/tag/v44.0.0-beta.5","https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"exploitabilityScore":1.7,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102676","epss":0.00479,"percentile":0.41349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102676","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102676","cwe":"CWE-1188","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-9qh4-3jw8-366w","versionConstraint":"<41.10.6 (semantic)"},"fix":{"suggestedVersion":"41.10.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-j759-j44w-7fr8","dataSource":"https://github.com/advisories/GHSA-j759-j44w-7fr8","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8","https://github.com/xmldom/xmldom/pull/987","https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7","https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10","https://nvd.nist.gov/vuln/detail/CVE-2026-41672"],"description":"xmldom has XML node injection through unvalidated comment serialization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41672","epss":0.00457,"percentile":0.39655,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41672","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41672","cwe":"CWE-91","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.37017},"relatedVulnerabilities":[{"id":"CVE-2026-41672","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41672","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7","https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1","https://github.com/xmldom/xmldom/pull/987","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10","https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/security/cve/CVE-2026-41672","https://bugzilla.redhat.com/show_bug.cgi?id=2467631","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41672.json"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41672","epss":0.00457,"percentile":0.39655,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41672","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41672","cwe":"CWE-91","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-j759-j44w-7fr8","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-6h8r-xr42-gp59","dataSource":"https://github.com/advisories/GHSA-6h8r-xr42-gp59","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59","https://nvd.nist.gov/vuln/detail/CVE-2026-83611","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/commit/4430189660b0d380ee9c9ee7550a1358688e8828","https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12"],"description":"xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83611","epss":0.00619,"percentile":0.49688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83611","cwe":"CWE-1286","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.368305},"relatedVulnerabilities":[{"id":"CVE-2026-83611","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83611","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/xmldom/xmldom/commit/4430189660b0d380ee9c9ee7550a1358688e8828","https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12","https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83611","epss":0.00619,"percentile":0.49688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83611","cwe":"CWE-1286","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-6h8r-xr42-gp59","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=374d713d4d50aa6f","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2371e2ddff0f5bc0","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=7059a7b443401e23","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2b36477cae56122e","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-wh4c-j3r5-mjhp","dataSource":"https://github.com/advisories/GHSA-wh4c-j3r5-mjhp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp","https://github.com/xmldom/xmldom/commit/2b852e836ab86dbbd6cbaf0537f584dd0b5ac184","https://github.com/xmldom/xmldom/releases/tag/0.8.12","https://github.com/xmldom/xmldom/releases/tag/0.9.9","https://nvd.nist.gov/vuln/detail/CVE-2026-34601"],"description":"xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34601","epss":0.0049,"percentile":0.42164,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34601","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34601","cwe":"CWE-91","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.3675},"relatedVulnerabilities":[{"id":"CVE-2026-34601","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34601","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/xmldom/xmldom/commit/2b852e836ab86dbbd6cbaf0537f584dd0b5ac184","https://github.com/xmldom/xmldom/releases/tag/0.8.12","https://github.com/xmldom/xmldom/releases/tag/0.9.9","https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp","https://access.redhat.com/security/cve/CVE-2026-34601","https://bugzilla.redhat.com/show_bug.cgi?id=2454595","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34601.json"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34601","epss":0.0049,"percentile":0.42164,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34601","cwe":"CWE-91","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34601","cwe":"CWE-91","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-wh4c-j3r5-mjhp","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-qffp-2rhf-9h96","dataSource":"https://github.com/advisories/GHSA-qffp-2rhf-9h96","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://nvd.nist.gov/vuln/detail/CVE-2026-29786"],"description":"tar has Hardlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.10"],"state":"fixed","available":[{"version":"7.5.10","date":"2026-03-05","kind":"first-observed"}]},"advisories":[],"risk":0.36580999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-29786","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-29786","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://access.redhat.com/security/cve/CVE-2026-29786","https://bugzilla.redhat.com/show_bug.cgi?id=2445476","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29786.json"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.3,"exploitabilityScore":1.9,"impactScore":4},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-qffp-2rhf-9h96","versionConstraint":"<=7.5.9 (semantic)"},"fix":{"suggestedVersion":"7.5.10"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-qffp-2rhf-9h96","dataSource":"https://github.com/advisories/GHSA-qffp-2rhf-9h96","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://nvd.nist.gov/vuln/detail/CVE-2026-29786"],"description":"tar has Hardlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.10"],"state":"fixed","available":[{"version":"7.5.10","date":"2026-03-05","kind":"first-observed"}]},"advisories":[],"risk":0.36580999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-29786","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-29786","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://access.redhat.com/security/cve/CVE-2026-29786","https://bugzilla.redhat.com/show_bug.cgi?id=2445476","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29786.json"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.3,"exploitabilityScore":1.9,"impactScore":4},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-qffp-2rhf-9h96","versionConstraint":"<=7.5.9 (semantic)"},"fix":{"suggestedVersion":"7.5.10"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-qffp-2rhf-9h96","dataSource":"https://github.com/advisories/GHSA-qffp-2rhf-9h96","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://nvd.nist.gov/vuln/detail/CVE-2026-29786"],"description":"tar has Hardlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.10"],"state":"fixed","available":[{"version":"7.5.10","date":"2026-03-05","kind":"first-observed"}]},"advisories":[],"risk":0.36580999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-29786","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-29786","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f","https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96","https://access.redhat.com/security/cve/CVE-2026-29786","https://bugzilla.redhat.com/show_bug.cgi?id=2445476","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29786.json"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.3,"exploitabilityScore":1.9,"impactScore":4},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29786","epss":0.00466,"percentile":0.40354,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-29786","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-qffp-2rhf-9h96","versionConstraint":"<=7.5.9 (semantic)"},"fix":{"suggestedVersion":"7.5.10"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-vc2v-76pw-4v95","dataSource":"https://github.com/advisories/GHSA-vc2v-76pw-4v95","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95","https://nvd.nist.gov/vuln/detail/CVE-2026-87776","https://github.com/expressjs/compression/commit/151f63e91e1b64f8fb0b064e19321a4f28db6bff","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/compression/releases/tag/v1.8.2"],"description":"compression vulnerable to Denial of Service via memory leak on premature response close","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87776","epss":0.00477,"percentile":0.41243,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87776","cwe":"CWE-401","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87776","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.8.2"],"state":"fixed","available":[{"version":"1.8.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.35775},"relatedVulnerabilities":[{"id":"CVE-2026-87776","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87776","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95"],"description":"compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87776","epss":0.00477,"percentile":0.41243,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87776","cwe":"CWE-401","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-87776","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"compression","version":"1.7.4"}},"found":{"vulnerabilityID":"GHSA-vc2v-76pw-4v95","versionConstraint":"<1.8.2 (semantic)"},"fix":{"suggestedVersion":"1.8.2"}}],"artifact":{"id":"pkg:npm/compression@1.7.4?package-id=b3f39068b24e8e68","name":"compression","version":"1.7.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:compression:compression:1.7.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/compression@1.7.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-7pqw-9j4j-h8q3","dataSource":"https://github.com/advisories/GHSA-7pqw-9j4j-h8q3","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-19693","https://github.com/max-mapper/extract-zip","https://www.npmjs.com/package/extract-zip","https://github.com/max-mapper/extract-zip/pull/160"],"description":"extract-zip allows arbitrary file writes through symlink archive entries","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19693","epss":0.00453,"percentile":0.39345,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19693","cwe":"CWE-22","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-19693","cwe":"CWE-59","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.35334000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-19693","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19693","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/max-mapper/extract-zip","https://www.npmjs.com/package/extract-zip"],"description":"extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-19693","epss":0.00453,"percentile":0.39345,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-19693","cwe":"CWE-22","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-19693","cwe":"CWE-59","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"extract-zip","version":"1.7.0"}},"found":{"vulnerabilityID":"GHSA-7pqw-9j4j-h8q3","versionConstraint":"<=2.0.1 (semantic)"}}],"artifact":{"id":"pkg:npm/extract-zip@1.7.0?package-id=55927e7059f30d33","name":"extract-zip","version":"1.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:max-mapper:extract-zip:1.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/extract-zip@1.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-532v-xpq5-8h95","dataSource":"https://github.com/advisories/GHSA-532v-xpq5-8h95","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95","https://nvd.nist.gov/vuln/detail/CVE-2026-34774"],"description":"Electron: Use-after-free in offscreen child window paint callback","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34774","epss":0.00452,"percentile":0.39301,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34774","cwe":"CWE-416","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34774","cwe":"CWE-825","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["39.8.1"],"state":"fixed","available":[{"version":"39.8.1","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.35256},"relatedVulnerabilities":[{"id":"CVE-2026-34774","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34774","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95","https://access.redhat.com/security/cve/CVE-2026-34774","https://bugzilla.redhat.com/show_bug.cgi?id=2455026","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34774.json"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34774","epss":0.00452,"percentile":0.39301,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34774","cwe":"CWE-416","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34774","cwe":"CWE-825","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-532v-xpq5-8h95","versionConstraint":"<39.8.1 (semantic)"},"fix":{"suggestedVersion":"39.8.1"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-v245-v573-v5vm","dataSource":"https://github.com/advisories/GHSA-v245-v573-v5vm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm","https://nvd.nist.gov/vuln/detail/CVE-2026-59887","https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe","https://github.com/markdown-it/linkify-it/releases/tag/5.0.2"],"description":"linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59887","epss":0.00467,"percentile":0.40435,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59887","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.2"],"state":"fixed","available":[{"version":"5.0.2","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.35024999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-59887","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59887","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/linkify-it/commit/105e5d77f7d119871d2b2d86ed208568eb3e7ffe","https://github.com/markdown-it/linkify-it/releases/tag/5.0.2","https://github.com/markdown-it/linkify-it/security/advisories/GHSA-v245-v573-v5vm"],"description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59887","epss":0.00467,"percentile":0.40435,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59887","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"linkify-it","version":"2.2.0"}},"found":{"vulnerabilityID":"GHSA-v245-v573-v5vm","versionConstraint":"<=5.0.1 (semantic)"},"fix":{"suggestedVersion":"5.0.2"}}],"artifact":{"id":"pkg:npm/linkify-it@2.2.0?package-id=f5f6b0534e4fd4e8","name":"linkify-it","version":"2.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:linkify-it:linkify-it:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify-it:linkify_it:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify-it:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify_it:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify-it:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify_it:2.2.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/linkify-it@2.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xv26-6w52-cph6","dataSource":"https://github.com/advisories/GHSA-xv26-6w52-cph6","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/faye/websocket-driver-node/security/advisories/GHSA-xv26-6w52-cph6","https://github.com/faye/websocket-driver-node/releases/tag/0.7.5"],"description":"websocket-driver: Message corruption via abuse of protocol length headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54466","epss":0.0038,"percentile":0.32008,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54466","cwe":"CWE-130","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.5"],"state":"fixed","available":[{"version":"0.7.5","date":"2026-07-16","kind":"first-observed"}]},"advisories":[],"risk":0.3458},"relatedVulnerabilities":[{"id":"CVE-2026-54466","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54466","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/faye/websocket-driver-node/commit/5b197ca874dab58e96cacad8a3c256797d804680","https://github.com/faye/websocket-driver-node/security/advisories/GHSA-xv26-6w52-cph6"],"description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54466","epss":0.0038,"percentile":0.32008,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54466","cwe":"CWE-130","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"websocket-driver","version":"0.7.4"}},"found":{"vulnerabilityID":"GHSA-xv26-6w52-cph6","versionConstraint":"<0.7.5 (semantic)"},"fix":{"suggestedVersion":"0.7.5"}}],"artifact":{"id":"pkg:npm/websocket-driver@0.7.4?package-id=605352b7609c207f","name":"websocket-driver","version":"0.7.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:websocket-driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket-driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket_driver:0.7.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/websocket-driver@0.7.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2b36477cae56122e","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=374d713d4d50aa6f","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2371e2ddff0f5bc0","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=7059a7b443401e23","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-8x88-c5mf-7j5w","dataSource":"https://github.com/advisories/GHSA-8x88-c5mf-7j5w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","https://nvd.nist.gov/vuln/detail/CVE-2026-59874","https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Negative tar entry size causes infinite loop in archive replace","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33852},"relatedVulnerabilities":[{"id":"CVE-2026-59874","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-8x88-c5mf-7j5w","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8x88-c5mf-7j5w","dataSource":"https://github.com/advisories/GHSA-8x88-c5mf-7j5w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","https://nvd.nist.gov/vuln/detail/CVE-2026-59874","https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Negative tar entry size causes infinite loop in archive replace","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33852},"relatedVulnerabilities":[{"id":"CVE-2026-59874","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-8x88-c5mf-7j5w","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-8x88-c5mf-7j5w","dataSource":"https://github.com/advisories/GHSA-8x88-c5mf-7j5w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w","https://nvd.nist.gov/vuln/detail/CVE-2026-59874","https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Negative tar entry size causes infinite loop in archive replace","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33852},"relatedVulnerabilities":[{"id":"CVE-2026-59874","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59874","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59874","epss":0.00434,"percentile":0.37694,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59874","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-8x88-c5mf-7j5w","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-6gmq-8vp8-gcm6","dataSource":"https://github.com/advisories/GHSA-6gmq-8vp8-gcm6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6","https://nvd.nist.gov/vuln/detail/CVE-2026-83610","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b","https://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12"],"description":"xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83610","epss":0.0059,"percentile":0.48218,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83610","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.33335},"relatedVulnerabilities":[{"id":"CVE-2026-83610","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83610","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b","https://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0","https://github.com/xmldom/xmldom/pull/1071","https://github.com/xmldom/xmldom/pull/1072","https://github.com/xmldom/xmldom/releases/tag/0.8.15","https://github.com/xmldom/xmldom/releases/tag/0.9.12","https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6"],"description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITY_REFERENCE_NODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-83610","epss":0.0059,"percentile":0.48218,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-83610","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"xmldom","version":"0.1.27"}},"found":{"vulnerabilityID":"GHSA-6gmq-8vp8-gcm6","versionConstraint":"<=0.6.0 (semantic)"}}],"artifact":{"id":"pkg:npm/xmldom@0.1.27?package-id=f73e53d57600c23e","name":"xmldom","version":"0.1.27","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:xmldom_project:xmldom:0.1.27:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/xmldom@0.1.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-w8wr-v893-vjvp","dataSource":"https://github.com/advisories/GHSA-w8wr-v893-vjvp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp","https://nvd.nist.gov/vuln/detail/CVE-2026-59871","https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Process crash via PAX numeric path type confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33166},"relatedVulnerabilities":[{"id":"CVE-2026-59871","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-w8wr-v893-vjvp","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-w8wr-v893-vjvp","dataSource":"https://github.com/advisories/GHSA-w8wr-v893-vjvp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp","https://nvd.nist.gov/vuln/detail/CVE-2026-59871","https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Process crash via PAX numeric path type confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33166},"relatedVulnerabilities":[{"id":"CVE-2026-59871","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-w8wr-v893-vjvp","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-w8wr-v893-vjvp","dataSource":"https://github.com/advisories/GHSA-w8wr-v893-vjvp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp","https://nvd.nist.gov/vuln/detail/CVE-2026-59871","https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18"],"description":"node-tar: Process crash via PAX numeric path type confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.18"],"state":"fixed","available":[{"version":"7.5.18","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.33166},"relatedVulnerabilities":[{"id":"CVE-2026-59871","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59871","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b","https://github.com/isaacs/node-tar/releases/tag/v7.5.18","https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59871","epss":0.00644,"percentile":0.50876,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59871","cwe":"CWE-704","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-w8wr-v893-vjvp","versionConstraint":"<=7.5.17 (semantic)"},"fix":{"suggestedVersion":"7.5.18"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-ph9p-34f9-6g65","dataSource":"https://github.com/advisories/GHSA-ph9p-34f9-6g65","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429","https://nvd.nist.gov/vuln/detail/CVE-2026-44705"],"description":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.6"],"state":"fixed","available":[{"version":"0.2.6","date":"2026-05-27","kind":"first-observed"}]},"advisories":[],"risk":0.32984},"relatedVulnerabilities":[{"id":"CVE-2026-44705","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.28"}},"found":{"vulnerabilityID":"GHSA-ph9p-34f9-6g65","versionConstraint":"<0.2.6 (semantic)"},"fix":{"suggestedVersion":"0.2.6"}}],"artifact":{"id":"pkg:npm/tmp@0.0.28?package-id=3061d93fb0a89722","name":"tmp","version":"0.0.28","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.28:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.28","upstreams":[]}},{"vulnerability":{"id":"GHSA-ph9p-34f9-6g65","dataSource":"https://github.com/advisories/GHSA-ph9p-34f9-6g65","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429","https://nvd.nist.gov/vuln/detail/CVE-2026-44705"],"description":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.6"],"state":"fixed","available":[{"version":"0.2.6","date":"2026-05-27","kind":"first-observed"}]},"advisories":[],"risk":0.32984},"relatedVulnerabilities":[{"id":"CVE-2026-44705","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.28"}},"found":{"vulnerabilityID":"GHSA-ph9p-34f9-6g65","versionConstraint":"<0.2.6 (semantic)"},"fix":{"suggestedVersion":"0.2.6"}}],"artifact":{"id":"pkg:npm/tmp@0.0.28?package-id=5d96f5cb328d08ad","name":"tmp","version":"0.0.28","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.28:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.28","upstreams":[]}},{"vulnerability":{"id":"GHSA-ph9p-34f9-6g65","dataSource":"https://github.com/advisories/GHSA-ph9p-34f9-6g65","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429","https://nvd.nist.gov/vuln/detail/CVE-2026-44705"],"description":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.6"],"state":"fixed","available":[{"version":"0.2.6","date":"2026-05-27","kind":"first-observed"}]},"advisories":[],"risk":0.32984},"relatedVulnerabilities":[{"id":"CVE-2026-44705","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.28"}},"found":{"vulnerabilityID":"GHSA-ph9p-34f9-6g65","versionConstraint":"<0.2.6 (semantic)"},"fix":{"suggestedVersion":"0.2.6"}}],"artifact":{"id":"pkg:npm/tmp@0.0.28?package-id=4328daa2653b7239","name":"tmp","version":"0.0.28","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.28:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.28","upstreams":[]}},{"vulnerability":{"id":"GHSA-ph9p-34f9-6g65","dataSource":"https://github.com/advisories/GHSA-ph9p-34f9-6g65","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429","https://nvd.nist.gov/vuln/detail/CVE-2026-44705"],"description":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.6"],"state":"fixed","available":[{"version":"0.2.6","date":"2026-05-27","kind":"first-observed"}]},"advisories":[],"risk":0.32984},"relatedVulnerabilities":[{"id":"CVE-2026-44705","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.29"}},"found":{"vulnerabilityID":"GHSA-ph9p-34f9-6g65","versionConstraint":"<0.2.6 (semantic)"},"fix":{"suggestedVersion":"0.2.6"}}],"artifact":{"id":"pkg:npm/tmp@0.0.29?package-id=a7f9d23e8b5b6f84","name":"tmp","version":"0.0.29","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.29:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.29","upstreams":[]}},{"vulnerability":{"id":"GHSA-ph9p-34f9-6g65","dataSource":"https://github.com/advisories/GHSA-ph9p-34f9-6g65","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429","https://nvd.nist.gov/vuln/detail/CVE-2026-44705"],"description":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.6"],"state":"fixed","available":[{"version":"0.2.6","date":"2026-05-27","kind":"first-observed"}]},"advisories":[],"risk":0.32984},"relatedVulnerabilities":[{"id":"CVE-2026-44705","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.33"}},"found":{"vulnerabilityID":"GHSA-ph9p-34f9-6g65","versionConstraint":"<0.2.6 (semantic)"},"fix":{"suggestedVersion":"0.2.6"}}],"artifact":{"id":"pkg:npm/tmp@0.0.33?package-id=12c12abb9cda5441","name":"tmp","version":"0.0.33","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.33:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.33","upstreams":[]}},{"vulnerability":{"id":"GHSA-ph9p-34f9-6g65","dataSource":"https://github.com/advisories/GHSA-ph9p-34f9-6g65","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429","https://nvd.nist.gov/vuln/detail/CVE-2026-44705"],"description":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.6"],"state":"fixed","available":[{"version":"0.2.6","date":"2026-05-27","kind":"first-observed"}]},"advisories":[],"risk":0.32984},"relatedVulnerabilities":[{"id":"CVE-2026-44705","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.33"}},"found":{"vulnerabilityID":"GHSA-ph9p-34f9-6g65","versionConstraint":"<0.2.6 (semantic)"},"fix":{"suggestedVersion":"0.2.6"}}],"artifact":{"id":"pkg:npm/tmp@0.0.33?package-id=7d703abfb2deed2d","name":"tmp","version":"0.0.33","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.33:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.33","upstreams":[]}},{"vulnerability":{"id":"GHSA-ph9p-34f9-6g65","dataSource":"https://github.com/advisories/GHSA-ph9p-34f9-6g65","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429","https://nvd.nist.gov/vuln/detail/CVE-2026-44705"],"description":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.6"],"state":"fixed","available":[{"version":"0.2.6","date":"2026-05-27","kind":"first-observed"}]},"advisories":[],"risk":0.32984},"relatedVulnerabilities":[{"id":"CVE-2026-44705","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.33"}},"found":{"vulnerabilityID":"GHSA-ph9p-34f9-6g65","versionConstraint":"<0.2.6 (semantic)"},"fix":{"suggestedVersion":"0.2.6"}}],"artifact":{"id":"pkg:npm/tmp@0.0.33?package-id=5c0bba295effd905","name":"tmp","version":"0.0.33","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.33:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.33","upstreams":[]}},{"vulnerability":{"id":"GHSA-ph9p-34f9-6g65","dataSource":"https://github.com/advisories/GHSA-ph9p-34f9-6g65","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429","https://nvd.nist.gov/vuln/detail/CVE-2026-44705"],"description":"tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.6"],"state":"fixed","available":[{"version":"0.2.6","date":"2026-05-27","kind":"first-observed"}]},"advisories":[],"risk":0.32984},"relatedVulnerabilities":[{"id":"CVE-2026-44705","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65"],"description":"tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44705","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44705","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-ph9p-34f9-6g65","versionConstraint":"<0.2.6 (semantic)"},"fix":{"suggestedVersion":"0.2.6"}}],"artifact":{"id":"pkg:npm/tmp@0.1.0?package-id=32ed00890a1abaf4","name":"tmp","version":"0.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p7v2-p9m8-qqg7","dataSource":"https://github.com/advisories/GHSA-p7v2-p9m8-qqg7","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-p7v2-p9m8-qqg7","https://nvd.nist.gov/vuln/detail/CVE-2023-29198","https://www.electronjs.org/docs/latest/api/context-bridge#parameter--error--return-type-support"],"description":"Electron context isolation bypass via nested unserializable return value","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6,"exploitabilityScore":1.8,"impactScore":3.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-29198","epss":0.0059,"percentile":0.48215,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-29198","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-29198","cwe":"CWE-754","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["22.3.6"],"state":"fixed","available":[{"version":"22.3.6","date":"2023-09-07","kind":"first-observed"}]},"advisories":[],"risk":0.3245},"relatedVulnerabilities":[{"id":"CVE-2023-29198","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-29198","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-p7v2-p9m8-qqg7","https://www.electronjs.org/docs/latest/api/context-bridge#parameter--error--return-type-support"],"description":"Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps using `contextIsolation` and `contextBridge` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. This issue is only exploitable if an API exposed to the main world via `contextBridge` can return an object or array that contains a javascript object which cannot be serialized, for instance, a canvas rendering context. This would normally result in an exception being thrown `Error: object could not be cloned`. The app side workaround is to ensure that such a case is not possible. Ensure all values returned from a function exposed over the context bridge are supported. This issue has been fixed in versions `25.0.0-alpha.2`, `24.0.1`, `23.2.3`, and `22.3.6`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"exploitabilityScore":1.8,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6,"exploitabilityScore":1.8,"impactScore":3.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-29198","epss":0.0059,"percentile":0.48215,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-29198","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-29198","cwe":"CWE-754","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-p7v2-p9m8-qqg7","versionConstraint":"<22.3.6 (semantic)"},"fix":{"suggestedVersion":"22.3.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-6fx8-h7jm-663j","dataSource":"https://github.com/advisories/GHSA-6fx8-h7jm-663j","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-36751","https://github.com/Kikobeats/parse-uri/issues/14","https://gist.github.com/6en6ar/78168687da94e8aa2e0357f2456b0233"],"description":"parse-uri Regular expression Denial of Service (ReDoS)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-36751","epss":0.00544,"percentile":0.4569,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-36751","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.32368},"relatedVulnerabilities":[{"id":"CVE-2024-36751","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36751","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/6en6ar/78168687da94e8aa2e0357f2456b0233","https://github.com/Kikobeats/parse-uri/issues/14"],"description":"An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-36751","epss":0.00544,"percentile":0.4569,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-36751","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"parseuri","version":"0.0.6"}},"found":{"vulnerabilityID":"GHSA-6fx8-h7jm-663j","versionConstraint":"<2.0.0 (semantic)"}}],"artifact":{"id":"pkg:npm/parseuri@0.0.6?package-id=0a9c16e8a14bf53e","name":"parseuri","version":"0.0.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:parseuri:parseuri:0.0.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/parseuri@0.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-p2jh-44qj-pf2v","dataSource":"https://github.com/advisories/GHSA-p2jh-44qj-pf2v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-p2jh-44qj-pf2v","https://nvd.nist.gov/vuln/detail/CVE-2022-36077"],"description":"Exfiltration of hashed SMB credentials on Windows via file:// redirect","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-36077","epss":0.0062,"percentile":0.49704,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-36077","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-36077","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-36077","cwe":"CWE-522","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["18.3.7"],"state":"fixed","available":[{"version":"18.3.7","date":"2022-11-12","kind":"first-observed"}]},"advisories":[],"risk":0.32239999999999996},"relatedVulnerabilities":[{"id":"CVE-2022-36077","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-36077","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-p2jh-44qj-pf2v"],"description":"The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":7.2,"exploitabilityScore":3.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-36077","epss":0.0062,"percentile":0.49704,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-36077","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-36077","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-36077","cwe":"CWE-522","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-p2jh-44qj-pf2v","versionConstraint":"<18.3.7 (semantic)"},"fix":{"suggestedVersion":"18.3.7"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-22p9-wv53-3rq4","dataSource":"https://github.com/advisories/GHSA-22p9-wv53-3rq4","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"],"description":"LinkifyIt#match scan loop has quadratic algorithmic complexity","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48801","epss":0.00394,"percentile":0.33576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48801","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2026-06-27","kind":"first-observed"}]},"advisories":[],"risk":0.31914},"relatedVulnerabilities":[{"id":"CVE-2026-48801","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48801","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159","https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"],"description":"linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service triggerable by a tens-of-KB request body. This issue is fixed in version 5.0.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48801","epss":0.00394,"percentile":0.33576,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48801","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"linkify-it","version":"2.2.0"}},"found":{"vulnerabilityID":"GHSA-22p9-wv53-3rq4","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/linkify-it@2.2.0?package-id=f5f6b0534e4fd4e8","name":"linkify-it","version":"2.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:linkify-it:linkify-it:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify-it:linkify_it:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify-it:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify_it:linkify_it:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify-it:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:linkify:linkify_it:2.2.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/linkify-it@2.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-9f4c-93c8-jc8g","dataSource":"https://github.com/advisories/GHSA-9f4c-93c8-jc8g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g","https://github.com/electron/electron/pull/51437","https://github.com/electron/electron/pull/51438","https://github.com/electron/electron/pull/51439","https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57","https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3","https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f","https://github.com/electron/electron/releases/tag/v39.8.10","https://github.com/electron/electron/releases/tag/v41.10.3","https://github.com/electron/electron/releases/tag/v42.0.1"],"description":"Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":3.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70608","epss":0.00431,"percentile":0.37314,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70608","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-70608","cwe":"CWE-1021","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.10"],"state":"fixed","available":[{"version":"39.8.10","date":"2026-08-06","kind":"first-observed"}]},"advisories":[],"risk":0.316785},"relatedVulnerabilities":[{"id":"CVE-2026-70608","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70608","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57","https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3","https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f","https://github.com/electron/electron/pull/51437","https://github.com/electron/electron/pull/51438","https://github.com/electron/electron/pull/51439","https://github.com/electron/electron/releases/tag/v39.8.10","https://github.com/electron/electron/releases/tag/v41.10.3","https://github.com/electron/electron/releases/tag/v42.0.1","https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in 39.8.10, 41.10.3, and 42.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":3.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70608","epss":0.00431,"percentile":0.37314,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70608","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-70608","cwe":"CWE-1021","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-9f4c-93c8-jc8g","versionConstraint":"<39.8.10 (semantic)"},"fix":{"suggestedVersion":"39.8.10"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-968p-4wvh-cqc8","dataSource":"https://github.com/advisories/GHSA-968p-4wvh-cqc8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8","https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4","https://nvd.nist.gov/vuln/detail/CVE-2025-27789"],"description":"Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.26.10"],"state":"fixed","available":[{"version":"7.26.10","date":"2025-03-12","kind":"first-observed"}]},"advisories":[],"risk":0.31528},"relatedVulnerabilities":[{"id":"CVE-2025-27789","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27789","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"],"description":"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/helpers","version":"7.12.17"}},"found":{"vulnerabilityID":"GHSA-968p-4wvh-cqc8","versionConstraint":"<7.26.10 (semantic)"},"fix":{"suggestedVersion":"7.26.10"}}],"artifact":{"id":"pkg:npm/%40babel/helpers@7.12.17?package-id=1ea2db4c9fb28236","name":"@babel/helpers","version":"7.12.17","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/helpers:\\@babel\\/helpers:7.12.17:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/helpers@7.12.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-968p-4wvh-cqc8","dataSource":"https://github.com/advisories/GHSA-968p-4wvh-cqc8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8","https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4","https://nvd.nist.gov/vuln/detail/CVE-2025-27789"],"description":"Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.26.10"],"state":"fixed","available":[{"version":"7.26.10","date":"2025-03-12","kind":"first-observed"}]},"advisories":[],"risk":0.31528},"relatedVulnerabilities":[{"id":"CVE-2025-27789","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27789","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"],"description":"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/helpers","version":"7.12.17"}},"found":{"vulnerabilityID":"GHSA-968p-4wvh-cqc8","versionConstraint":"<7.26.10 (semantic)"},"fix":{"suggestedVersion":"7.26.10"}}],"artifact":{"id":"pkg:npm/%40babel/helpers@7.12.17?package-id=32a78991074b72f5","name":"@babel/helpers","version":"7.12.17","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/helpers:\\@babel\\/helpers:7.12.17:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/helpers@7.12.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-968p-4wvh-cqc8","dataSource":"https://github.com/advisories/GHSA-968p-4wvh-cqc8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8","https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4","https://nvd.nist.gov/vuln/detail/CVE-2025-27789"],"description":"Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.26.10"],"state":"fixed","available":[{"version":"7.26.10","date":"2025-03-12","kind":"first-observed"}]},"advisories":[],"risk":0.31528},"relatedVulnerabilities":[{"id":"CVE-2025-27789","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27789","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"],"description":"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/helpers","version":"7.12.17"}},"found":{"vulnerabilityID":"GHSA-968p-4wvh-cqc8","versionConstraint":"<7.26.10 (semantic)"},"fix":{"suggestedVersion":"7.26.10"}}],"artifact":{"id":"pkg:npm/%40babel/helpers@7.12.17?package-id=4a5d7837fffea0f3","name":"@babel/helpers","version":"7.12.17","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/helpers:\\@babel\\/helpers:7.12.17:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/helpers@7.12.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-968p-4wvh-cqc8","dataSource":"https://github.com/advisories/GHSA-968p-4wvh-cqc8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8","https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4","https://nvd.nist.gov/vuln/detail/CVE-2025-27789"],"description":"Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.26.10"],"state":"fixed","available":[{"version":"7.26.10","date":"2025-03-12","kind":"first-observed"}]},"advisories":[],"risk":0.31528},"relatedVulnerabilities":[{"id":"CVE-2025-27789","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27789","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"],"description":"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/runtime","version":"7.12.18"}},"found":{"vulnerabilityID":"GHSA-968p-4wvh-cqc8","versionConstraint":"<7.26.10 (semantic)"},"fix":{"suggestedVersion":"7.26.10"}}],"artifact":{"id":"pkg:npm/%40babel/runtime@7.12.18?package-id=82d56c7e51c351c1","name":"@babel/runtime","version":"7.12.18","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/runtime:\\@babel\\/runtime:7.12.18:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/runtime@7.12.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-968p-4wvh-cqc8","dataSource":"https://github.com/advisories/GHSA-968p-4wvh-cqc8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8","https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4","https://nvd.nist.gov/vuln/detail/CVE-2025-27789"],"description":"Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.26.10"],"state":"fixed","available":[{"version":"7.26.10","date":"2025-03-12","kind":"first-observed"}]},"advisories":[],"risk":0.31528},"relatedVulnerabilities":[{"id":"CVE-2025-27789","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27789","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"],"description":"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/runtime","version":"7.12.18"}},"found":{"vulnerabilityID":"GHSA-968p-4wvh-cqc8","versionConstraint":"<7.26.10 (semantic)"},"fix":{"suggestedVersion":"7.26.10"}}],"artifact":{"id":"pkg:npm/%40babel/runtime@7.12.18?package-id=c96cfaa083405437","name":"@babel/runtime","version":"7.12.18","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/runtime:\\@babel\\/runtime:7.12.18:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/runtime@7.12.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-968p-4wvh-cqc8","dataSource":"https://github.com/advisories/GHSA-968p-4wvh-cqc8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8","https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/commit/d5952e80c0faa5ec20e35085531b6e572d31dad4","https://nvd.nist.gov/vuln/detail/CVE-2025-27789"],"description":"Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.26.10"],"state":"fixed","available":[{"version":"7.26.10","date":"2025-03-12","kind":"first-observed"}]},"advisories":[],"risk":0.31528},"relatedVulnerabilities":[{"id":"CVE-2025-27789","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27789","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/babel/babel/pull/17173","https://github.com/babel/babel/security/advisories/GHSA-968p-4wvh-cqc8"],"description":"Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, using the `.replace` method on a regular expression that contains named capturing groups, and the code using untrusted strings as the second argument of `.replace`. This problem has been fixed in `@babel/helpers` and `@babel/runtime` 7.26.10 and 8.0.0-alpha.17. It's likely that individual users do not directly depend on `@babel/helpers`, and instead depend on `@babel/core` (which itself depends on `@babel/helpers`). Upgrading to `@babel/core` 7.26.10 is not required, but it guarantees use of a new enough `@babel/helpers` version. Note that just updating Babel dependencies is not enough; one will also need to re-compile the code. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"exploitabilityScore":2.6,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27789","epss":0.00563,"percentile":0.46836,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-27789","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/runtime","version":"7.12.18"}},"found":{"vulnerabilityID":"GHSA-968p-4wvh-cqc8","versionConstraint":"<7.26.10 (semantic)"},"fix":{"suggestedVersion":"7.26.10"}}],"artifact":{"id":"pkg:npm/%40babel/runtime@7.12.18?package-id=3e9645b24425c266","name":"@babel/runtime","version":"7.12.18","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/runtime:\\@babel\\/runtime:7.12.18:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/runtime@7.12.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2c7-rcm5-vvqj","dataSource":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj","https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d","https://nvd.nist.gov/vuln/detail/CVE-2026-33671"],"description":"Picomatch has a ReDoS vulnerability via extglob quantifiers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33671","epss":0.0042,"percentile":0.36325,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33671","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.315},"relatedVulnerabilities":[{"id":"CVE-2026-33671","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33671","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d","https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj"],"description":"Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33671","epss":0.0042,"percentile":0.36325,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33671","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"picomatch","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-c2c7-rcm5-vvqj","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"pkg:npm/picomatch@2.2.2?package-id=f1013bf6f21317f2","name":"picomatch","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:picomatch:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/picomatch@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-c2c7-rcm5-vvqj","dataSource":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj","https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d","https://nvd.nist.gov/vuln/detail/CVE-2026-33671"],"description":"Picomatch has a ReDoS vulnerability via extglob quantifiers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33671","epss":0.0042,"percentile":0.36325,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33671","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.315},"relatedVulnerabilities":[{"id":"CVE-2026-33671","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33671","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d","https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj"],"description":"Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users to supply glob patterns that are passed to `picomatch` for compilation or matching. In those cases, an attacker can cause excessive CPU consumption and block the Node.js event loop, resulting in a denial of service. Applications that only use trusted, developer-controlled glob patterns are much less likely to be exposed in a security-relevant way. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to `picomatch`. Possible mitigations include disabling extglob support for untrusted patterns by using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers such as `+()` and `*()`, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, and applying application-level request throttling and input validation for any endpoint that accepts glob patterns.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33671","epss":0.0042,"percentile":0.36325,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33671","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"picomatch","version":"2.3.1"}},"found":{"vulnerabilityID":"GHSA-c2c7-rcm5-vvqj","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"pkg:npm/picomatch@2.3.1?package-id=9753bca4aa0b315b","name":"picomatch","version":"2.3.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:picomatch:2.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/picomatch@2.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-3p22-ghq8-v749","dataSource":"https://github.com/advisories/GHSA-3p22-ghq8-v749","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749","https://nvd.nist.gov/vuln/detail/CVE-2022-21718","https://github.com/electron/electron/pull/32178","https://github.com/electron/electron/pull/32240"],"description":"Renderers can obtain access to random bluetooth device without permission in Electron","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21718","epss":0.00946,"percentile":0.61116,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-21718","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-21718","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["13.6.6"],"state":"fixed","available":[{"version":"13.6.6","date":"2022-03-23","kind":"first-observed"}]},"advisories":[],"risk":0.30271999999999993},"relatedVulnerabilities":[{"id":"CVE-2022-21718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/pull/32178","https://github.com/electron/electron/pull/32240","https://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5,"exploitabilityScore":3.2,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21718","epss":0.00946,"percentile":0.61116,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-21718","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-21718","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-3p22-ghq8-v749","versionConstraint":"<13.6.6 (semantic)"},"fix":{"suggestedVersion":"13.6.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-01-17","kind":"first-observed"}]},"advisories":[],"risk":0.29516},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23745","https://bugzilla.redhat.com/show_bug.cgi?id=2430538","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-01-17","kind":"first-observed"}]},"advisories":[],"risk":0.29516},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23745","https://bugzilla.redhat.com/show_bug.cgi?id=2430538","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-01-17","kind":"first-observed"}]},"advisories":[],"risk":0.29516},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23745","https://bugzilla.redhat.com/show_bug.cgi?id=2430538","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23745.json"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00376,"percentile":0.31592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-vcc3-ghjq-m6fr","dataSource":"https://github.com/advisories/GHSA-vcc3-ghjq-m6fr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-vcc3-ghjq-m6fr","https://nvd.nist.gov/vuln/detail/CVE-2026-45822","https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005","https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.0","https://www.npmjs.com/package/decode-uri-component"],"description":"decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45822","epss":0.00507,"percentile":0.43265,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45822","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45822","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["0.5.0"],"state":"fixed","available":[{"version":"0.5.0","date":"2026-09-01","kind":"first-observed"}]},"advisories":[],"risk":0.29406},"relatedVulnerabilities":[{"id":"CVE-2026-45822","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45822","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js","https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005","https://www.npmjs.com/package/decode-uri-component"],"description":"decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45822","epss":0.00507,"percentile":0.43265,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45822","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45822","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"decode-uri-component","version":"0.2.0"}},"found":{"vulnerabilityID":"GHSA-vcc3-ghjq-m6fr","versionConstraint":"<=0.4.2 (semantic)"},"fix":{"suggestedVersion":"0.5.0"}}],"artifact":{"id":"pkg:npm/decode-uri-component@0.2.0?package-id=c628a0855d545708","name":"decode-uri-component","version":"0.2.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:decode-uri-component_project:decode-uri-component:0.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/decode-uri-component@0.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vcc3-ghjq-m6fr","dataSource":"https://github.com/advisories/GHSA-vcc3-ghjq-m6fr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-vcc3-ghjq-m6fr","https://nvd.nist.gov/vuln/detail/CVE-2026-45822","https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005","https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.0","https://www.npmjs.com/package/decode-uri-component"],"description":"decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45822","epss":0.00507,"percentile":0.43265,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45822","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45822","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["0.5.0"],"state":"fixed","available":[{"version":"0.5.0","date":"2026-09-01","kind":"first-observed"}]},"advisories":[],"risk":0.29406},"relatedVulnerabilities":[{"id":"CVE-2026-45822","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45822","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js","https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005","https://www.npmjs.com/package/decode-uri-component"],"description":"decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45822","epss":0.00507,"percentile":0.43265,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45822","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45822","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"decode-uri-component","version":"0.2.0"}},"found":{"vulnerabilityID":"GHSA-vcc3-ghjq-m6fr","versionConstraint":"<=0.4.2 (semantic)"},"fix":{"suggestedVersion":"0.5.0"}}],"artifact":{"id":"pkg:npm/decode-uri-component@0.2.0?package-id=a174fcee943e47c0","name":"decode-uri-component","version":"0.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:decode-uri-component_project:decode-uri-component:0.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/decode-uri-component@0.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-ff2p-hmqr-hxm4","dataSource":"https://github.com/advisories/GHSA-ff2p-hmqr-hxm4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4","https://github.com/electron/electron/pull/51083","https://github.com/electron/electron/pull/51084","https://github.com/electron/electron/pull/51085","https://github.com/electron/electron/pull/51086","https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713","https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd","https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55","https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737","https://github.com/electron/electron/releases/tag/v39.8.9","https://github.com/electron/electron/releases/tag/v40.9.2","https://github.com/electron/electron/releases/tag/v41.2.2","https://github.com/electron/electron/releases/tag/v42.0.0-beta.4"],"description":"Electron: contextBridge object copy honors prototype setters","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70610","epss":0.00564,"percentile":0.46858,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70610","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.9"],"state":"fixed","available":[{"version":"39.8.9","date":"2026-08-06","kind":"first-observed"}]},"advisories":[],"risk":0.29328000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-70610","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70610","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713","https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd","https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55","https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737","https://github.com/electron/electron/pull/51083","https://github.com/electron/electron/pull/51084","https://github.com/electron/electron/pull/51085","https://github.com/electron/electron/pull/51086","https://github.com/electron/electron/releases/tag/v39.8.9","https://github.com/electron/electron/releases/tag/v40.9.2","https://github.com/electron/electron/releases/tag/v41.2.2","https://github.com/electron/electron/releases/tag/v42.0.0-beta.4","https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70610","epss":0.00564,"percentile":0.46858,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70610","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-ff2p-hmqr-hxm4","versionConstraint":"<39.8.9 (semantic)"},"fix":{"suggestedVersion":"39.8.9"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-27r3-jxmh-p828","dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.9"],"state":"fixed","available":[{"version":"1.20.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29100000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-111181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.19.0"}},"found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":"<1.20.9 (semantic)"},"fix":{"suggestedVersion":"1.20.9"}}],"artifact":{"id":"pkg:npm/body-parser@1.19.0?package-id=18bd816c85cff5a3","name":"body-parser","version":"1.19.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:body-parser:1.19.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.19.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-27r3-jxmh-p828","dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.9"],"state":"fixed","available":[{"version":"1.20.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29100000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-111181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.20.1"}},"found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":"<1.20.9 (semantic)"},"fix":{"suggestedVersion":"1.20.9"}}],"artifact":{"id":"pkg:npm/body-parser@1.20.1?package-id=7f3f0b84d4a020ab","name":"body-parser","version":"1.20.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:body-parser:1.20.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.20.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-v93f-fgjr-hjrj","dataSource":"https://github.com/advisories/GHSA-v93f-fgjr-hjrj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj","https://github.com/electron/electron/pull/50946","https://github.com/electron/electron/pull/50947","https://github.com/electron/electron/pull/50948","https://github.com/electron/electron/pull/50949","https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a","https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7","https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b","https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55","https://github.com/electron/electron/releases/tag/v39.8.8","https://github.com/electron/electron/releases/tag/v40.9.0","https://github.com/electron/electron/releases/tag/v41.2.1","https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"],"description":"Electron: window.open features string controls some window options considered privileged","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70607","epss":0.00558,"percentile":0.46509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70607","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.8"],"state":"fixed","available":[{"version":"39.8.8","date":"2026-08-05","kind":"first-observed"}]},"advisories":[],"risk":0.28737},"relatedVulnerabilities":[{"id":"CVE-2026-70607","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70607","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a","https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7","https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b","https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55","https://github.com/electron/electron/pull/50946","https://github.com/electron/electron/pull/50947","https://github.com/electron/electron/pull/50948","https://github.com/electron/electron/pull/50949","https://github.com/electron/electron/releases/tag/v39.8.8","https://github.com/electron/electron/releases/tag/v40.9.0","https://github.com/electron/electron/releases/tag/v41.2.1","https://github.com/electron/electron/releases/tag/v42.0.0-beta.3","https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70607","epss":0.00558,"percentile":0.46509,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70607","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-v93f-fgjr-hjrj","versionConstraint":"<39.8.8 (semantic)"},"fix":{"suggestedVersion":"39.8.8"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-2g4f-4pwh-qvx6","dataSource":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-69873","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/ajv-validator/ajv/pull/2586","https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5","https://github.com/ajv-validator/ajv/releases/tag/v8.18.0","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/github/advisory-database/pull/6991"],"description":"ajv has ReDoS when using `$data` option","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["6.14.0"],"state":"fixed","available":[{"version":"6.14.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.287175},"relatedVulnerabilities":[{"id":"CVE-2025-69873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/github/advisory-database/pull/6991","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:26211","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5907","https://access.redhat.com/errata/RHSA-2026:5910","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7314","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69873","https://bugzilla.redhat.com/show_bug.cgi?id=2439070","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"],"description":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"4.11.8"}},"found":{"vulnerabilityID":"GHSA-2g4f-4pwh-qvx6","versionConstraint":"<6.14.0 (semantic)"},"fix":{"suggestedVersion":"6.14.0"}}],"artifact":{"id":"pkg:npm/ajv@4.11.8?package-id=3b2f8424f2ea8fd2","name":"ajv","version":"4.11.8","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:4.11.8:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@4.11.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-2g4f-4pwh-qvx6","dataSource":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-69873","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/ajv-validator/ajv/pull/2586","https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5","https://github.com/ajv-validator/ajv/releases/tag/v8.18.0","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/github/advisory-database/pull/6991"],"description":"ajv has ReDoS when using `$data` option","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["6.14.0"],"state":"fixed","available":[{"version":"6.14.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.287175},"relatedVulnerabilities":[{"id":"CVE-2025-69873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/github/advisory-database/pull/6991","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:26211","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5907","https://access.redhat.com/errata/RHSA-2026:5910","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7314","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69873","https://bugzilla.redhat.com/show_bug.cgi?id=2439070","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"],"description":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"6.12.6"}},"found":{"vulnerabilityID":"GHSA-2g4f-4pwh-qvx6","versionConstraint":"<6.14.0 (semantic)"},"fix":{"suggestedVersion":"6.14.0"}}],"artifact":{"id":"pkg:npm/ajv@6.12.6?package-id=1e1c2b91b377aaa5","name":"ajv","version":"6.12.6","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:6.12.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@6.12.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-2g4f-4pwh-qvx6","dataSource":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-69873","https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/ajv-validator/ajv/pull/2586","https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5","https://github.com/ajv-validator/ajv/releases/tag/v8.18.0","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/github/advisory-database/pull/6991"],"description":"ajv has ReDoS when using `$data` option","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["6.14.0"],"state":"fixed","available":[{"version":"6.14.0","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.287175},"relatedVulnerabilities":[{"id":"CVE-2025-69873","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","https://github.com/ajv-validator/ajv/pull/2588","https://github.com/ajv-validator/ajv/pull/2590","https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","https://github.com/github/advisory-database/pull/6991","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:26211","https://access.redhat.com/errata/RHSA-2026:26214","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5907","https://access.redhat.com/errata/RHSA-2026:5910","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6309","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7314","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2025-69873","https://bugzilla.redhat.com/show_bug.cgi?id=2439070","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"],"description":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cve@mitre.org","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69873","epss":0.00547,"percentile":0.45847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2025-69873","cwe":"CWE-1333","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ajv","version":"6.6.2"}},"found":{"vulnerabilityID":"GHSA-2g4f-4pwh-qvx6","versionConstraint":"<6.14.0 (semantic)"},"fix":{"suggestedVersion":"6.14.0"}}],"artifact":{"id":"pkg:npm/ajv@6.6.2?package-id=3eaad64be5bb1ab4","name":"ajv","version":"6.6.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:ajv:ajv:6.6.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/ajv@6.6.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4f78-qhmw-8j8m","dataSource":"https://github.com/advisories/GHSA-4f78-qhmw-8j8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m","https://github.com/electron/electron/pull/50665","https://github.com/electron/electron/pull/50666","https://github.com/electron/electron/pull/50667","https://github.com/electron/electron/pull/50668","https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1","https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b","https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce","https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba","https://github.com/electron/electron/releases/tag/v39.8.7","https://github.com/electron/electron/releases/tag/v40.9.0","https://github.com/electron/electron/releases/tag/v41.2.0","https://github.com/electron/electron/releases/tag/v42.0.0-beta.1"],"description":"Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.7,"exploitabilityScore":0.6,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70609","epss":0.00532,"percentile":0.44983,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70609","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-70609","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.7"],"state":"fixed","available":[{"version":"39.8.7","date":"2026-08-06","kind":"first-observed"}]},"advisories":[],"risk":0.28462},"relatedVulnerabilities":[{"id":"CVE-2026-70609","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70609","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1","https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b","https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce","https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba","https://github.com/electron/electron/pull/50665","https://github.com/electron/electron/pull/50666","https://github.com/electron/electron/pull/50667","https://github.com/electron/electron/pull/50668","https://github.com/electron/electron/releases/tag/v39.8.7","https://github.com/electron/electron/releases/tag/v40.9.0","https://github.com/electron/electron/releases/tag/v41.2.0","https://github.com/electron/electron/releases/tag/v42.0.0-beta.1","https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":5.7,"exploitabilityScore":0.6,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70609","epss":0.00532,"percentile":0.44983,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70609","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-70609","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-4f78-qhmw-8j8m","versionConstraint":"<39.8.7 (semantic)"},"fix":{"suggestedVersion":"39.8.7"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-4p3w-j4w9-5jqw","dataSource":"https://github.com/advisories/GHSA-4p3w-j4w9-5jqw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw","https://nvd.nist.gov/vuln/detail/CVE-2026-17495","https://github.com/moment/moment/pull/6386","https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07","https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/releases/tag/2.31.0"],"description":"moment vulnerable to Path Traversal via crafted non-string locale name","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-17495","epss":0.00519,"percentile":0.44161,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.31.0"],"state":"fixed","available":[{"version":"2.31.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.282855},"relatedVulnerabilities":[{"id":"CVE-2026-17495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17495","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw"],"description":"moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-17495","epss":0.00519,"percentile":0.44161,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-17495","cwe":"CWE-27","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.29.4"}},"found":{"vulnerabilityID":"GHSA-4p3w-j4w9-5jqw","versionConstraint":">=2.29.2,<2.31.0 (semantic)"},"fix":{"suggestedVersion":"2.31.0"}}],"artifact":{"id":"pkg:npm/moment@2.29.4?package-id=e0d37fef5f9e1f6d","name":"moment","version":"2.29.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:momentjs:moment:2.29.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.29.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-jr5w-w6x2-84p9","dataSource":"https://github.com/advisories/GHSA-jr5w-w6x2-84p9","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9","https://github.com/electron/electron/pull/55127","https://github.com/electron/electron/pull/55128","https://github.com/electron/electron/pull/55129","https://github.com/electron/electron/pull/55130","https://github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc","https://github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f5bcad","https://github.com/electron/electron/commit/817c43f925677eb88034bfba4f0b8dfd28e7ad20","https://github.com/electron/electron/commit/e02265be96c5e13ae43644ef482b718e1e800499","https://github.com/electron/electron/releases/tag/v42.11.16","https://github.com/electron/electron/releases/tag/v43.8.1","https://github.com/electron/electron/releases/tag/v44.9.1","https://github.com/electron/electron/releases/tag/v45.0.0-beta.6"],"description":"Electron: Mitigation for compromised eMudhra intermediate certificates","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115570","epss":0.00377,"percentile":0.31724,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115570","cwe":"CWE-299","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["42.11.16"],"state":"fixed","available":[{"version":"42.11.16","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.280865},"relatedVulnerabilities":[{"id":"CVE-2026-115570","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115570","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc","https://github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f5bcad","https://github.com/electron/electron/commit/817c43f925677eb88034bfba4f0b8dfd28e7ad20","https://github.com/electron/electron/commit/e02265be96c5e13ae43644ef482b718e1e800499","https://github.com/electron/electron/pull/55127","https://github.com/electron/electron/pull/55128","https://github.com/electron/electron/pull/55129","https://github.com/electron/electron/pull/55130","https://github.com/electron/electron/releases/tag/v42.11.16","https://github.com/electron/electron/releases/tag/v43.8.1","https://github.com/electron/electron/releases/tag/v44.9.1","https://github.com/electron/electron/releases/tag/v45.0.0-beta.6","https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115570","epss":0.00377,"percentile":0.31724,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115570","cwe":"CWE-299","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-jr5w-w6x2-84p9","versionConstraint":"<42.11.16 (semantic)"},"fix":{"suggestedVersion":"42.11.16"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-m93v-9qjc-3g79","dataSource":"https://github.com/advisories/GHSA-m93v-9qjc-3g79","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-m93v-9qjc-3g79","https://nvd.nist.gov/vuln/detail/CVE-2020-4076","https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"],"description":"Context isolation bypass via leaked cross-context objects in Electron","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.8,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-4076","epss":0.00367,"percentile":0.306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-4076","cwe":"CWE-501","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-4076","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.2.4"],"state":"fixed","available":[{"version":"7.2.4","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":0.28075500000000003},"relatedVulnerabilities":[{"id":"CVE-2020-4076","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-4076","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/electron/electron/security/advisories/GHSA-m93v-9qjc-3g79","https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"],"description":"In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9,"exploitabilityScore":2.6,"impactScore":5.8},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":4,"impactScore":5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.8,"exploitabilityScore":1.5,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-4076","epss":0.00367,"percentile":0.306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-4076","cwe":"CWE-501","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-4076","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-m93v-9qjc-3g79","versionConstraint":"<7.2.4 (semantic)"},"fix":{"suggestedVersion":"7.2.4"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-7x97-j373-85x5","dataSource":"https://github.com/advisories/GHSA-7x97-j373-85x5","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-7x97-j373-85x5","https://nvd.nist.gov/vuln/detail/CVE-2023-39956"],"description":"Electron vulnerable to out-of-package code execution when launched with arbitrary cwd","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.1,"exploitabilityScore":1.4,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-39956","epss":0.00491,"percentile":0.42224,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-39956","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["22.3.19"],"state":"fixed","available":[{"version":"22.3.19","date":"2023-09-07","kind":"first-observed"}]},"advisories":[],"risk":0.272505},"relatedVulnerabilities":[{"id":"CVE-2023-39956","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39956","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-7x97-j373-85x5"],"description":"Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted.   Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with an attacker-controlled working directory and 2. The attacker has the ability to write files to that working directory. This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance.  This issue has been fixed in versions:`26.0.0-beta.13`, `25.4.1`, `24.7.1`, `23.3.13`, and `22.3.19`. There are no app side workarounds, users must update to a patched version of Electron.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.6,"exploitabilityScore":1.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.1,"exploitabilityScore":1.4,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-39956","epss":0.00491,"percentile":0.42224,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-39956","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-7x97-j373-85x5","versionConstraint":"<22.3.19 (semantic)"},"fix":{"suggestedVersion":"22.3.19"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-mq8j-3h7h-p8g7","dataSource":"https://github.com/advisories/GHSA-mq8j-3h7h-p8g7","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7","https://nvd.nist.gov/vuln/detail/CVE-2022-29247"],"description":"Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.2,"exploitabilityScore":0.8,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-29247","epss":0.01048,"percentile":0.64234,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-29247","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["15.5.5"],"state":"fixed","available":[{"version":"15.5.5","date":"2022-06-17","kind":"first-observed"}]},"advisories":[],"risk":0.27248},"relatedVulnerabilities":[{"id":"CVE-2022-29247","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29247","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.2,"exploitabilityScore":0.8,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-29247","epss":0.01048,"percentile":0.64234,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2022-29247","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-mq8j-3h7h-p8g7","versionConstraint":"<15.5.5 (semantic)"},"fix":{"suggestedVersion":"15.5.5"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-p9pc-299p-vxgp","dataSource":"https://github.com/advisories/GHSA-p9pc-299p-vxgp","namespace":"github:language:javascript","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381","https://www.npmjs.com/advisories/1500","https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2","https://nvd.nist.gov/vuln/detail/CVE-2020-7608","https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36"],"description":"yargs-parser Vulnerable to Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["13.1.2"],"state":"fixed","available":[{"version":"13.1.2","date":"2020-09-05","kind":"first-observed"}]},"advisories":[],"risk":0.26471},"relatedVulnerabilities":[{"id":"CVE-2020-7608","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","namespace":"nvd:cpe","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381"],"description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"exploitabilityScore":4,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"yargs-parser","version":"11.1.1"}},"found":{"vulnerabilityID":"GHSA-p9pc-299p-vxgp","versionConstraint":">=6.0.0,<13.1.2 (semantic)"},"fix":{"suggestedVersion":"13.1.2"}}],"artifact":{"id":"pkg:npm/yargs-parser@11.1.1?package-id=bb400a96763660b9","name":"yargs-parser","version":"11.1.1","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:yargs:yargs-parser:11.1.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/yargs-parser@11.1.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-p9pc-299p-vxgp","dataSource":"https://github.com/advisories/GHSA-p9pc-299p-vxgp","namespace":"github:language:javascript","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381","https://www.npmjs.com/advisories/1500","https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2","https://nvd.nist.gov/vuln/detail/CVE-2020-7608","https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36"],"description":"yargs-parser Vulnerable to Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["13.1.2"],"state":"fixed","available":[{"version":"13.1.2","date":"2020-09-05","kind":"first-observed"}]},"advisories":[],"risk":0.26471},"relatedVulnerabilities":[{"id":"CVE-2020-7608","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","namespace":"nvd:cpe","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381"],"description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"exploitabilityScore":4,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"yargs-parser","version":"13.0.0"}},"found":{"vulnerabilityID":"GHSA-p9pc-299p-vxgp","versionConstraint":">=6.0.0,<13.1.2 (semantic)"},"fix":{"suggestedVersion":"13.1.2"}}],"artifact":{"id":"pkg:npm/yargs-parser@13.0.0?package-id=0ed7bb5d096bf06c","name":"yargs-parser","version":"13.0.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:yargs:yargs-parser:13.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/yargs-parser@13.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p9pc-299p-vxgp","dataSource":"https://github.com/advisories/GHSA-p9pc-299p-vxgp","namespace":"github:language:javascript","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381","https://www.npmjs.com/advisories/1500","https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2","https://nvd.nist.gov/vuln/detail/CVE-2020-7608","https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36"],"description":"yargs-parser Vulnerable to Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["13.1.2"],"state":"fixed","available":[{"version":"13.1.2","date":"2020-09-05","kind":"first-observed"}]},"advisories":[],"risk":0.26471},"relatedVulnerabilities":[{"id":"CVE-2020-7608","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","namespace":"nvd:cpe","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381"],"description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"exploitabilityScore":4,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"yargs-parser","version":"13.1.0"}},"found":{"vulnerabilityID":"GHSA-p9pc-299p-vxgp","versionConstraint":">=6.0.0,<13.1.2 (semantic)"},"fix":{"suggestedVersion":"13.1.2"}}],"artifact":{"id":"pkg:npm/yargs-parser@13.1.0?package-id=14a764c50e99fa1e","name":"yargs-parser","version":"13.1.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:yargs:yargs-parser:13.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/yargs-parser@13.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p9pc-299p-vxgp","dataSource":"https://github.com/advisories/GHSA-p9pc-299p-vxgp","namespace":"github:language:javascript","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381","https://www.npmjs.com/advisories/1500","https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2","https://nvd.nist.gov/vuln/detail/CVE-2020-7608","https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36"],"description":"yargs-parser Vulnerable to Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2021-07-29","kind":"first-observed"}]},"advisories":[],"risk":0.26471},"relatedVulnerabilities":[{"id":"CVE-2020-7608","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","namespace":"nvd:cpe","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381"],"description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"exploitabilityScore":4,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"yargs-parser","version":"2.4.1"}},"found":{"vulnerabilityID":"GHSA-p9pc-299p-vxgp","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/yargs-parser@2.4.1?package-id=327b4ff1c51c87d8","name":"yargs-parser","version":"2.4.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:yargs:yargs-parser:2.4.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/yargs-parser@2.4.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-p9pc-299p-vxgp","dataSource":"https://github.com/advisories/GHSA-p9pc-299p-vxgp","namespace":"github:language:javascript","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381","https://www.npmjs.com/advisories/1500","https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2","https://nvd.nist.gov/vuln/detail/CVE-2020-7608","https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36"],"description":"yargs-parser Vulnerable to Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2021-07-29","kind":"first-observed"}]},"advisories":[],"risk":0.26471},"relatedVulnerabilities":[{"id":"CVE-2020-7608","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","namespace":"nvd:cpe","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381"],"description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"exploitabilityScore":4,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"yargs-parser","version":"4.2.1"}},"found":{"vulnerabilityID":"GHSA-p9pc-299p-vxgp","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/yargs-parser@4.2.1?package-id=0fe93a18c00c4325","name":"yargs-parser","version":"4.2.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:yargs:yargs-parser:4.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/yargs-parser@4.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-p9pc-299p-vxgp","dataSource":"https://github.com/advisories/GHSA-p9pc-299p-vxgp","namespace":"github:language:javascript","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381","https://www.npmjs.com/advisories/1500","https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2","https://nvd.nist.gov/vuln/detail/CVE-2020-7608","https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36"],"description":"yargs-parser Vulnerable to Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["5.0.1"],"state":"fixed","available":[{"version":"5.0.1","date":"2021-07-29","kind":"first-observed"}]},"advisories":[],"risk":0.26471},"relatedVulnerabilities":[{"id":"CVE-2020-7608","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","namespace":"nvd:cpe","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381"],"description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"exploitabilityScore":4,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"yargs-parser","version":"5.0.0"}},"found":{"vulnerabilityID":"GHSA-p9pc-299p-vxgp","versionConstraint":"<=5.0.0 (semantic)"},"fix":{"suggestedVersion":"5.0.1"}}],"artifact":{"id":"pkg:npm/yargs-parser@5.0.0?package-id=9da135c09bd98a9a","name":"yargs-parser","version":"5.0.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:yargs:yargs-parser:5.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/yargs-parser@5.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p9pc-299p-vxgp","dataSource":"https://github.com/advisories/GHSA-p9pc-299p-vxgp","namespace":"github:language:javascript","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381","https://www.npmjs.com/advisories/1500","https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2","https://nvd.nist.gov/vuln/detail/CVE-2020-7608","https://github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36"],"description":"yargs-parser Vulnerable to Prototype Pollution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["13.1.2"],"state":"fixed","available":[{"version":"13.1.2","date":"2020-09-05","kind":"first-observed"}]},"advisories":[],"risk":0.26471},"relatedVulnerabilities":[{"id":"CVE-2020-7608","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","namespace":"nvd:cpe","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381"],"description":"yargs-parser could be tricked into adding or modifying properties of Object.prototype using a \"__proto__\" payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"exploitabilityScore":4,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-7608","epss":0.00514,"percentile":0.43859,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2020-7608","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"yargs-parser","version":"9.0.2"}},"found":{"vulnerabilityID":"GHSA-p9pc-299p-vxgp","versionConstraint":">=6.0.0,<13.1.2 (semantic)"},"fix":{"suggestedVersion":"13.1.2"}}],"artifact":{"id":"pkg:npm/yargs-parser@9.0.2?package-id=941fa1fd6f61b267","name":"yargs-parser","version":"9.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:yargs:yargs-parser:9.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/yargs-parser@9.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-v3j7-r9gq-3gjw","dataSource":"https://github.com/advisories/GHSA-v3j7-r9gq-3gjw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw"],"description":"Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70604","epss":0.00354,"percentile":0.29182,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70604","cwe":"CWE-942","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.10"],"state":"fixed","available":[{"version":"39.8.10","date":"2026-08-05","kind":"first-observed"}]},"advisories":[],"risk":0.26373},"relatedVulnerabilities":[{"id":"CVE-2026-70604","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70604","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70604","epss":0.00354,"percentile":0.29182,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70604","cwe":"CWE-942","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-v3j7-r9gq-3gjw","versionConstraint":"<39.8.10 (semantic)"},"fix":{"suggestedVersion":"39.8.10"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.13"],"state":"fixed","available":[{"version":"1.1.13","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":"<1.1.13 (semantic)"},"fix":{"suggestedVersion":"1.1.13"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=7059a7b443401e23","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.13"],"state":"fixed","available":[{"version":"1.1.13","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":"<1.1.13 (semantic)"},"fix":{"suggestedVersion":"1.1.13"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2b36477cae56122e","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.13"],"state":"fixed","available":[{"version":"1.1.13","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":"<1.1.13 (semantic)"},"fix":{"suggestedVersion":"1.1.13"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2371e2ddff0f5bc0","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-f886-m6hf-6m8v","dataSource":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://nvd.nist.gov/vuln/detail/CVE-2026-33750"],"description":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.13"],"state":"fixed","available":[{"version":"1.1.13","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.25702499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-33750","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33750","epss":0.00447,"percentile":0.38908,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33750","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-f886-m6hf-6m8v","versionConstraint":"<1.1.13 (semantic)"},"fix":{"suggestedVersion":"1.1.13"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=374d713d4d50aa6f","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-fxqj-rqcc-2cmp","dataSource":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19"],"description":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.23"],"state":"fixed","available":[{"version":"8.5.23","date":"2026-08-04","kind":"first-observed"}]},"advisories":[],"risk":0.254815},"relatedVulnerabilities":[{"id":"CVE-2026-69153","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss/releases/tag/8.5.19","https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-69153","epss":0.00451,"percentile":0.39211,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-69153","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-69153","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"5.2.18"}},"found":{"vulnerabilityID":"GHSA-fxqj-rqcc-2cmp","versionConstraint":"<=8.5.22 (semantic)"},"fix":{"suggestedVersion":"8.5.23"}}],"artifact":{"id":"pkg:npm/postcss@5.2.18?package-id=a2216b0d3db52a78","name":"postcss","version":"5.2.18","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:postcss:postcss:5.2.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@5.2.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=7059a7b443401e23","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2371e2ddff0f5bc0","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=374d713d4d50aa6f","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-3jxr-9vmj-r5cp","dataSource":"https://github.com/advisories/GHSA-3jxr-9vmj-r5cp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp","https://nvd.nist.gov/vuln/detail/CVE-2026-13149","https://github.com/juliangruber/brace-expansion/pull/122","https://github.com/juliangruber/brace-expansion/pull/123","https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265","https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95","https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16","https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2","https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["1.1.16"],"state":"fixed","available":[{"version":"1.1.16","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.25479999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-13149","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754","https://www.npmjs.com/package/brace-expansion"],"description":"brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-13149","epss":0.00364,"percentile":0.30245,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-13149","cwe":"CWE-400","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-13149","cwe":"CWE-407","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-3jxr-9vmj-r5cp","versionConstraint":"<1.1.16 (semantic)"},"fix":{"suggestedVersion":"1.1.16"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2b36477cae56122e","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-mp7j-qc5w-4988","dataSource":"https://github.com/advisories/GHSA-mp7j-qc5w-4988","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/faye/websocket-driver-node/security/advisories/GHSA-mp7j-qc5w-4988","https://github.com/faye/websocket-driver-node/releases/tag/0.7.5"],"description":"websocket-driver: Resource limit bypass via message compression","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54490","epss":0.00445,"percentile":0.38693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54490","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.5"],"state":"fixed","available":[{"version":"0.7.5","date":"2026-07-16","kind":"first-observed"}]},"advisories":[],"risk":0.25142499999999995},"relatedVulnerabilities":[{"id":"CVE-2026-54490","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54490","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/faye/websocket-driver-node/commit/c55679a5b18251dd0a55d18a0cc6a4fd8822b92f","https://github.com/faye/websocket-driver-node/security/advisories/GHSA-mp7j-qc5w-4988"],"description":"websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54490","epss":0.00445,"percentile":0.38693,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54490","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"websocket-driver","version":"0.7.4"}},"found":{"vulnerabilityID":"GHSA-mp7j-qc5w-4988","versionConstraint":"<0.7.5 (semantic)"},"fix":{"suggestedVersion":"0.7.5"}}],"artifact":{"id":"pkg:npm/websocket-driver@0.7.4?package-id=605352b7609c207f","name":"websocket-driver","version":"0.7.4","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:websocket-driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket-driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket_driver:websocket_driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket-driver:0.7.4:*:*:*:*:*:*:*","cpe:2.3:a:websocket:websocket_driver:0.7.4:*:*:*:*:*:*:*"],"purl":"pkg:npm/websocket-driver@0.7.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-qr28-fpjm-wq7f","dataSource":"https://github.com/advisories/GHSA-qr28-fpjm-wq7f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f","https://nvd.nist.gov/vuln/detail/CVE-2026-118664","https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1"],"description":"decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118664","epss":0.00318,"percentile":0.24817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118664","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118664","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.5.1"],"state":"fixed","available":[{"version":"0.5.1","date":"2026-10-30","kind":"first-observed"}]},"advisories":[],"risk":0.24963},"relatedVulnerabilities":[{"id":"CVE-2026-118664","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118664","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1","https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f"],"description":"decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118664","epss":0.00318,"percentile":0.24817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118664","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118664","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"decode-uri-component","version":"0.2.0"}},"found":{"vulnerabilityID":"GHSA-qr28-fpjm-wq7f","versionConstraint":"<=0.5.0 (semantic)"},"fix":{"suggestedVersion":"0.5.1"}}],"artifact":{"id":"pkg:npm/decode-uri-component@0.2.0?package-id=a174fcee943e47c0","name":"decode-uri-component","version":"0.2.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:decode-uri-component_project:decode-uri-component:0.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/decode-uri-component@0.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qr28-fpjm-wq7f","dataSource":"https://github.com/advisories/GHSA-qr28-fpjm-wq7f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f","https://nvd.nist.gov/vuln/detail/CVE-2026-118664","https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1"],"description":"decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118664","epss":0.00318,"percentile":0.24817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118664","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118664","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.5.1"],"state":"fixed","available":[{"version":"0.5.1","date":"2026-10-30","kind":"first-observed"}]},"advisories":[],"risk":0.24963},"relatedVulnerabilities":[{"id":"CVE-2026-118664","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118664","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1","https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f"],"description":"decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118664","epss":0.00318,"percentile":0.24817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118664","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-118664","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"decode-uri-component","version":"0.2.0"}},"found":{"vulnerabilityID":"GHSA-qr28-fpjm-wq7f","versionConstraint":"<=0.5.0 (semantic)"},"fix":{"suggestedVersion":"0.5.1"}}],"artifact":{"id":"pkg:npm/decode-uri-component@0.2.0?package-id=c628a0855d545708","name":"decode-uri-component","version":"0.2.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:decode-uri-component_project:decode-uri-component:0.2.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/decode-uri-component@0.2.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.23944000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.23944000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.23944000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00328,"percentile":0.25996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqcg-44mw-7w3h","dataSource":"https://github.com/advisories/GHSA-jqcg-44mw-7w3h","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h","https://nvd.nist.gov/vuln/detail/CVE-2026-90711","https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965","https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8"],"description":"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.0.8"],"state":"fixed","available":[{"version":"2.0.8","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.2353},"relatedVulnerabilities":[{"id":"CVE-2026-90711","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90711","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"],"description":"proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"proxy-addr","version":"2.0.5"}},"found":{"vulnerabilityID":"GHSA-jqcg-44mw-7w3h","versionConstraint":">=1.1.0,<2.0.8 (semantic)"},"fix":{"suggestedVersion":"2.0.8"}}],"artifact":{"id":"pkg:npm/proxy-addr@2.0.5?package-id=51cef7852d509506","name":"proxy-addr","version":"2.0.5","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:proxy-addr:proxy-addr:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:proxy-addr:proxy_addr:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy-addr:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy_addr:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy-addr:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy_addr:2.0.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/proxy-addr@2.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-jqcg-44mw-7w3h","dataSource":"https://github.com/advisories/GHSA-jqcg-44mw-7w3h","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h","https://nvd.nist.gov/vuln/detail/CVE-2026-90711","https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965","https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8"],"description":"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.0.8"],"state":"fixed","available":[{"version":"2.0.8","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.2353},"relatedVulnerabilities":[{"id":"CVE-2026-90711","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90711","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"],"description":"proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-90711","epss":0.0026,"percentile":0.17705,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-90711","cwe":"CWE-290","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-348","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-90711","cwe":"CWE-697","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"proxy-addr","version":"2.0.7"}},"found":{"vulnerabilityID":"GHSA-jqcg-44mw-7w3h","versionConstraint":">=1.1.0,<2.0.8 (semantic)"},"fix":{"suggestedVersion":"2.0.8"}}],"artifact":{"id":"pkg:npm/proxy-addr@2.0.7?package-id=e90d5c17f1486777","name":"proxy-addr","version":"2.0.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:proxy-addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy-addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy_addr:proxy_addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy-addr:2.0.7:*:*:*:*:*:*:*","cpe:2.3:a:proxy:proxy_addr:2.0.7:*:*:*:*:*:*:*"],"purl":"pkg:npm/proxy-addr@2.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3ch-rx76-35fx","dataSource":"https://github.com/advisories/GHSA-g3ch-rx76-35fx","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-6783","https://www.herodevs.com/vulnerability-directory/cve-2024-6783"],"description":"vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"exploitabilityScore":1.7,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-6783","epss":0.00506,"percentile":0.43255,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-6783","cwe":"CWE-79","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.23276000000000005},"relatedVulnerabilities":[{"id":"CVE-2024-6783","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-6783","namespace":"nvd:cpe","severity":"Medium","urls":["https://www.herodevs.com/vulnerability-directory/cve-2024-6783","https://github.com/advisories/GHSA-g3ch-rx76-35fx","https://www.herodevs.com/vulnerability-directory/cve-2024-6783---vue-client-side-xss"],"description":"A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as `Object.prototype.staticClass` or `Object.prototype.staticStyle` to execute arbitrary JavaScript code.","cvss":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-6783","epss":0.00506,"percentile":0.43255,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-6783","cwe":"CWE-79","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vue-template-compiler","version":"2.6.12"}},"found":{"vulnerabilityID":"GHSA-g3ch-rx76-35fx","versionConstraint":">=2.0.0,<3.0.0 (semantic)"}}],"artifact":{"id":"pkg:npm/vue-template-compiler@2.6.12?package-id=e84b2255154a228f","name":"vue-template-compiler","version":"2.6.12","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:vue-template-compiler:vue-template-compiler:2.6.12:*:*:*:*:*:*:*","cpe:2.3:a:vue-template-compiler:vue_template_compiler:2.6.12:*:*:*:*:*:*:*","cpe:2.3:a:vue_template_compiler:vue-template-compiler:2.6.12:*:*:*:*:*:*:*","cpe:2.3:a:vue_template_compiler:vue_template_compiler:2.6.12:*:*:*:*:*:*:*","cpe:2.3:a:vue-template:vue-template-compiler:2.6.12:*:*:*:*:*:*:*","cpe:2.3:a:vue-template:vue_template_compiler:2.6.12:*:*:*:*:*:*:*","cpe:2.3:a:vue_template:vue-template-compiler:2.6.12:*:*:*:*:*:*:*","cpe:2.3:a:vue_template:vue_template_compiler:2.6.12:*:*:*:*:*:*:*","cpe:2.3:a:vue:vue-template-compiler:2.6.12:*:*:*:*:*:*:*","cpe:2.3:a:vue:vue_template_compiler:2.6.12:*:*:*:*:*:*:*"],"purl":"pkg:npm/vue-template-compiler@2.6.12","upstreams":[]}},{"vulnerability":{"id":"GHSA-xjpj-3mr7-gcpf","dataSource":"https://github.com/advisories/GHSA-xjpj-3mr7-gcpf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33941"],"description":"Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33941","epss":0.00296,"percentile":0.22307,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33941","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-28","kind":"first-observed"}]},"advisories":[],"risk":0.23235999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-33941","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33941","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/security/cve/CVE-2026-33941","https://bugzilla.redhat.com/show_bug.cgi?id=2452524","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33941.json"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser. Version 4.7.9 fixes the issue. Some workarounds are available. First, validate all CLI inputs before invoking the precompiler. Reject filenames and option values  that contain characters with JavaScript string-escaping significance (`\"`, `'`, `;`, etc.). Second, use a fixed, trusted namespace string passed via a configuration file rather than  command-line arguments in automated pipelines. Third, run the precompiler in a sandboxed environment (container with no write access to sensitive  paths) to limit the impact of successful exploitation. Fourth, audit template filenames in any repository or package that is consumed by an automated  build pipeline.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33941","epss":0.00296,"percentile":0.22307,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33941","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33941","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.7"}},"found":{"vulnerabilityID":"GHSA-xjpj-3mr7-gcpf","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.7?package-id=94a6b0a915fbcc9f","name":"handlebars","version":"4.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.7:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-9wfr-w7mm-pc7f","dataSource":"https://github.com/advisories/GHSA-9wfr-w7mm-pc7f","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-9wfr-w7mm-pc7f","https://nvd.nist.gov/vuln/detail/CVE-2026-34769"],"description":"Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.7,"exploitabilityScore":1.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34769","epss":0.003,"percentile":0.22812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34769","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34769","cwe":"CWE-912","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34769","cwe":"CWE-88","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.22799999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-34769","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34769","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-9wfr-w7mm-pc7f","https://access.redhat.com/security/cve/CVE-2026-34769","https://bugzilla.redhat.com/show_bug.cgi?id=2455004","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34769.json"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls. Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.7,"exploitabilityScore":1.1,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.7,"exploitabilityScore":1.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34769","epss":0.003,"percentile":0.22812,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34769","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34769","cwe":"CWE-912","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34769","cwe":"CWE-88","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-9wfr-w7mm-pc7f","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-6rw7-vpxm-498p","dataSource":"https://github.com/advisories/GHSA-6rw7-vpxm-498p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","https://nvd.nist.gov/vuln/detail/CVE-2025-15284","https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"],"description":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.1"],"state":"fixed","available":[{"version":"6.14.1","date":"2026-01-01","kind":"first-observed"}]},"advisories":[],"risk":0.22499999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-15284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"],"description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' && options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index <= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.11.0"}},"found":{"vulnerabilityID":"GHSA-6rw7-vpxm-498p","versionConstraint":"<6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.1"}}],"artifact":{"id":"pkg:npm/qs@6.11.0?package-id=d6d772e2b709ec9c","name":"qs","version":"6.11.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.11.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.11.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6rw7-vpxm-498p","dataSource":"https://github.com/advisories/GHSA-6rw7-vpxm-498p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","https://nvd.nist.gov/vuln/detail/CVE-2025-15284","https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"],"description":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.1"],"state":"fixed","available":[{"version":"6.14.1","date":"2026-01-01","kind":"first-observed"}]},"advisories":[],"risk":0.22499999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-15284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"],"description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' && options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index <= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.11.2"}},"found":{"vulnerabilityID":"GHSA-6rw7-vpxm-498p","versionConstraint":"<6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.1"}}],"artifact":{"id":"pkg:npm/qs@6.11.2?package-id=71e0f1d535ab1430","name":"qs","version":"6.11.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.11.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.11.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6rw7-vpxm-498p","dataSource":"https://github.com/advisories/GHSA-6rw7-vpxm-498p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","https://nvd.nist.gov/vuln/detail/CVE-2025-15284","https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"],"description":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.1"],"state":"fixed","available":[{"version":"6.14.1","date":"2026-01-01","kind":"first-observed"}]},"advisories":[],"risk":0.22499999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-15284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"],"description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' && options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index <= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.4.0"}},"found":{"vulnerabilityID":"GHSA-6rw7-vpxm-498p","versionConstraint":"<6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.1"}}],"artifact":{"id":"pkg:npm/qs@6.4.0?package-id=20732df25e595c98","name":"qs","version":"6.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6rw7-vpxm-498p","dataSource":"https://github.com/advisories/GHSA-6rw7-vpxm-498p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","https://nvd.nist.gov/vuln/detail/CVE-2025-15284","https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"],"description":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.1"],"state":"fixed","available":[{"version":"6.14.1","date":"2026-01-01","kind":"first-observed"}]},"advisories":[],"risk":0.22499999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-15284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"],"description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' && options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index <= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.5.2"}},"found":{"vulnerabilityID":"GHSA-6rw7-vpxm-498p","versionConstraint":"<6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.1"}}],"artifact":{"id":"pkg:npm/qs@6.5.2?package-id=6d31126b7caf030d","name":"qs","version":"6.5.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.5.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.5.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6rw7-vpxm-498p","dataSource":"https://github.com/advisories/GHSA-6rw7-vpxm-498p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","https://nvd.nist.gov/vuln/detail/CVE-2025-15284","https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"],"description":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.1"],"state":"fixed","available":[{"version":"6.14.1","date":"2026-01-01","kind":"first-observed"}]},"advisories":[],"risk":0.22499999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-15284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"],"description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' && options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index <= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.0045,"percentile":0.39088,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.7.0"}},"found":{"vulnerabilityID":"GHSA-6rw7-vpxm-498p","versionConstraint":"<6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.1"}}],"artifact":{"id":"pkg:npm/qs@6.7.0?package-id=48756c534af1cb28","name":"qs","version":"6.7.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-pxg6-pf52-xh8x","dataSource":"https://github.com/advisories/GHSA-pxg6-pf52-xh8x","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c"],"description":"cookie accepts cookie name, path, and domain with out of bounds characters","cvss":[],"epss":[{"cve":"CVE-2024-47764","epss":0.00744,"percentile":0.54778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.0"],"state":"fixed","available":[{"version":"0.7.0","date":"2024-10-05","kind":"first-observed"}]},"advisories":[],"risk":0.2232},"relatedVulnerabilities":[{"id":"CVE-2024-47764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x"],"description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47764","epss":0.00744,"percentile":0.54778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cookie","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-pxg6-pf52-xh8x","versionConstraint":"<0.7.0 (semantic)"},"fix":{"suggestedVersion":"0.7.0"}}],"artifact":{"id":"pkg:npm/cookie@0.4.0?package-id=896c74a3a53b1a9b","name":"cookie","version":"0.4.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cookie:cookie:0.4.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/cookie@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-pxg6-pf52-xh8x","dataSource":"https://github.com/advisories/GHSA-pxg6-pf52-xh8x","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c"],"description":"cookie accepts cookie name, path, and domain with out of bounds characters","cvss":[],"epss":[{"cve":"CVE-2024-47764","epss":0.00744,"percentile":0.54778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.0"],"state":"fixed","available":[{"version":"0.7.0","date":"2024-10-05","kind":"first-observed"}]},"advisories":[],"risk":0.2232},"relatedVulnerabilities":[{"id":"CVE-2024-47764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x"],"description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47764","epss":0.00744,"percentile":0.54778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cookie","version":"0.4.2"}},"found":{"vulnerabilityID":"GHSA-pxg6-pf52-xh8x","versionConstraint":"<0.7.0 (semantic)"},"fix":{"suggestedVersion":"0.7.0"}}],"artifact":{"id":"pkg:npm/cookie@0.4.2?package-id=fff059041db39339","name":"cookie","version":"0.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cookie:cookie:0.4.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/cookie@0.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-pxg6-pf52-xh8x","dataSource":"https://github.com/advisories/GHSA-pxg6-pf52-xh8x","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c"],"description":"cookie accepts cookie name, path, and domain with out of bounds characters","cvss":[],"epss":[{"cve":"CVE-2024-47764","epss":0.00744,"percentile":0.54778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.0"],"state":"fixed","available":[{"version":"0.7.0","date":"2024-10-05","kind":"first-observed"}]},"advisories":[],"risk":0.2232},"relatedVulnerabilities":[{"id":"CVE-2024-47764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x"],"description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47764","epss":0.00744,"percentile":0.54778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cookie","version":"0.5.0"}},"found":{"vulnerabilityID":"GHSA-pxg6-pf52-xh8x","versionConstraint":"<0.7.0 (semantic)"},"fix":{"suggestedVersion":"0.7.0"}}],"artifact":{"id":"pkg:npm/cookie@0.5.0?package-id=2dbda15f3e78417f","name":"cookie","version":"0.5.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:cookie:cookie:0.5.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/cookie@0.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p2rr-rvmm-c5fp","dataSource":"https://github.com/advisories/GHSA-p2rr-rvmm-c5fp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp","https://github.com/electron/electron/pull/50961","https://github.com/electron/electron/pull/50962","https://github.com/electron/electron/pull/50963","https://github.com/electron/electron/pull/50964","https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5","https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a","https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39","https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3","https://github.com/electron/electron/releases/tag/v39.8.8","https://github.com/electron/electron/releases/tag/v40.9.0","https://github.com/electron/electron/releases/tag/v41.2.1","https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"],"description":"Electron: Sandboxed iframes can launch external protocol handlers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70612","epss":0.00429,"percentile":0.37185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70612","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.8"],"state":"fixed","available":[{"version":"39.8.8","date":"2026-08-06","kind":"first-observed"}]},"advisories":[],"risk":0.22308000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-70612","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70612","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5","https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a","https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39","https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3","https://github.com/electron/electron/pull/50961","https://github.com/electron/electron/pull/50962","https://github.com/electron/electron/pull/50963","https://github.com/electron/electron/pull/50964","https://github.com/electron/electron/releases/tag/v39.8.8","https://github.com/electron/electron/releases/tag/v40.9.0","https://github.com/electron/electron/releases/tag/v41.2.1","https://github.com/electron/electron/releases/tag/v42.0.0-beta.3","https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70612","epss":0.00429,"percentile":0.37185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70612","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-p2rr-rvmm-c5fp","versionConstraint":"<39.8.8 (semantic)"},"fix":{"suggestedVersion":"39.8.8"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2b36477cae56122e","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2371e2ddff0f5bc0","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=7059a7b443401e23","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=374d713d4d50aa6f","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-8337-3p73-46f4","dataSource":"https://github.com/advisories/GHSA-8337-3p73-46f4","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-8337-3p73-46f4","https://nvd.nist.gov/vuln/detail/CVE-2026-34771"],"description":"Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34771","epss":0.00292,"percentile":0.21842,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34771","cwe":"CWE-416","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34771","cwe":"CWE-364","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.219},"relatedVulnerabilities":[{"id":"CVE-2026-34771","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34771","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-8337-3p73-46f4","https://access.redhat.com/security/cve/CVE-2026-34771","https://bugzilla.redhat.com/show_bug.cgi?id=2454995","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34771.json"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34771","epss":0.00292,"percentile":0.21842,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34771","cwe":"CWE-416","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34771","cwe":"CWE-364","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-8337-3p73-46f4","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-3v7f-55p6-f55p","dataSource":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p","https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903","https://nvd.nist.gov/vuln/detail/CVE-2026-33672"],"description":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33672","epss":0.00425,"percentile":0.3684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33672","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.21887500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33672","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33672","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903","https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p"],"description":"Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like `[[:...:]]`; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33672","epss":0.00425,"percentile":0.3684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33672","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"picomatch","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-3v7f-55p6-f55p","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"pkg:npm/picomatch@2.2.2?package-id=f1013bf6f21317f2","name":"picomatch","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:picomatch:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/picomatch@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3v7f-55p6-f55p","dataSource":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p","https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903","https://nvd.nist.gov/vuln/detail/CVE-2026-33672"],"description":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33672","epss":0.00425,"percentile":0.3684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33672","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-03-26","kind":"first-observed"}]},"advisories":[],"risk":0.21887500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33672","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33672","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903","https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p"],"description":"Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (integrity impact), where patterns may match unintended filenames. The issue does not enable remote code execution, but it can cause security-relevant logic errors in applications that rely on glob matching for filtering, validation, or access control. All users of affected `picomatch` versions that process untrusted or user-controlled glob patterns are potentially impacted. This issue is fixed in picomatch 4.0.4, 3.0.2 and 2.3.2. Users should upgrade to one of these versions or later, depending on their supported release line. If upgrading is not immediately possible, avoid passing untrusted glob patterns to picomatch. Possible mitigations include sanitizing or rejecting untrusted glob patterns, especially those containing POSIX character classes like `[[:...:]]`; avoiding the use of POSIX bracket expressions if user input is involved; and manually patching the library by modifying `POSIX_REGEX_SOURCE` to use a null prototype.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33672","epss":0.00425,"percentile":0.3684,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33672","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"picomatch","version":"2.3.1"}},"found":{"vulnerabilityID":"GHSA-3v7f-55p6-f55p","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"pkg:npm/picomatch@2.3.1?package-id=9753bca4aa0b315b","name":"picomatch","version":"2.3.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:jonschlinkert:picomatch:2.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/picomatch@2.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.2"],"state":"fixed","available":[{"version":"3.14.2","date":"2025-11-18","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.13.1"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":"<3.14.2 (semantic)"},"fix":{"suggestedVersion":"3.14.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.13.1?package-id=d33db3c848bbbd0c","name":"js-yaml","version":"3.13.1","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.13.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.2"],"state":"fixed","available":[{"version":"3.14.2","date":"2025-11-18","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":"<3.14.2 (semantic)"},"fix":{"suggestedVersion":"3.14.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=7f4e23ed36f92339","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.2"],"state":"fixed","available":[{"version":"3.14.2","date":"2025-11-18","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.6.1"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":"<3.14.2 (semantic)"},"fix":{"suggestedVersion":"3.14.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.6.1?package-id=30d141a9595f949a","name":"js-yaml","version":"3.6.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.6.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.2"],"state":"fixed","available":[{"version":"3.14.2","date":"2025-11-18","kind":"first-observed"}]},"advisories":[],"risk":0.217845},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.00423,"percentile":0.36639,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.7.0"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":"<3.14.2 (semantic)"},"fix":{"suggestedVersion":"3.14.2"}}],"artifact":{"id":"pkg:npm/js-yaml@3.7.0?package-id=a0f85ddb9679f590","name":"js-yaml","version":"3.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-q8mj-m7cp-5q26","dataSource":"https://github.com/advisories/GHSA-q8mj-m7cp-5q26","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26","https://nvd.nist.gov/vuln/detail/CVE-2026-8723","https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41"],"description":"qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.15.2"],"state":"fixed","available":[{"version":"6.15.2","date":"2026-05-23","kind":"first-observed"}]},"advisories":[],"risk":0.21546},"relatedVulnerabilities":[{"id":"CVE-2026-8723","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41","https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26"],"description":"### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/utils.js:195`) reads `str.length` with no null guard, so a `null` or `undefined` element throws `TypeError`. `skipNulls` and `strictNullHandling` are both checked in the per-element loop below this line and never get a chance to run.\n\n\n\nSame class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + `encodeValuesOnly` branch was introduced in 4c4b23d (\"encode comma values more consistently\", PR #463, 2023-01-19), first released in v6.11.1.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nconst qs = require('qs');\n\n\n\nqs.stringify({ a: [null, 'b'] },      { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\nqs.stringify({ a: [null] },           { arrayFormat: 'comma', encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot read properties of null (reading 'length')\n\n\n\n//     at encode (lib/utils.js:195:13)\n\n\n\n//     at Object.maybeMap (lib/utils.js:322:37)\n\n\n\n//     at stringify (lib/stringify.js:145:25)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/stringify.js:145`, applied in 21f80b3 on `main` and released as v6.15.2:\n\n\n\n```diff\n\n\n\n- obj = utils.maybeMap(obj, encoder);\n\n\n\n+ obj = utils.maybeMap(obj, function (v) {\n\n\n\n+     return v == null ? v : encoder(v);\n\n\n\n+ });\n\n\n\n```\n\n\n\n`null` and `undefined` now pass through `maybeMap` unchanged and reach the `join(',')` step as-is. For `{ a: [null, 'b'] }` this produces `a=,b`, matching the non-`encodeValuesOnly` comma path (which already joins before encoding and produces `a=%2Cb` for the same input). Single-element `[null]` arrays still collapse via the existing `obj.join(',') || null` and remain subject to `skipNulls` / `strictNullHandling` in the main loop.\n\n\n\n### Affected versions\n\n\n\n`>=6.11.1 <6.15.2` — fixed in v6.15.2.\n\n\n\nThe vulnerable code shape was introduced in 4c4b23d and first shipped in v6.11.1. Earlier versions — including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 — implemented the comma + `encodeValuesOnly` path differently (joining before encoding) and are not affected. Empirically verified across released versions.\n\n\n\n### Impact\n\n\n\nApplication code that calls `qs.stringify` with both `arrayFormat: 'comma'` and `encodeValuesOnly: true` (both non-default) on input that may contain a `null` or `undefined` array element will throw synchronously instead of producing a query string. In a typical Node.js HTTP framework (Express, Fastify, Koa, hapi) the sync throw is caught by the framework's error boundary and the affected request returns a 500; the worker process does not exit and subsequent requests are unaffected. The \"kills the worker process\" framing applies only to call sites outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or to deployments with framework error handling explicitly disabled.\n\n\n\nThe vulnerable input is a `null` or `undefined` entry inside an array; this is reachable from JSON request bodies or from application code constructing arrays from user input, but not from standard HTML form submissions (which produce strings or omitted fields, not literal `null`).","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8723","epss":0.00399,"percentile":0.34223,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8723","cwe":"CWE-476","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.11.2"}},"found":{"vulnerabilityID":"GHSA-q8mj-m7cp-5q26","versionConstraint":">=6.11.1,<=6.15.1 (semantic)"},"fix":{"suggestedVersion":"6.15.2"}}],"artifact":{"id":"pkg:npm/qs@6.11.2?package-id=71e0f1d535ab1430","name":"qs","version":"6.11.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.11.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.11.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":0.21516000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23950","https://bugzilla.redhat.com/show_bug.cgi?id=2431036","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23950.json"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":0.21516000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23950","https://bugzilla.redhat.com/show_bug.cgi?id=2431036","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23950.json"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":0.21516000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:2144","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/security/cve/CVE-2026-23950","https://bugzilla.redhat.com/show_bug.cgi?id=2431036","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23950.json"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00264,"percentile":0.18349,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Secondary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.11.0"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.11.0?package-id=d6d772e2b709ec9c","name":"qs","version":"6.11.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.11.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.11.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.11.2"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.11.2?package-id=71e0f1d535ab1430","name":"qs","version":"6.11.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.11.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.11.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.4.0"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.4.0?package-id=20732df25e595c98","name":"qs","version":"6.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.5.2"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.5.2?package-id=6d31126b7caf030d","name":"qs","version":"6.5.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.5.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.5.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4mjr-xmp4-gh2g","dataSource":"https://github.com/advisories/GHSA-4mjr-xmp4-gh2g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g","https://nvd.nist.gov/vuln/detail/CVE-2026-82417","https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"],"description":"qs: Denial of Service via Attacker Controlled isBuffer","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.0"],"state":"fixed","available":[{"version":"6.16.0","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.21384},"relatedVulnerabilities":[{"id":"CVE-2026-82417","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6","https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"],"description":"### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.\n\n\n\nSuch an object can be built from untrusted input. `qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(qs.parse(\"x[constructor][isBuffer]=y\", { plainObjects: true }));\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":{\\\"constructor\\\":{\\\"isBuffer\\\":\\\"x\\\"}}}\"));\n\n\n\n// TypeError: obj.constructor.isBuffer is not a function\n\n\n\n//     at Object.isBuffer (lib/utils.js:332:78)\n\n\n\n//     at stringify (lib/stringify.js:127:45)\n\n\n\n```\n\n\n\n#### Fix\n\n\n\n`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:\n\n\n\n```diff\n\n\n\n- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));\n\n\n\n+ return !!(obj.constructor && typeof obj.constructor.isBuffer === \"function\" && obj.constructor.isBuffer(obj));\n\n\n\n```\n\n\n\nReal `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.\n\n\n\n### Affected versions\n\n\n\n`>=2.2.5 <6.16.0`, fixed in v6.16.0.\n\n\n\nThe unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-82417","epss":0.00396,"percentile":0.33816,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-82417","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-82417","cwe":"CWE-703","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.7.0"}},"found":{"vulnerabilityID":"GHSA-4mjr-xmp4-gh2g","versionConstraint":">=2.2.5,<6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.0"}}],"artifact":{"id":"pkg:npm/qs@6.7.0?package-id=48756c534af1cb28","name":"qs","version":"6.7.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-h7rp-cf8h-j98x","dataSource":"https://github.com/advisories/GHSA-h7rp-cf8h-j98x","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x"],"description":"Electron: Context isolation bypass via Function.prototype.bind hijack","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70601","epss":0.00285,"percentile":0.2109,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70601","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.9"],"state":"fixed","available":[{"version":"39.8.9","date":"2026-08-05","kind":"first-observed"}]},"advisories":[],"risk":0.21375},"relatedVulnerabilities":[{"id":"CVE-2026-70601","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70601","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via contextBridge, the standard pattern for wrapping ipcRenderer.invoke, in windows that load untrusted content. This issue is fixed in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":2.3,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70601","epss":0.00285,"percentile":0.2109,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70601","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-h7rp-cf8h-j98x","versionConstraint":"<39.8.9 (semantic)"},"fix":{"suggestedVersion":"39.8.9"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-06-29","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.13.1"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":"<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.13.1?package-id=d33db3c848bbbd0c","name":"js-yaml","version":"3.13.1","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.13.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-06-29","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":"<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=7f4e23ed36f92339","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-06-29","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.6.1"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":"<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.6.1?package-id=30d141a9595f949a","name":"js-yaml","version":"3.6.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.6.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h67p-54hq-rp68","dataSource":"https://github.com/advisories/GHSA-h67p-54hq-rp68","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550"],"description":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.15.0"],"state":"fixed","available":[{"version":"3.15.0","date":"2026-06-29","kind":"first-observed"}]},"advisories":[],"risk":0.21372500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-53550","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"],"description":"js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53550","epss":0.00415,"percentile":0.35875,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53550","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.7.0"}},"found":{"vulnerabilityID":"GHSA-h67p-54hq-rp68","versionConstraint":"<3.15.0 (semantic)"},"fix":{"suggestedVersion":"3.15.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.7.0?package-id=a0f85ddb9679f590","name":"js-yaml","version":"3.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rj75-hqrm-r3gf","dataSource":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf","https://nvd.nist.gov/vuln/detail/CVE-2026-104844","https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/pull/346","https://github.com/postcss/postcss-selector-parser/commit/70b0779c843462197380d25daa02d1528bf7eae5","https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.5"],"description":"PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.1.5"],"state":"fixed","available":[{"version":"6.1.5","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0.212005},"relatedVulnerabilities":[{"id":"CVE-2026-104844","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104844","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf"],"description":"PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss-selector-parser","version":"2.2.3"}},"found":{"vulnerabilityID":"GHSA-rj75-hqrm-r3gf","versionConstraint":"<6.1.5 (semantic)"},"fix":{"suggestedVersion":"6.1.5"}}],"artifact":{"id":"pkg:npm/postcss-selector-parser@2.2.3?package-id=aba6ad86ffe2541c","name":"postcss-selector-parser","version":"2.2.3","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:2.2.3:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:2.2.3:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:2.2.3:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:2.2.3:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:2.2.3:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:2.2.3:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:2.2.3:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:2.2.3:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:2.2.3:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:2.2.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/postcss-selector-parser@2.2.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-9ppj-qmqm-q256","dataSource":"https://github.com/advisories/GHSA-9ppj-qmqm-q256","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256","https://nvd.nist.gov/vuln/detail/CVE-2026-31802","https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad"],"description":"node-tar Symlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.11"],"state":"fixed","available":[{"version":"7.5.11","date":"2026-03-11","kind":"first-observed"}]},"advisories":[],"risk":0.21116500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-31802","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31802","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad","https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-9ppj-qmqm-q256","versionConstraint":"<=7.5.10 (semantic)"},"fix":{"suggestedVersion":"7.5.11"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-9ppj-qmqm-q256","dataSource":"https://github.com/advisories/GHSA-9ppj-qmqm-q256","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256","https://nvd.nist.gov/vuln/detail/CVE-2026-31802","https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad"],"description":"node-tar Symlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.11"],"state":"fixed","available":[{"version":"7.5.11","date":"2026-03-11","kind":"first-observed"}]},"advisories":[],"risk":0.21116500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-31802","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31802","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad","https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-9ppj-qmqm-q256","versionConstraint":"<=7.5.10 (semantic)"},"fix":{"suggestedVersion":"7.5.11"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-9ppj-qmqm-q256","dataSource":"https://github.com/advisories/GHSA-9ppj-qmqm-q256","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256","https://nvd.nist.gov/vuln/detail/CVE-2026-31802","https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad"],"description":"node-tar Symlink Path Traversal via Drive-Relative Linkpath","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.11"],"state":"fixed","available":[{"version":"7.5.11","date":"2026-03-11","kind":"first-observed"}]},"advisories":[],"risk":0.21116500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-31802","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31802","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad","https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256"],"description":"node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31802","epss":0.00269,"percentile":0.19059,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31802","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-9ppj-qmqm-q256","versionConstraint":"<=7.5.10 (semantic)"},"fix":{"suggestedVersion":"7.5.11"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-9f6g-j8ch-79g4","dataSource":"https://github.com/advisories/GHSA-9f6g-j8ch-79g4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/expressjs/morgan/security/advisories/GHSA-9f6g-j8ch-79g4","https://nvd.nist.gov/vuln/detail/CVE-2026-87859","https://github.com/expressjs/morgan/commit/4b695edf967ce179cdf4009fe8cddd184b7511ee","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/morgan/releases/tag/1.12.1"],"description":"morgan vulnerable to Log Injection via unescaped double quote in quoted log fields","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87859","epss":0.0041,"percentile":0.35297,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87859","cwe":"CWE-117","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.12.1"],"state":"fixed","available":[{"version":"1.12.1","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.21115},"relatedVulnerabilities":[{"id":"CVE-2026-87859","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87859","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/morgan/security/advisories/GHSA-9f6g-j8ch-79g4"],"description":"morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value written to a quoted field, such as the User-Agent or Referer header, can include a double quote to close that field early, so a log consumer that parses the log by field position reads attacker-supplied text as the following field. In the built-in formats this makes the recorded value differ from the value that was sent, and in custom formats that quote an attacker-controlled token before a server-controlled one it can forge values such as the response status. No newline is injected, so record separation stays intact. The issue is fixed in morgan 1.12.1, which escapes the double quote. Users should upgrade to morgan 1.12.1 or later.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87859","epss":0.0041,"percentile":0.35297,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-87859","cwe":"CWE-117","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"morgan","version":"1.10.0"}},"found":{"vulnerabilityID":"GHSA-9f6g-j8ch-79g4","versionConstraint":"<1.12.1 (semantic)"},"fix":{"suggestedVersion":"1.12.1"}}],"artifact":{"id":"pkg:npm/morgan@1.10.0?package-id=63435b8f8473d873","name":"morgan","version":"1.10.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:morgan_project:morgan:1.10.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/morgan@1.10.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-cm22-4g7w-348p","dataSource":"https://github.com/advisories/GHSA-cm22-4g7w-348p","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p","https://nvd.nist.gov/vuln/detail/CVE-2024-43800","https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b","https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa"],"description":"serve-static vulnerable to template injection that can lead to XSS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43800","epss":0.00631,"percentile":0.50257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43800","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.0"],"state":"fixed","available":[{"version":"1.16.0","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.2098075},"relatedVulnerabilities":[{"id":"CVE-2024-43800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43800","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b","https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa","https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p"],"description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43800","epss":0.00631,"percentile":0.50257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43800","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serve-static","version":"1.14.1"}},"found":{"vulnerabilityID":"GHSA-cm22-4g7w-348p","versionConstraint":"<1.16.0 (semantic)"},"fix":{"suggestedVersion":"1.16.0"}}],"artifact":{"id":"pkg:npm/serve-static@1.14.1?package-id=1669a2eea689303d","name":"serve-static","version":"1.14.1","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:serve-static:serve-static:1.14.1:*:*:*:*:*:*:*","cpe:2.3:a:serve-static:serve_static:1.14.1:*:*:*:*:*:*:*","cpe:2.3:a:serve_static:serve-static:1.14.1:*:*:*:*:*:*:*","cpe:2.3:a:serve_static:serve_static:1.14.1:*:*:*:*:*:*:*","cpe:2.3:a:serve:serve-static:1.14.1:*:*:*:*:*:*:*","cpe:2.3:a:serve:serve_static:1.14.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/serve-static@1.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-cm22-4g7w-348p","dataSource":"https://github.com/advisories/GHSA-cm22-4g7w-348p","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p","https://nvd.nist.gov/vuln/detail/CVE-2024-43800","https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b","https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa"],"description":"serve-static vulnerable to template injection that can lead to XSS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43800","epss":0.00631,"percentile":0.50257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43800","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.16.0"],"state":"fixed","available":[{"version":"1.16.0","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.2098075},"relatedVulnerabilities":[{"id":"CVE-2024-43800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43800","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b","https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa","https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p"],"description":"serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43800","epss":0.00631,"percentile":0.50257,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43800","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"serve-static","version":"1.15.0"}},"found":{"vulnerabilityID":"GHSA-cm22-4g7w-348p","versionConstraint":"<1.16.0 (semantic)"},"fix":{"suggestedVersion":"1.16.0"}}],"artifact":{"id":"pkg:npm/serve-static@1.15.0?package-id=ace0fd542a02f99a","name":"serve-static","version":"1.15.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:serve-static:serve-static:1.15.0:*:*:*:*:*:*:*","cpe:2.3:a:serve-static:serve_static:1.15.0:*:*:*:*:*:*:*","cpe:2.3:a:serve_static:serve-static:1.15.0:*:*:*:*:*:*:*","cpe:2.3:a:serve_static:serve_static:1.15.0:*:*:*:*:*:*:*","cpe:2.3:a:serve:serve-static:1.15.0:*:*:*:*:*:*:*","cpe:2.3:a:serve:serve_static:1.15.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/serve-static@1.15.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"3.3.2"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@3.3.2?package-id=8982b2d18e2afd96","name":"uuid","version":"3.3.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:uuidjs:uuid:3.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@3.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5hq-g745-h8pq","dataSource":"https://github.com/advisories/GHSA-w5hq-g745-h8pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq","https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34","https://github.com/uuidjs/uuid/releases/tag/v14.0.0","https://nvd.nist.gov/vuln/detail/CVE-2026-41907","https://github.com/uuidjs/uuid/commit/32389c887c9e75f90442ee4cc95bbab0c4e8346e","https://github.com/uuidjs/uuid/commit/3d61d6ac1f782cf6b1dd8661c60f11722cd49a0d","https://github.com/uuidjs/uuid/commit/9d27ddf7046ce496ef39569ff84d948eeff9cb2a","https://github.com/uuidjs/uuid/releases/tag/v11.1.1","https://github.com/uuidjs/uuid/releases/tag/v12.0.1","https://github.com/uuidjs/uuid/releases/tag/v13.0.1"],"description":"uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.1.1"],"state":"fixed","available":[{"version":"11.1.1","date":"2026-05-05","kind":"first-observed"}]},"advisories":[],"risk":0.20825000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-41907","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41907","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq"],"description":"uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41907","epss":0.0035,"percentile":0.28636,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41907","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41907","cwe":"CWE-823","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"uuid","version":"3.4.0"}},"found":{"vulnerabilityID":"GHSA-w5hq-g745-h8pq","versionConstraint":"<11.1.1 (semantic)"},"fix":{"suggestedVersion":"11.1.1"}}],"artifact":{"id":"pkg:npm/uuid@3.4.0?package-id=1a43dd05f36c1ec7","name":"uuid","version":"3.4.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:uuidjs:uuid:3.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/uuid@3.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jxfw-x594-9x9m","dataSource":"https://github.com/advisories/GHSA-jxfw-x594-9x9m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/expressjs/morgan/security/advisories/GHSA-jxfw-x594-9x9m","https://nvd.nist.gov/vuln/detail/CVE-2026-15603","https://github.com/expressjs/morgan/commit/fbf93833186920cc39bb19b247e4a86b61bef4fe","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/morgan/releases/tag/1.12.0"],"description":"morgan vulnerable to Log Forging via unescaped Unicode line separators","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-15603","epss":0.00397,"percentile":0.3396,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-15603","cwe":"CWE-117","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.12.0"],"state":"fixed","available":[{"version":"1.12.0","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.204455},"relatedVulnerabilities":[{"id":"CVE-2026-15603","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15603","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/morgan/security/advisories/GHSA-jxfw-x594-9x9m"],"description":"morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can place these characters in an attacker-controlled log token, for example a Basic auth username surfaced through the remote-user token, so that Unicode-aware downstream log processing splits a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078, which only addressed ASCII control characters. The issue is fixed in morgan 1.12.0, which extends the escaping set to cover these Unicode line separators. Upgrade to morgan 1.12.0 to remediate.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-15603","epss":0.00397,"percentile":0.3396,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-15603","cwe":"CWE-117","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"morgan","version":"1.10.0"}},"found":{"vulnerabilityID":"GHSA-jxfw-x594-9x9m","versionConstraint":"<1.12.0 (semantic)"},"fix":{"suggestedVersion":"1.12.0"}}],"artifact":{"id":"pkg:npm/morgan@1.10.0?package-id=63435b8f8473d873","name":"morgan","version":"1.10.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:morgan_project:morgan:1.10.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/morgan@1.10.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.11.0"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.11.0?package-id=d6d772e2b709ec9c","name":"qs","version":"6.11.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.11.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.11.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.11.2"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.11.2?package-id=71e0f1d535ab1430","name":"qs","version":"6.11.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.11.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.11.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.7.0"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.7.0?package-id=48756c534af1cb28","name":"qs","version":"6.7.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6v5v-wf23-fmfq","dataSource":"https://github.com/advisories/GHSA-6v5v-wf23-fmfq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"description":"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48988","epss":0.00379,"percentile":0.31865,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.2.0"],"state":"fixed","available":[{"version":"14.2.0","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.195185},"relatedVulnerabilities":[{"id":"CVE-2026-48988","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48988","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/commit/9ce2087562c45d1e5ddd9f76b990f4b3fbe040e5","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-6v5v-wf23-fmfq"],"description":"markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typographer is disabled by default, many production apps enable it for smart typography, making the issue relevant. This issue has been fixed in version 14.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48988","epss":0.00379,"percentile":0.31865,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48988","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"8.4.2"}},"found":{"vulnerabilityID":"GHSA-6v5v-wf23-fmfq","versionConstraint":"<=14.1.1 (semantic)"},"fix":{"suggestedVersion":"14.2.0"}}],"artifact":{"id":"pkg:npm/markdown-it@8.4.2?package-id=26992563bba8d2e3","name":"markdown-it","version":"8.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:8.4.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@8.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-f23m-r3pf-42rh","dataSource":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950"],"description":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":0.193775},"relatedVulnerabilities":[{"id":"CVE-2026-2950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-f23m-r3pf-42rh","versionConstraint":"<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@2.4.2?package-id=7a6b48925eb51c59","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-f23m-r3pf-42rh","dataSource":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950"],"description":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":0.193775},"relatedVulnerabilities":[{"id":"CVE-2026-2950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-f23m-r3pf-42rh","versionConstraint":"<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=ba9b218e488409eb","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-f23m-r3pf-42rh","dataSource":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950"],"description":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":0.193775},"relatedVulnerabilities":[{"id":"CVE-2026-2950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-f23m-r3pf-42rh","versionConstraint":"<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=c54a61e75e4999c4","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-f23m-r3pf-42rh","dataSource":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950"],"description":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":0.193775},"relatedVulnerabilities":[{"id":"CVE-2026-2950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.20"}},"found":{"vulnerabilityID":"GHSA-f23m-r3pf-42rh","versionConstraint":"<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.20?package-id=018753b8823e0ec7","name":"lodash","version":"4.17.20","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.20:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.20","upstreams":[]}},{"vulnerability":{"id":"GHSA-f23m-r3pf-42rh","dataSource":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950"],"description":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":0.193775},"relatedVulnerabilities":[{"id":"CVE-2026-2950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh"],"description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00337,"percentile":0.27173,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.21"}},"found":{"vulnerabilityID":"GHSA-f23m-r3pf-42rh","versionConstraint":"<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"pkg:npm/lodash@4.17.21?package-id=cb6dfff11809ad1e","name":"lodash","version":"4.17.21","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.21","upstreams":[]}},{"vulnerability":{"id":"GHSA-gr2m-v5gq-v685","dataSource":"https://github.com/advisories/GHSA-gr2m-v5gq-v685","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685","https://github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2","https://github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d","https://github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886","https://github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a","https://github.com/electron/electron/releases/tag/v41.10.6","https://github.com/electron/electron/releases/tag/v42.9.2","https://github.com/electron/electron/releases/tag/v43.4.1","https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"],"description":"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102674","epss":0.00236,"percentile":0.14585,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102674","cwe":"CWE-266","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102674","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["41.10.6"],"state":"fixed","available":[{"version":"41.10.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.18525999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-102674","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102674","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2","https://github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d","https://github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886","https://github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a","https://github.com/electron/electron/releases/tag/v41.10.6","https://github.com/electron/electron/releases/tag/v42.9.2","https://github.com/electron/electron/releases/tag/v43.4.1","https://github.com/electron/electron/releases/tag/v44.0.0-beta.5","https://github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102674","epss":0.00236,"percentile":0.14585,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102674","cwe":"CWE-266","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102674","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-gr2m-v5gq-v685","versionConstraint":"<41.10.6 (semantic)"},"fix":{"suggestedVersion":"41.10.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-gvwx-54wh-qm9j","dataSource":"https://github.com/advisories/GHSA-gvwx-54wh-qm9j","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j","https://nvd.nist.gov/vuln/detail/CVE-2026-59875","https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17"],"description":"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.17"],"state":"fixed","available":[{"version":"7.5.17","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.18231000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-59875","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59875","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17","https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-gvwx-54wh-qm9j","versionConstraint":"<=7.5.16 (semantic)"},"fix":{"suggestedVersion":"7.5.17"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-gvwx-54wh-qm9j","dataSource":"https://github.com/advisories/GHSA-gvwx-54wh-qm9j","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j","https://nvd.nist.gov/vuln/detail/CVE-2026-59875","https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17"],"description":"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.17"],"state":"fixed","available":[{"version":"7.5.17","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.18231000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-59875","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59875","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17","https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-gvwx-54wh-qm9j","versionConstraint":"<=7.5.16 (semantic)"},"fix":{"suggestedVersion":"7.5.17"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-gvwx-54wh-qm9j","dataSource":"https://github.com/advisories/GHSA-gvwx-54wh-qm9j","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j","https://nvd.nist.gov/vuln/detail/CVE-2026-59875","https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17"],"description":"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.17"],"state":"fixed","available":[{"version":"7.5.17","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.18231000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-59875","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59875","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3","https://github.com/isaacs/node-tar/releases/tag/v7.5.17","https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j"],"description":"node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59875","epss":0.00354,"percentile":0.29162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59875","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-gvwx-54wh-qm9j","versionConstraint":"<=7.5.16 (semantic)"},"fix":{"suggestedVersion":"7.5.17"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-w7fw-mjwx-w883","dataSource":"https://github.com/advisories/GHSA-w7fw-mjwx-w883","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://nvd.nist.gov/vuln/detail/CVE-2026-2391","https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482"],"description":"qs's arrayLimit bypass in comma parsing allows denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00542,"percentile":0.45587,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.2"],"state":"fixed","available":[{"version":"6.14.2","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.18157},"relatedVulnerabilities":[{"id":"CVE-2026-2391","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2391","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883"],"description":"### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.\n\n**Vulnerable code** (lib/parse.js: lines ~40-50):\n```js\nif (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {\n    return val.split(',');\n}\n\nif (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {\n    throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');\n}\n\nreturn val;\n```\nThe `split(',')` returns the array immediately, skipping the subsequent limit check. Downstream merging via `utils.combine` does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., `?param=,,,,,,,,...`), allocating massive arrays in memory without triggering limits. It bypasses the intent of `arrayLimit`, which is enforced correctly for indexed (`a[0]=`) and bracket (`a[]=`) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).\n\n### PoC\n**Test 1 - Basic bypass:**\n```\nnpm install qs\n```\n\n```js\nconst qs = require('qs');\n\nconst payload = 'a=' + ','.repeat(25);  // 26 elements after split (bypasses arrayLimit: 5)\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\n\ntry {\n  const result = qs.parse(payload, options);\n  console.log(result.a.length);  // Outputs: 26 (bypass successful)\n} catch (e) {\n  console.log('Limit enforced:', e.message);  // Not thrown\n}\n```\n**Configuration:**\n- `comma: true`\n- `arrayLimit: 5`\n- `throwOnLimitExceeded: true`\n\nExpected: Throws \"Array limit exceeded\" error.\nActual: Parses successfully, creating an array of length 26.\n\n\n### Impact\nDenial of Service (DoS) via memory exhaustion.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00542,"percentile":0.45587,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.11.0"}},"found":{"vulnerabilityID":"GHSA-w7fw-mjwx-w883","versionConstraint":">=6.7.0,<=6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.2"}}],"artifact":{"id":"pkg:npm/qs@6.11.0?package-id=d6d772e2b709ec9c","name":"qs","version":"6.11.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.11.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.11.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-w7fw-mjwx-w883","dataSource":"https://github.com/advisories/GHSA-w7fw-mjwx-w883","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://nvd.nist.gov/vuln/detail/CVE-2026-2391","https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482"],"description":"qs's arrayLimit bypass in comma parsing allows denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00542,"percentile":0.45587,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.2"],"state":"fixed","available":[{"version":"6.14.2","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.18157},"relatedVulnerabilities":[{"id":"CVE-2026-2391","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2391","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883"],"description":"### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.\n\n**Vulnerable code** (lib/parse.js: lines ~40-50):\n```js\nif (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {\n    return val.split(',');\n}\n\nif (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {\n    throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');\n}\n\nreturn val;\n```\nThe `split(',')` returns the array immediately, skipping the subsequent limit check. Downstream merging via `utils.combine` does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., `?param=,,,,,,,,...`), allocating massive arrays in memory without triggering limits. It bypasses the intent of `arrayLimit`, which is enforced correctly for indexed (`a[0]=`) and bracket (`a[]=`) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).\n\n### PoC\n**Test 1 - Basic bypass:**\n```\nnpm install qs\n```\n\n```js\nconst qs = require('qs');\n\nconst payload = 'a=' + ','.repeat(25);  // 26 elements after split (bypasses arrayLimit: 5)\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\n\ntry {\n  const result = qs.parse(payload, options);\n  console.log(result.a.length);  // Outputs: 26 (bypass successful)\n} catch (e) {\n  console.log('Limit enforced:', e.message);  // Not thrown\n}\n```\n**Configuration:**\n- `comma: true`\n- `arrayLimit: 5`\n- `throwOnLimitExceeded: true`\n\nExpected: Throws \"Array limit exceeded\" error.\nActual: Parses successfully, creating an array of length 26.\n\n\n### Impact\nDenial of Service (DoS) via memory exhaustion.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00542,"percentile":0.45587,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.11.2"}},"found":{"vulnerabilityID":"GHSA-w7fw-mjwx-w883","versionConstraint":">=6.7.0,<=6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.2"}}],"artifact":{"id":"pkg:npm/qs@6.11.2?package-id=71e0f1d535ab1430","name":"qs","version":"6.11.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.11.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.11.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-w7fw-mjwx-w883","dataSource":"https://github.com/advisories/GHSA-w7fw-mjwx-w883","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://nvd.nist.gov/vuln/detail/CVE-2026-2391","https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482"],"description":"qs's arrayLimit bypass in comma parsing allows denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00542,"percentile":0.45587,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.2"],"state":"fixed","available":[{"version":"6.14.2","date":"2026-03-04","kind":"first-observed"}]},"advisories":[],"risk":0.18157},"relatedVulnerabilities":[{"id":"CVE-2026-2391","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2391","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883"],"description":"### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.\n\n**Vulnerable code** (lib/parse.js: lines ~40-50):\n```js\nif (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {\n    return val.split(',');\n}\n\nif (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {\n    throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');\n}\n\nreturn val;\n```\nThe `split(',')` returns the array immediately, skipping the subsequent limit check. Downstream merging via `utils.combine` does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., `?param=,,,,,,,,...`), allocating massive arrays in memory without triggering limits. It bypasses the intent of `arrayLimit`, which is enforced correctly for indexed (`a[0]=`) and bracket (`a[]=`) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).\n\n### PoC\n**Test 1 - Basic bypass:**\n```\nnpm install qs\n```\n\n```js\nconst qs = require('qs');\n\nconst payload = 'a=' + ','.repeat(25);  // 26 elements after split (bypasses arrayLimit: 5)\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\n\ntry {\n  const result = qs.parse(payload, options);\n  console.log(result.a.length);  // Outputs: 26 (bypass successful)\n} catch (e) {\n  console.log('Limit enforced:', e.message);  // Not thrown\n}\n```\n**Configuration:**\n- `comma: true`\n- `arrayLimit: 5`\n- `throwOnLimitExceeded: true`\n\nExpected: Throws \"Array limit exceeded\" error.\nActual: Parses successfully, creating an array of length 26.\n\n\n### Impact\nDenial of Service (DoS) via memory exhaustion.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00542,"percentile":0.45587,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.7.0"}},"found":{"vulnerabilityID":"GHSA-w7fw-mjwx-w883","versionConstraint":">=6.7.0,<=6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.2"}}],"artifact":{"id":"pkg:npm/qs@6.7.0?package-id=48756c534af1cb28","name":"qs","version":"6.7.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jjp3-mq3x-295m","dataSource":"https://github.com/advisories/GHSA-jjp3-mq3x-295m","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-jjp3-mq3x-295m","https://nvd.nist.gov/vuln/detail/CVE-2026-34770"],"description":"Electron: Use-after-free in PowerMonitor on Windows and macOS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34770","epss":0.00249,"percentile":0.16303,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34770","cwe":"CWE-416","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.180525},"relatedVulnerabilities":[{"id":"CVE-2026-34770","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34770","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-jjp3-mq3x-295m"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption. All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34770","epss":0.00249,"percentile":0.16303,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34770","cwe":"CWE-416","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-jjp3-mq3x-295m","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-m6fv-jmcg-4jfg","dataSource":"https://github.com/advisories/GHSA-m6fv-jmcg-4jfg","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg","https://nvd.nist.gov/vuln/detail/CVE-2024-43799","https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35","https://lists.debian.org/debian-lts-announce/2025/06/msg00022.html"],"description":"send vulnerable to template injection that can lead to XSS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43799","epss":0.00541,"percentile":0.45548,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43799","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.19.0"],"state":"fixed","available":[{"version":"0.19.0","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.1798825},"relatedVulnerabilities":[{"id":"CVE-2024-43799","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43799","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35","https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg","https://lists.debian.org/debian-lts-announce/2025/06/msg00022.html"],"description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43799","epss":0.00541,"percentile":0.45548,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43799","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"send","version":"0.17.1"}},"found":{"vulnerabilityID":"GHSA-m6fv-jmcg-4jfg","versionConstraint":"<0.19.0 (semantic)"},"fix":{"suggestedVersion":"0.19.0"}}],"artifact":{"id":"pkg:npm/send@0.17.1?package-id=1c36c571e046ddc3","name":"send","version":"0.17.1","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:send_project:send:0.17.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/send@0.17.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-m6fv-jmcg-4jfg","dataSource":"https://github.com/advisories/GHSA-m6fv-jmcg-4jfg","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg","https://nvd.nist.gov/vuln/detail/CVE-2024-43799","https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35","https://lists.debian.org/debian-lts-announce/2025/06/msg00022.html"],"description":"send vulnerable to template injection that can lead to XSS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43799","epss":0.00541,"percentile":0.45548,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43799","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.19.0"],"state":"fixed","available":[{"version":"0.19.0","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.1798825},"relatedVulnerabilities":[{"id":"CVE-2024-43799","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43799","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35","https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg","https://lists.debian.org/debian-lts-announce/2025/06/msg00022.html"],"description":"Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43799","epss":0.00541,"percentile":0.45548,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43799","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"send","version":"0.18.0"}},"found":{"vulnerabilityID":"GHSA-m6fv-jmcg-4jfg","versionConstraint":"<0.19.0 (semantic)"},"fix":{"suggestedVersion":"0.19.0"}}],"artifact":{"id":"pkg:npm/send@0.18.0?package-id=1f5bdd958f1007f6","name":"send","version":"0.18.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:send_project:send:0.18.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/send@0.18.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-98mx-cjp9-gchm","dataSource":"https://github.com/advisories/GHSA-98mx-cjp9-gchm","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-98mx-cjp9-gchm","https://nvd.nist.gov/vuln/detail/CVE-2026-113797","https://github.com/electron/electron/pull/52597","https://github.com/electron/electron/pull/53353","https://github.com/electron/electron/pull/53354","https://github.com/electron/electron/pull/53355","https://github.com/electron/electron/pull/53356","https://github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4","https://github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c","https://github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f","https://github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921","https://github.com/electron/electron/commit/f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f","https://github.com/electron/electron/releases/tag/v42.11.1","https://github.com/electron/electron/releases/tag/v43.5.1","https://github.com/electron/electron/releases/tag/v44.1.1","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.4"],"description":"Electron: Extension tabs.query returns tab URLs and titles without the tabs permission","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113797","epss":0.00586,"percentile":0.48005,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113797","cwe":"CWE-862","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["42.11.1"],"state":"fixed","available":[{"version":"42.11.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.17873},"relatedVulnerabilities":[{"id":"CVE-2026-113797","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113797","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4","https://github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c","https://github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f","https://github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921","https://github.com/electron/electron/commit/f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f","https://github.com/electron/electron/pull/52597","https://github.com/electron/electron/pull/53353","https://github.com/electron/electron/pull/53354","https://github.com/electron/electron/pull/53355","https://github.com/electron/electron/pull/53356","https://github.com/electron/electron/releases/tag/v42.11.1","https://github.com/electron/electron/releases/tag/v43.5.1","https://github.com/electron/electron/releases/tag/v44.1.1","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.4","https://github.com/electron/electron/security/advisories/GHSA-98mx-cjp9-gchm"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions that had neither the tabs permission nor matching host permissions. An application that loaded an extension it did not fully trust through session.extensions.loadExtension could therefore allow that extension to read the URL and title of every webContents in its session. This issue is fixed in versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113797","epss":0.00586,"percentile":0.48005,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113797","cwe":"CWE-862","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-98mx-cjp9-gchm","versionConstraint":"<42.11.1 (semantic)"},"fix":{"suggestedVersion":"42.11.1"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-73rr-hh4g-fpgx","dataSource":"https://github.com/advisories/GHSA-73rr-hh4g-fpgx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://nvd.nist.gov/vuln/detail/CVE-2026-24001"],"description":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["3.5.1"],"state":"fixed","available":[{"version":"3.5.1","date":"2026-01-31","kind":"first-observed"}]},"advisories":[],"risk":0.17556000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-24001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://access.redhat.com/security/cve/CVE-2026-24001","https://bugzilla.redhat.com/show_bug.cgi?id=2431930","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24001.json"],"description":"jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its \"leading garbage\"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\\r`, `\\u2028`, or `\\u2029`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"diff","version":"3.5.0"}},"found":{"vulnerabilityID":"GHSA-73rr-hh4g-fpgx","versionConstraint":"<3.5.1 (semantic)"},"fix":{"suggestedVersion":"3.5.1"}}],"artifact":{"id":"pkg:npm/diff@3.5.0?package-id=049d9e37932e37a5","name":"diff","version":"3.5.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:kpdecker:jsdiff:3.5.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/diff@3.5.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-73rr-hh4g-fpgx","dataSource":"https://github.com/advisories/GHSA-73rr-hh4g-fpgx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://nvd.nist.gov/vuln/detail/CVE-2026-24001"],"description":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.0.4"],"state":"fixed","available":[{"version":"4.0.4","date":"2026-01-21","kind":"first-observed"}]},"advisories":[],"risk":0.17556000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-24001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://access.redhat.com/security/cve/CVE-2026-24001","https://bugzilla.redhat.com/show_bug.cgi?id=2431930","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24001.json"],"description":"jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its \"leading garbage\"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\\r`, `\\u2028`, or `\\u2029`.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.00616,"percentile":0.49546,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"diff","version":"4.0.2"}},"found":{"vulnerabilityID":"GHSA-73rr-hh4g-fpgx","versionConstraint":">=4.0.0,<4.0.4 (semantic)"},"fix":{"suggestedVersion":"4.0.4"}}],"artifact":{"id":"pkg:npm/diff@4.0.2?package-id=bb8428a490f4bdda","name":"diff","version":"4.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:kpdecker:jsdiff:4.0.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/diff@4.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xwr5-m59h-vwqr","dataSource":"https://github.com/advisories/GHSA-xwr5-m59h-vwqr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr","https://nvd.nist.gov/vuln/detail/CVE-2026-34775"],"description":"Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34775","epss":0.00294,"percentile":0.22034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34775","cwe":"CWE-653","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.17345999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-34775","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34775","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/electron/electron/security/advisories/GHSA-xwr5-m59h-vwqr"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34775","epss":0.00294,"percentile":0.22034,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34775","cwe":"CWE-653","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-xwr5-m59h-vwqr","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"0.3.0"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@0.3.0?package-id=b5eda2de6c0adccc","name":"minimatch","version":"0.3.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:0.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@0.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=c0db5736107463f9","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=70a0bfe47d5139e6","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.4"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.0.4?package-id=6c204b89569ec56b","name":"minimatch","version":"3.0.4","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.2?package-id=ad726dd19b0b9889","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-v64r-4m7r-3mvq","dataSource":"https://github.com/advisories/GHSA-v64r-4m7r-3mvq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq"],"description":"Electron: HTTP redirect followed into local file loader","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70605","epss":0.00315,"percentile":0.24436,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70605","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.8"],"state":"fixed","available":[{"version":"39.8.8","date":"2026-08-05","kind":"first-observed"}]},"advisories":[],"risk":0.17167500000000002},"relatedVulnerabilities":[{"id":"CVE-2026-70605","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70605","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70605","epss":0.00315,"percentile":0.24436,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70605","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-v64r-4m7r-3mvq","versionConstraint":"<39.8.8 (semantic)"},"fix":{"suggestedVersion":"39.8.8"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-4vj7-5mj6-jm8m","dataSource":"https://github.com/advisories/GHSA-4vj7-5mj6-jm8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m","https://nvd.nist.gov/vuln/detail/CVE-2026-5078","https://cna.openjsf.org/security-advisories.html"],"description":"morgan vulnerable to Log Forging via unneutralized control characters in :remote-user","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-5078","epss":0.00332,"percentile":0.26454,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-5078","cwe":"CWE-117","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.11.0"],"state":"fixed","available":[{"version":"1.11.0","date":"2026-07-10","kind":"first-observed"}]},"advisories":[],"risk":0.17098},"relatedVulnerabilities":[{"id":"CVE-2026-5078","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5078","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m"],"description":"Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-5078","epss":0.00332,"percentile":0.26454,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-5078","cwe":"CWE-117","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"morgan","version":"1.10.0"}},"found":{"vulnerabilityID":"GHSA-4vj7-5mj6-jm8m","versionConstraint":">=1.2.0,<=1.10.1 (semantic)"},"fix":{"suggestedVersion":"1.11.0"}}],"artifact":{"id":"pkg:npm/morgan@1.10.0?package-id=63435b8f8473d873","name":"morgan","version":"1.10.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:morgan_project:morgan:1.10.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/morgan@1.10.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f3pv-wv63-48x8","dataSource":"https://github.com/advisories/GHSA-f3pv-wv63-48x8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8","https://github.com/electron/electron/releases/tag/v39.8.5","https://github.com/electron/electron/releases/tag/v40.8.5","https://github.com/electron/electron/releases/tag/v41.1.0","https://github.com/electron/electron/releases/tag/v42.0.0-alpha.5","https://nvd.nist.gov/vuln/detail/CVE-2026-34765"],"description":"Electron: Named window.open targets not scoped to the opener's browsing context","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6,"exploitabilityScore":1.8,"impactScore":3.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34765","epss":0.003,"percentile":0.22696,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34765","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.5"],"state":"fixed","available":[{"version":"39.8.5","date":"2026-04-07","kind":"first-observed"}]},"advisories":[],"risk":0.165},"relatedVulnerabilities":[{"id":"CVE-2026-34765","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34765","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6,"exploitabilityScore":1.8,"impactScore":3.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34765","epss":0.003,"percentile":0.22696,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34765","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-f3pv-wv63-48x8","versionConstraint":"<39.8.5 (semantic)"},"fix":{"suggestedVersion":"39.8.5"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-qw6h-vgh9-j6wx","dataSource":"https://github.com/advisories/GHSA-qw6h-vgh9-j6wx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx","https://nvd.nist.gov/vuln/detail/CVE-2024-43796","https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553"],"description":"express vulnerable to XSS via response.redirect()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43796","epss":0.00486,"percentile":0.41882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43796","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.20.0"],"state":"fixed","available":[{"version":"4.20.0","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.161595},"relatedVulnerabilities":[{"id":"CVE-2024-43796","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43796","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553","https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx"],"description":"Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43796","epss":0.00486,"percentile":0.41882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43796","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"express","version":"4.17.0"}},"found":{"vulnerabilityID":"GHSA-qw6h-vgh9-j6wx","versionConstraint":"<4.20.0 (semantic)"},"fix":{"suggestedVersion":"4.20.0"}}],"artifact":{"id":"pkg:npm/express@4.17.0?package-id=c8eeb28a79af5142","name":"express","version":"4.17.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:express:4.17.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/express@4.17.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qw6h-vgh9-j6wx","dataSource":"https://github.com/advisories/GHSA-qw6h-vgh9-j6wx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx","https://nvd.nist.gov/vuln/detail/CVE-2024-43796","https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553"],"description":"express vulnerable to XSS via response.redirect()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43796","epss":0.00486,"percentile":0.41882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43796","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.20.0"],"state":"fixed","available":[{"version":"4.20.0","date":"2024-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.161595},"relatedVulnerabilities":[{"id":"CVE-2024-43796","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-43796","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553","https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx"],"description":"Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-43796","epss":0.00486,"percentile":0.41882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-43796","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"express","version":"4.18.2"}},"found":{"vulnerabilityID":"GHSA-qw6h-vgh9-j6wx","versionConstraint":"<4.20.0 (semantic)"},"fix":{"suggestedVersion":"4.20.0"}}],"artifact":{"id":"pkg:npm/express@4.18.2?package-id=0e91afbebe92fb67","name":"express","version":"4.18.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:express:4.18.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/express@4.18.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-j84w-jfhq-vhvj","dataSource":"https://github.com/advisories/GHSA-j84w-jfhq-vhvj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj","https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d","https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d","https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397","https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2","https://github.com/electron/electron/releases/tag/v41.10.6","https://github.com/electron/electron/releases/tag/v42.9.2","https://github.com/electron/electron/releases/tag/v43.4.1","https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"],"description":"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102675","epss":0.00214,"percentile":0.11751,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102675","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["41.10.6"],"state":"fixed","available":[{"version":"41.10.6","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.15943},"relatedVulnerabilities":[{"id":"CVE-2026-102675","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102675","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d","https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d","https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397","https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2","https://github.com/electron/electron/releases/tag/v41.10.6","https://github.com/electron/electron/releases/tag/v42.9.2","https://github.com/electron/electron/releases/tag/v43.4.1","https://github.com/electron/electron/releases/tag/v44.0.0-beta.5","https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.9,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102675","epss":0.00214,"percentile":0.11751,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102675","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-j84w-jfhq-vhvj","versionConstraint":"<41.10.6 (semantic)"},"fix":{"suggestedVersion":"41.10.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-vmqv-hx8q-j7mg","dataSource":"https://github.com/advisories/GHSA-vmqv-hx8q-j7mg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg","https://github.com/electron/electron/pull/48101","https://github.com/electron/electron/pull/48102","https://github.com/electron/electron/pull/48103","https://github.com/electron/electron/pull/48104","https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b","https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1","https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d","https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee","https://nvd.nist.gov/vuln/detail/CVE-2025-55305"],"description":"Electron has ASAR Integrity Bypass via resource modification","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.1,"exploitabilityScore":1.4,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-55305","epss":0.00276,"percentile":0.20098,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-55305","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-55305","cwe":"CWE-829","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["35.7.5"],"state":"fixed","available":[{"version":"35.7.5","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":0.15317999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-55305","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55305","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b","https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1","https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d","https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee","https://github.com/electron/electron/pull/48101","https://github.com/electron/electron/pull/48102","https://github.com/electron/electron/pull/48103","https://github.com/electron/electron/pull/48104","https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0, 37.0.0-alpha.1 through 37.3.1 and 38.0.0-alpha.1 through 38.0.0-beta.6, ASAR Integrity Bypass via resource modification. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is fixed in versions 35.7.5, 36.8.1, 37.3.1 and 38.0.0-beta.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.1,"exploitabilityScore":1.4,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-55305","epss":0.00276,"percentile":0.20098,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-55305","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-55305","cwe":"CWE-829","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-vmqv-hx8q-j7mg","versionConstraint":"<35.7.5 (semantic)"},"fix":{"suggestedVersion":"35.7.5"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6h2-p8h4-qcjw","dataSource":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-5889","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717","https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2","https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f","https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e","https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217"],"description":"brace-expansion Regular Expression Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["1.1.12"],"state":"fixed","available":[{"version":"1.1.12","date":"2025-06-12","kind":"first-observed"}]},"advisories":[],"risk":0.15236},"relatedVulnerabilities":[{"id":"CVE-2025-5889","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717"],"description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-v6h2-p8h4-qcjw","versionConstraint":">=1.0.0,<=1.1.11 (semantic)"},"fix":{"suggestedVersion":"1.1.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2b36477cae56122e","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6h2-p8h4-qcjw","dataSource":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-5889","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717","https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2","https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f","https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e","https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217"],"description":"brace-expansion Regular Expression Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["1.1.12"],"state":"fixed","available":[{"version":"1.1.12","date":"2025-06-12","kind":"first-observed"}]},"advisories":[],"risk":0.15236},"relatedVulnerabilities":[{"id":"CVE-2025-5889","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717"],"description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-v6h2-p8h4-qcjw","versionConstraint":">=1.0.0,<=1.1.11 (semantic)"},"fix":{"suggestedVersion":"1.1.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=374d713d4d50aa6f","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6h2-p8h4-qcjw","dataSource":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-5889","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717","https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2","https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f","https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e","https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217"],"description":"brace-expansion Regular Expression Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["1.1.12"],"state":"fixed","available":[{"version":"1.1.12","date":"2025-06-12","kind":"first-observed"}]},"advisories":[],"risk":0.15236},"relatedVulnerabilities":[{"id":"CVE-2025-5889","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717"],"description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-v6h2-p8h4-qcjw","versionConstraint":">=1.0.0,<=1.1.11 (semantic)"},"fix":{"suggestedVersion":"1.1.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=7059a7b443401e23","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-v6h2-p8h4-qcjw","dataSource":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-5889","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717","https://github.com/juliangruber/brace-expansion/commit/0b6a9781e18e9d2769bb2931f4856d1360243ed2","https://github.com/juliangruber/brace-expansion/commit/15f9b3c75ebf5988198241fecaebdc45eff28a9f","https://github.com/juliangruber/brace-expansion/commit/36603d5f3599a37af9e85eda30acd7d28599c36e","https://github.com/juliangruber/brace-expansion/commit/c3c73c8b088defc70851843be88ccc3af08e7217"],"description":"brace-expansion Regular Expression Denial of Service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["1.1.12"],"state":"fixed","available":[{"version":"1.1.12","date":"2025-06-12","kind":"first-observed"}]},"advisories":[],"risk":0.15236},"relatedVulnerabilities":[{"id":"CVE-2025-5889","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5889","namespace":"nvd:cpe","severity":"Low","urls":["https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466","https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5","https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1","https://vuldb.com/?ctiid.311660","https://vuldb.com/?id.311660","https://vuldb.com/?submit.585717"],"description":"A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.3},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":2.1,"exploitabilityScore":4,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-5889","epss":0.00586,"percentile":0.48006,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-5889","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2025-5889","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.11"}},"found":{"vulnerabilityID":"GHSA-v6h2-p8h4-qcjw","versionConstraint":">=1.0.0,<=1.1.11 (semantic)"},"fix":{"suggestedVersion":"1.1.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.11?package-id=2371e2ddff0f5bc0","name":"brace-expansion","version":"1.1.11","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.11:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-m55f-7gqj-fr98","dataSource":"https://github.com/advisories/GHSA-m55f-7gqj-fr98","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-m55f-7gqj-fr98"],"description":"Electron: Extension tab APIs operate across session boundaries","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","metrics":{"baseScore":6.6,"exploitabilityScore":1.4,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70602","epss":0.00256,"percentile":0.17353,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70602","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.8"],"state":"fixed","available":[{"version":"39.8.8","date":"2026-08-05","kind":"first-observed"}]},"advisories":[],"risk":0.14848},"relatedVulnerabilities":[{"id":"CVE-2026-70602","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70602","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-m55f-7gqj-fr98"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","metrics":{"baseScore":6.6,"exploitabilityScore":1.4,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70602","epss":0.00256,"percentile":0.17353,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70602","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-m55f-7gqj-fr98","versionConstraint":"<39.8.8 (semantic)"},"fix":{"suggestedVersion":"39.8.8"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-vfgh-jcmw-g37q","dataSource":"https://github.com/advisories/GHSA-vfgh-jcmw-g37q","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q","https://nvd.nist.gov/vuln/detail/CVE-2026-111766","https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"],"description":"markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111766","epss":0.00428,"percentile":0.37065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111766","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.3.3"],"state":"fixed","available":[{"version":"14.3.3","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.14337999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-111766","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111766","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79","https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503","https://github.com/markdown-it/markdown-it/releases/tag/14.3.3","https://github.com/markdown-it/markdown-it/releases/tag/15.0.3","https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"],"description":"markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111766","epss":0.00428,"percentile":0.37065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111766","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-111766","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"8.4.2"}},"found":{"vulnerabilityID":"GHSA-vfgh-jcmw-g37q","versionConstraint":"<14.3.3 (semantic)"},"fix":{"suggestedVersion":"14.3.3"}}],"artifact":{"id":"pkg:npm/markdown-it@8.4.2?package-id=26992563bba8d2e3","name":"markdown-it","version":"8.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:8.4.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@8.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xw65-4hp5-5hc7","dataSource":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7","https://nvd.nist.gov/vuln/detail/CVE-2026-106444","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"],"description":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106444","epss":0.0029,"percentile":0.21631,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["4.7.10"],"state":"fixed","available":[{"version":"4.7.10","date":"2026-10-09","kind":"first-observed"}]},"advisories":[],"risk":0.14064999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-106444","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106444","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","https://github.com/handlebars-lang/handlebars.js/pull/2185","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7"],"description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-106444","epss":0.0029,"percentile":0.21631,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-106444","cwe":"CWE-116","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.7"}},"found":{"vulnerabilityID":"GHSA-xw65-4hp5-5hc7","versionConstraint":">=4.0.0,<=4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.10"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.7?package-id=94a6b0a915fbcc9f","name":"handlebars","version":"4.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.7:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-v422-hmwv-36x6","dataSource":"https://github.com/advisories/GHSA-v422-hmwv-36x6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6","https://nvd.nist.gov/vuln/detail/CVE-2026-12590","https://github.com/expressjs/body-parser/pull/698","https://github.com/expressjs/body-parser/pull/741","https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d","https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.6","https://github.com/expressjs/body-parser/releases/tag/v2.3.0"],"description":"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.6"],"state":"fixed","available":[{"version":"1.20.6","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.13802},"relatedVulnerabilities":[{"id":"CVE-2026-12590","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12590","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6"],"description":"Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb. Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at startup and reject any configuration where the result is null or a non-finite number.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.19.0"}},"found":{"vulnerabilityID":"GHSA-v422-hmwv-36x6","versionConstraint":"<1.20.6 (semantic)"},"fix":{"suggestedVersion":"1.20.6"}}],"artifact":{"id":"pkg:npm/body-parser@1.19.0?package-id=18bd816c85cff5a3","name":"body-parser","version":"1.19.0","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:body-parser:1.19.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.19.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-v422-hmwv-36x6","dataSource":"https://github.com/advisories/GHSA-v422-hmwv-36x6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6","https://nvd.nist.gov/vuln/detail/CVE-2026-12590","https://github.com/expressjs/body-parser/pull/698","https://github.com/expressjs/body-parser/pull/741","https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d","https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.6","https://github.com/expressjs/body-parser/releases/tag/v2.3.0"],"description":"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.20.6"],"state":"fixed","available":[{"version":"1.20.6","date":"2026-07-21","kind":"first-observed"}]},"advisories":[],"risk":0.13802},"relatedVulnerabilities":[{"id":"CVE-2026-12590","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12590","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6"],"description":"Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb. Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at startup and reject any configuration where the result is null or a non-finite number.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-12590","epss":0.00412,"percentile":0.355,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-12590","cwe":"CWE-770","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"1.20.1"}},"found":{"vulnerabilityID":"GHSA-v422-hmwv-36x6","versionConstraint":"<1.20.6 (semantic)"},"fix":{"suggestedVersion":"1.20.6"}}],"artifact":{"id":"pkg:npm/body-parser@1.20.1?package-id=7f3f0b84d4a020ab","name":"body-parser","version":"1.20.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:body-parser:1.20.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@1.20.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2qvq-rjwj-gvw9","dataSource":"https://github.com/advisories/GHSA-2qvq-rjwj-gvw9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9","https://nvd.nist.gov/vuln/detail/CVE-2021-23369","https://nvd.nist.gov/vuln/detail/CVE-2021-23383","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33916"],"description":"Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33916","epss":0.0028,"percentile":0.20536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33916","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33916","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-27","kind":"first-observed"}]},"advisories":[],"risk":0.1358},"relatedVulnerabilities":[{"id":"CVE-2026-33916","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33916","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9"],"description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype  pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates  and reduces the attack surface.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33916","epss":0.0028,"percentile":0.20536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33916","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33916","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.7"}},"found":{"vulnerabilityID":"GHSA-2qvq-rjwj-gvw9","versionConstraint":">=4.0.0,<4.7.9 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.7?package-id=94a6b0a915fbcc9f","name":"handlebars","version":"4.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.7:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-x562-297c-g43g","dataSource":"https://github.com/advisories/GHSA-x562-297c-g43g","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-x562-297c-g43g","https://nvd.nist.gov/vuln/detail/CVE-2026-113798","https://github.com/electron/electron/pull/54432","https://github.com/electron/electron/pull/54463","https://github.com/electron/electron/pull/54464","https://github.com/electron/electron/pull/54465","https://github.com/electron/electron/pull/54466","https://github.com/electron/electron/commit/076c7496791a45968cf8d9e76e9657bc161ea979","https://github.com/electron/electron/commit/0b680cfa1ffa70a50282da53efde37a210d5223b","https://github.com/electron/electron/commit/1755ee598697356959219beefee1e139bc3f8207","https://github.com/electron/electron/commit/4073e9f4712f61e6b8abd5548673cc7638f6c1a1","https://github.com/electron/electron/commit/a48e6eaaafa85b6fc40f7431ceec4fd6ef4bb899","https://github.com/electron/electron/releases/tag/v42.11.9","https://github.com/electron/electron/releases/tag/v43.7.6","https://github.com/electron/electron/releases/tag/v44.5.0","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.13"],"description":"Electron: Pointer lock permission requests can be attributed to the wrong frame","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113798","epss":0.00244,"percentile":0.1562,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113798","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["42.11.9"],"state":"fixed","available":[{"version":"42.11.9","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.12688},"relatedVulnerabilities":[{"id":"CVE-2026-113798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113798","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/076c7496791a45968cf8d9e76e9657bc161ea979","https://github.com/electron/electron/commit/0b680cfa1ffa70a50282da53efde37a210d5223b","https://github.com/electron/electron/commit/1755ee598697356959219beefee1e139bc3f8207","https://github.com/electron/electron/commit/4073e9f4712f61e6b8abd5548673cc7638f6c1a1","https://github.com/electron/electron/commit/a48e6eaaafa85b6fc40f7431ceec4fd6ef4bb899","https://github.com/electron/electron/pull/54432","https://github.com/electron/electron/pull/54463","https://github.com/electron/electron/pull/54464","https://github.com/electron/electron/pull/54465","https://github.com/electron/electron/pull/54466","https://github.com/electron/electron/releases/tag/v42.11.9","https://github.com/electron/electron/releases/tag/v43.7.6","https://github.com/electron/electron/releases/tag/v44.5.0","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.13","https://github.com/electron/electron/security/advisories/GHSA-x562-297c-g43g"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An application that embeds untrusted iframe content and grants pointer lock based on the requesting origin could therefore grant the permission under the top-level page's identity. Applications that deny pointerLock for untrusted embedded content are not affected. This issue is fixed in versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113798","epss":0.00244,"percentile":0.1562,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113798","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-x562-297c-g43g","versionConstraint":"<42.11.9 (semantic)"},"fix":{"suggestedVersion":"42.11.9"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-fw47-9c62-h3vw","dataSource":"https://github.com/advisories/GHSA-fw47-9c62-h3vw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw","https://github.com/electron/electron/pull/53656","https://github.com/electron/electron/pull/53679","https://github.com/electron/electron/pull/53688","https://github.com/electron/electron/pull/53689","https://github.com/electron/electron/pull/53736","https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a","https://github.com/electron/electron/commit/36042b2e1b1c60c67b05ba0e95d1a34f608b9742","https://github.com/electron/electron/commit/56cc43eb677d46b86b0d3f49b5fba71404ab1ff0","https://github.com/electron/electron/commit/922073f8601479e93071f56f0745041291b206fd","https://github.com/electron/electron/commit/c965cee73284c4b230a81d51a7db6115e55da8c0","https://github.com/electron/electron/releases/tag/v42.11.3","https://github.com/electron/electron/releases/tag/v43.7.0","https://github.com/electron/electron/releases/tag/v44.3.0","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.5"],"description":"Electron: HID and USB permission checks can be attributed to the wrong origin","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113800","epss":0.00241,"percentile":0.15321,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113800","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["42.11.3"],"state":"fixed","available":[{"version":"42.11.3","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.12532},"relatedVulnerabilities":[{"id":"CVE-2026-113800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113800","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a","https://github.com/electron/electron/commit/36042b2e1b1c60c67b05ba0e95d1a34f608b9742","https://github.com/electron/electron/commit/56cc43eb677d46b86b0d3f49b5fba71404ab1ff0","https://github.com/electron/electron/commit/922073f8601479e93071f56f0745041291b206fd","https://github.com/electron/electron/commit/c965cee73284c4b230a81d51a7db6115e55da8c0","https://github.com/electron/electron/pull/53656","https://github.com/electron/electron/pull/53679","https://github.com/electron/electron/pull/53688","https://github.com/electron/electron/pull/53689","https://github.com/electron/electron/pull/53736","https://github.com/electron/electron/releases/tag/v42.11.3","https://github.com/electron/electron/releases/tag/v43.7.0","https://github.com/electron/electron/releases/tag/v44.3.0","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.5","https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and details instead of the requesting frame's. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113800","epss":0.00241,"percentile":0.15321,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113800","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-fw47-9c62-h3vw","versionConstraint":"<42.11.3 (semantic)"},"fix":{"suggestedVersion":"42.11.3"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-mwmh-mq4g-g6gr","dataSource":"https://github.com/advisories/GHSA-mwmh-mq4g-g6gr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-mwmh-mq4g-g6gr","https://nvd.nist.gov/vuln/detail/CVE-2026-34773"],"description":"Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34773","epss":0.00244,"percentile":0.15682,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34773","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34773","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34773","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.11833999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-34773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34773","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-mwmh-mq4g-g6gr"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on Windows, app.setAsDefaultProtocolClient(protocol) did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\\Software\\Classes\\, potentially hijacking existing protocol handlers. Apps are only affected if they call app.setAsDefaultProtocolClient() with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34773","epss":0.00244,"percentile":0.15682,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34773","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34773","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34773","cwe":"CWE-74","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-mwmh-mq4g-g6gr","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-4p4r-m79c-wq3v","dataSource":"https://github.com/advisories/GHSA-4p4r-m79c-wq3v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-4p4r-m79c-wq3v","https://nvd.nist.gov/vuln/detail/CVE-2026-34767"],"description":"Electron: HTTP Response Header Injection in custom protocol handlers and webRequest","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34767","epss":0.00215,"percentile":0.11957,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34767","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34767","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.117175},"relatedVulnerabilities":[{"id":"CVE-2026-34767","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34767","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-4p4r-m79c-wq3v"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3, apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value. An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls. Apps that do not reflect external input into response headers are not affected. This issue has been patched in versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34767","epss":0.00215,"percentile":0.11957,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34767","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34767","cwe":"CWE-113","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-4p4r-m79c-wq3v","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-7m48-wc93-9g85","dataSource":"https://github.com/advisories/GHSA-7m48-wc93-9g85","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85","https://nvd.nist.gov/vuln/detail/CVE-2023-44402","https://github.com/electron/electron/pull/39788","https://www.electronjs.org/docs/latest/tutorial/fuses"],"description":"ASAR Integrity bypass via filetype confusion in electron","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.1,"exploitabilityScore":1.4,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-44402","epss":0.00207,"percentile":0.10833,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-44402","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["22.3.24"],"state":"fixed","available":[{"version":"22.3.24","date":"2023-12-02","kind":"first-observed"}]},"advisories":[],"risk":0.11488499999999996},"relatedVulnerabilities":[{"id":"CVE-2023-44402","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44402","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/pull/39788","https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85","https://www.electronjs.org/docs/latest/tutorial/fuses"],"description":"Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled.  Apps without these fuses enabled are not impacted.  This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too.  i.e. the ability to edit files inside the `.app` bundle on macOS which these fuses are supposed to protect against. There are no app side workarounds, you must update to a patched version of Electron.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.1,"exploitabilityScore":1.4,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-44402","epss":0.00207,"percentile":0.10833,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2023-44402","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-7m48-wc93-9g85","versionConstraint":"<22.3.24 (semantic)"},"fix":{"suggestedVersion":"22.3.24"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-3c8v-cfp5-9885","dataSource":"https://github.com/advisories/GHSA-3c8v-cfp5-9885","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-3c8v-cfp5-9885","https://nvd.nist.gov/vuln/detail/CVE-2026-34776"],"description":"Electron: Out-of-bounds read in second-instance IPC on macOS and Linux","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.1,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34776","epss":0.00223,"percentile":0.1296,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34776","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.114845},"relatedVulnerabilities":[{"id":"CVE-2026-34776","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34776","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-3c8v-cfp5-9885"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Apps that do not call app.requestSingleInstanceLock() are not affected. Windows is not affected by this issue. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.1,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34776","epss":0.00223,"percentile":0.1296,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34776","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-3c8v-cfp5-9885","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-9w97-2464-8783","dataSource":"https://github.com/advisories/GHSA-9w97-2464-8783","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-9w97-2464-8783","https://nvd.nist.gov/vuln/detail/CVE-2026-34772"],"description":"Electron: Use-after-free in download save dialog callback","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","metrics":{"baseScore":5.8,"exploitabilityScore":1.1,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34772","epss":0.00212,"percentile":0.11527,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34772","cwe":"CWE-416","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.11448000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-34772","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34772","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-9w97-2464-8783"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L","metrics":{"baseScore":5.8,"exploitabilityScore":1.1,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34772","epss":0.00212,"percentile":0.11527,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34772","cwe":"CWE-416","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-9w97-2464-8783","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-997q-gvvc-jwmx","dataSource":"https://github.com/advisories/GHSA-997q-gvvc-jwmx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-997q-gvvc-jwmx","https://nvd.nist.gov/vuln/detail/CVE-2026-114121","https://github.com/electron/electron/pull/53682","https://github.com/electron/electron/pull/53696","https://github.com/electron/electron/pull/53697","https://github.com/electron/electron/pull/53698","https://github.com/electron/electron/pull/53699","https://github.com/electron/electron/commit/25057643bf6d9a20bad69e45707551ccf546f5ce","https://github.com/electron/electron/commit/8aa5414f73792ed3b2e3f9ab6391b1832e6dc2c3","https://github.com/electron/electron/commit/92a783952891805f2f82f344c40a6917b98a7d98","https://github.com/electron/electron/commit/e0a20d5277b567aea8603f8e9852a4341407a586","https://github.com/electron/electron/commit/e3a400911084537bce7380ffea8af939572ce8dd","https://github.com/electron/electron/releases/tag/v42.11.3","https://github.com/electron/electron/releases/tag/v43.7.0","https://github.com/electron/electron/releases/tag/v44.3.0","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.5"],"description":"Electron: openExternal permission requests can be attributed to the wrong origin","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114121","epss":0.00219,"percentile":0.12413,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114121","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["42.11.3"],"state":"fixed","available":[{"version":"42.11.3","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.11388000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-114121","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114121","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/25057643bf6d9a20bad69e45707551ccf546f5ce","https://github.com/electron/electron/commit/8aa5414f73792ed3b2e3f9ab6391b1832e6dc2c3","https://github.com/electron/electron/commit/92a783952891805f2f82f344c40a6917b98a7d98","https://github.com/electron/electron/commit/e0a20d5277b567aea8603f8e9852a4341407a586","https://github.com/electron/electron/commit/e3a400911084537bce7380ffea8af939572ce8dd","https://github.com/electron/electron/pull/53682","https://github.com/electron/electron/pull/53696","https://github.com/electron/electron/pull/53697","https://github.com/electron/electron/pull/53698","https://github.com/electron/electron/pull/53699","https://github.com/electron/electron/releases/tag/v42.11.3","https://github.com/electron/electron/releases/tag/v43.7.0","https://github.com/electron/electron/releases/tag/v44.3.0","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.5","https://github.com/electron/electron/security/advisories/GHSA-997q-gvvc-jwmx"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114121","epss":0.00219,"percentile":0.12413,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114121","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-997q-gvvc-jwmx","versionConstraint":"<42.11.3 (semantic)"},"fix":{"suggestedVersion":"42.11.3"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-qx2v-qp2m-jg93","dataSource":"https://github.com/advisories/GHSA-qx2v-qp2m-jg93","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93","https://nvd.nist.gov/vuln/detail/CVE-2026-41305","https://github.com/postcss/postcss/releases/tag/8.5.10"],"description":"PostCSS has XSS via Unescaped </style> in its CSS Stringify Output","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["8.5.10"],"state":"fixed","available":[{"version":"8.5.10","date":"2026-04-24","kind":"first-observed"}]},"advisories":[],"risk":0.11377499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41305","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41305","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss/releases/tag/8.5.10","https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93"],"description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41305","epss":0.00205,"percentile":0.10481,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41305","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss","version":"5.2.18"}},"found":{"vulnerabilityID":"GHSA-qx2v-qp2m-jg93","versionConstraint":"<8.5.10 (semantic)"},"fix":{"suggestedVersion":"8.5.10"}}],"artifact":{"id":"pkg:npm/postcss@5.2.18?package-id=a2216b0d3db52a78","name":"postcss","version":"5.2.18","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:postcss:postcss:5.2.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/postcss@5.2.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-f2r8-jv7c-xqmp","dataSource":"https://github.com/advisories/GHSA-f2r8-jv7c-xqmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp","https://github.com/electron/electron/pull/50937","https://github.com/electron/electron/pull/50938","https://github.com/electron/electron/pull/51114","https://github.com/electron/electron/pull/51115","https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322","https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44","https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de","https://github.com/electron/electron/releases/tag/v39.8.9","https://github.com/electron/electron/releases/tag/v40.9.2","https://github.com/electron/electron/releases/tag/v41.2.1","https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"],"description":"Electron: DevTools embedder handler executes arbitrary files via shell open","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":6.9,"exploitabilityScore":0.7,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70611","epss":0.00186,"percentile":0.08244,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70611","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.9"],"state":"fixed","available":[{"version":"39.8.9","date":"2026-08-06","kind":"first-observed"}]},"advisories":[],"risk":0.11066999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-70611","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70611","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322","https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771","https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44","https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de","https://github.com/electron/electron/pull/50937","https://github.com/electron/electron/pull/50938","https://github.com/electron/electron/pull/51114","https://github.com/electron/electron/pull/51115","https://github.com/electron/electron/releases/tag/v39.8.9","https://github.com/electron/electron/releases/tag/v40.9.2","https://github.com/electron/electron/releases/tag/v41.2.1","https://github.com/electron/electron/releases/tag/v42.0.0-beta.3","https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":6.9,"exploitabilityScore":0.7,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70611","epss":0.00186,"percentile":0.08244,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70611","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-f2r8-jv7c-xqmp","versionConstraint":"<39.8.9 (semantic)"},"fix":{"suggestedVersion":"39.8.9"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-9pf5-hg6p-4pwp","dataSource":"https://github.com/advisories/GHSA-9pf5-hg6p-4pwp","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp","https://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c"],"description":"Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70599","epss":0.00193,"percentile":0.0907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70599","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.7"],"state":"fixed","available":[{"version":"39.8.7","date":"2026-08-05","kind":"first-observed"}]},"advisories":[],"risk":0.10518500000000003},"relatedVulnerabilities":[{"id":"CVE-2026-70599","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70599","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c","https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70599","epss":0.00193,"percentile":0.0907,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70599","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-9pf5-hg6p-4pwp","versionConstraint":"<39.8.7 (semantic)"},"fix":{"suggestedVersion":"39.8.7"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-hq2x-r82h-9wj4","dataSource":"https://github.com/advisories/GHSA-hq2x-r82h-9wj4","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4","https://github.com/electron/electron/pull/52133","https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba","https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69","https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da","https://github.com/electron/electron/releases/tag/v41.10.4","https://github.com/electron/electron/releases/tag/v42.5.2","https://github.com/electron/electron/releases/tag/v43.0.0"],"description":"Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102673","epss":0.00132,"percentile":0.02758,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102673","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102673","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["41.10.4"],"state":"fixed","available":[{"version":"41.10.4","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.10361999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-102673","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102673","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba","https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69","https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da","https://github.com/electron/electron/pull/52133","https://github.com/electron/electron/releases/tag/v41.10.4","https://github.com/electron/electron/releases/tag/v42.5.2","https://github.com/electron/electron/releases/tag/v43.0.0","https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target=\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102673","epss":0.00132,"percentile":0.02758,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102673","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102673","cwe":"CWE-693","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-hq2x-r82h-9wj4","versionConstraint":"<41.10.4 (semantic)"},"fix":{"suggestedVersion":"41.10.4"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-52f5-9888-hmc6","dataSource":"https://github.com/advisories/GHSA-52f5-9888-hmc6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://nvd.nist.gov/vuln/detail/CVE-2025-54798","https://github.com/raszi/node-tmp/issues/207","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2025-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.10339999999999999},"relatedVulnerabilities":[{"id":"CVE-2025-54798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-54798","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://github.com/raszi/node-tmp/issues/207","https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.28"}},"found":{"vulnerabilityID":"GHSA-52f5-9888-hmc6","versionConstraint":"<=0.2.3 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/tmp@0.0.28?package-id=4328daa2653b7239","name":"tmp","version":"0.0.28","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.28:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.28","upstreams":[]}},{"vulnerability":{"id":"GHSA-52f5-9888-hmc6","dataSource":"https://github.com/advisories/GHSA-52f5-9888-hmc6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://nvd.nist.gov/vuln/detail/CVE-2025-54798","https://github.com/raszi/node-tmp/issues/207","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2025-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.10339999999999999},"relatedVulnerabilities":[{"id":"CVE-2025-54798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-54798","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://github.com/raszi/node-tmp/issues/207","https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.28"}},"found":{"vulnerabilityID":"GHSA-52f5-9888-hmc6","versionConstraint":"<=0.2.3 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/tmp@0.0.28?package-id=3061d93fb0a89722","name":"tmp","version":"0.0.28","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.28:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.28","upstreams":[]}},{"vulnerability":{"id":"GHSA-52f5-9888-hmc6","dataSource":"https://github.com/advisories/GHSA-52f5-9888-hmc6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://nvd.nist.gov/vuln/detail/CVE-2025-54798","https://github.com/raszi/node-tmp/issues/207","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2025-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.10339999999999999},"relatedVulnerabilities":[{"id":"CVE-2025-54798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-54798","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://github.com/raszi/node-tmp/issues/207","https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.28"}},"found":{"vulnerabilityID":"GHSA-52f5-9888-hmc6","versionConstraint":"<=0.2.3 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/tmp@0.0.28?package-id=5d96f5cb328d08ad","name":"tmp","version":"0.0.28","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.28:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.28","upstreams":[]}},{"vulnerability":{"id":"GHSA-52f5-9888-hmc6","dataSource":"https://github.com/advisories/GHSA-52f5-9888-hmc6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://nvd.nist.gov/vuln/detail/CVE-2025-54798","https://github.com/raszi/node-tmp/issues/207","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2025-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.10339999999999999},"relatedVulnerabilities":[{"id":"CVE-2025-54798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-54798","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://github.com/raszi/node-tmp/issues/207","https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.29"}},"found":{"vulnerabilityID":"GHSA-52f5-9888-hmc6","versionConstraint":"<=0.2.3 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/tmp@0.0.29?package-id=a7f9d23e8b5b6f84","name":"tmp","version":"0.0.29","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.29:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.29","upstreams":[]}},{"vulnerability":{"id":"GHSA-52f5-9888-hmc6","dataSource":"https://github.com/advisories/GHSA-52f5-9888-hmc6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://nvd.nist.gov/vuln/detail/CVE-2025-54798","https://github.com/raszi/node-tmp/issues/207","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2025-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.10339999999999999},"relatedVulnerabilities":[{"id":"CVE-2025-54798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-54798","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://github.com/raszi/node-tmp/issues/207","https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.33"}},"found":{"vulnerabilityID":"GHSA-52f5-9888-hmc6","versionConstraint":"<=0.2.3 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/tmp@0.0.33?package-id=7d703abfb2deed2d","name":"tmp","version":"0.0.33","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.33:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.33","upstreams":[]}},{"vulnerability":{"id":"GHSA-52f5-9888-hmc6","dataSource":"https://github.com/advisories/GHSA-52f5-9888-hmc6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://nvd.nist.gov/vuln/detail/CVE-2025-54798","https://github.com/raszi/node-tmp/issues/207","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2025-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.10339999999999999},"relatedVulnerabilities":[{"id":"CVE-2025-54798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-54798","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://github.com/raszi/node-tmp/issues/207","https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.33"}},"found":{"vulnerabilityID":"GHSA-52f5-9888-hmc6","versionConstraint":"<=0.2.3 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/tmp@0.0.33?package-id=12c12abb9cda5441","name":"tmp","version":"0.0.33","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.33:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.33","upstreams":[]}},{"vulnerability":{"id":"GHSA-52f5-9888-hmc6","dataSource":"https://github.com/advisories/GHSA-52f5-9888-hmc6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://nvd.nist.gov/vuln/detail/CVE-2025-54798","https://github.com/raszi/node-tmp/issues/207","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2025-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.10339999999999999},"relatedVulnerabilities":[{"id":"CVE-2025-54798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-54798","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://github.com/raszi/node-tmp/issues/207","https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.0.33"}},"found":{"vulnerabilityID":"GHSA-52f5-9888-hmc6","versionConstraint":"<=0.2.3 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/tmp@0.0.33?package-id=5c0bba295effd905","name":"tmp","version":"0.0.33","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.0.33:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.0.33","upstreams":[]}},{"vulnerability":{"id":"GHSA-52f5-9888-hmc6","dataSource":"https://github.com/advisories/GHSA-52f5-9888-hmc6","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://nvd.nist.gov/vuln/detail/CVE-2025-54798","https://github.com/raszi/node-tmp/issues/207","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.2.4"],"state":"fixed","available":[{"version":"0.2.4","date":"2025-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.10339999999999999},"relatedVulnerabilities":[{"id":"CVE-2025-54798","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-54798","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b","https://github.com/raszi/node-tmp/issues/207","https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html"],"description":"tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-54798","epss":0.00376,"percentile":0.31627,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-54798","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tmp","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-52f5-9888-hmc6","versionConstraint":"<=0.2.3 (semantic)"},"fix":{"suggestedVersion":"0.2.4"}}],"artifact":{"id":"pkg:npm/tmp@0.1.0?package-id=32ed00890a1abaf4","name":"tmp","version":"0.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:raszi:tmp:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tmp@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-2p8c-gr87-2676","dataSource":"https://github.com/advisories/GHSA-2p8c-gr87-2676","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-2p8c-gr87-2676","https://nvd.nist.gov/vuln/detail/CVE-2026-113796","https://github.com/electron/electron/pull/53683","https://github.com/electron/electron/pull/53717","https://github.com/electron/electron/pull/53718","https://github.com/electron/electron/pull/53719","https://github.com/electron/electron/pull/53721","https://github.com/electron/electron/commit/079b9b1594ee62c336adc3aa430d4c1cf62bd51e","https://github.com/electron/electron/commit/0e6aca0618eeae50a18cfd50548b8688820629ed","https://github.com/electron/electron/commit/652ef79ac79c6767b31e59b2f28d0d46114645e5","https://github.com/electron/electron/commit/98940cb274bb6adcb7cdb2da2d4495ac83119670","https://github.com/electron/electron/commit/a86ae4205ba2ba7ae60a6caa9d5d3a44321f2f9b","https://github.com/electron/electron/releases/tag/v42.11.3","https://github.com/electron/electron/releases/tag/v43.7.0","https://github.com/electron/electron/releases/tag/v44.3.0","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.6"],"description":"Electron: SameSite cookie restrictions are not applied to windows opened from links","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"exploitabilityScore":1.7,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113796","epss":0.00219,"percentile":0.12394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113796","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["42.11.3"],"state":"fixed","available":[{"version":"42.11.3","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.10074000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-113796","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113796","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/079b9b1594ee62c336adc3aa430d4c1cf62bd51e","https://github.com/electron/electron/commit/0e6aca0618eeae50a18cfd50548b8688820629ed","https://github.com/electron/electron/commit/652ef79ac79c6767b31e59b2f28d0d46114645e5","https://github.com/electron/electron/commit/98940cb274bb6adcb7cdb2da2d4495ac83119670","https://github.com/electron/electron/commit/a86ae4205ba2ba7ae60a6caa9d5d3a44321f2f9b","https://github.com/electron/electron/pull/53683","https://github.com/electron/electron/pull/53717","https://github.com/electron/electron/pull/53718","https://github.com/electron/electron/pull/53719","https://github.com/electron/electron/pull/53721","https://github.com/electron/electron/releases/tag/v42.11.3","https://github.com/electron/electron/releases/tag/v43.7.0","https://github.com/electron/electron/releases/tag/v44.3.0","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.6","https://github.com/electron/electron/security/advisories/GHSA-2p8c-gr87-2676"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page containing the link as the initiator. The resulting top-level request could be classified as same-site, causing SameSite=Strict cookies to be sent and Sec-Fetch-Site not to identify the initiating page. An application that loads untrusted content and permits it to open new windows could therefore allow that content to make a credentialed request to another site that relies on SameSite cookies for CSRF protection. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"exploitabilityScore":1.7,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113796","epss":0.00219,"percentile":0.12394,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113796","cwe":"CWE-352","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-2p8c-gr87-2676","versionConstraint":"<42.11.3 (semantic)"},"fix":{"suggestedVersion":"42.11.3"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-fv7c-fp4j-7gwp","dataSource":"https://github.com/advisories/GHSA-fv7c-fp4j-7gwp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp","https://nvd.nist.gov/vuln/detail/CVE-2026-44728"],"description":"@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44728","epss":0.00125,"percentile":0.02185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44728","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44728","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.4"],"state":"fixed","available":[{"version":"7.29.4","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.09812499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44728","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44728","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp"],"description":"Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44728","epss":0.00125,"percentile":0.02185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44728","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44728","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/plugin-transform-modules-systemjs","version":"7.12.13"}},"found":{"vulnerabilityID":"GHSA-fv7c-fp4j-7gwp","versionConstraint":">=7.12.0,<=7.29.3 (semantic)"},"fix":{"suggestedVersion":"7.29.4"}}],"artifact":{"id":"pkg:npm/%40babel/plugin-transform-modules-systemjs@7.12.13?package-id=f07ad434fbc7c599","name":"@babel/plugin-transform-modules-systemjs","version":"7.12.13","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/plugin-transform-modules-systemjs:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules-systemjs:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules_systemjs:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules_systemjs:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/plugin-transform-modules-systemjs@7.12.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-fv7c-fp4j-7gwp","dataSource":"https://github.com/advisories/GHSA-fv7c-fp4j-7gwp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp","https://nvd.nist.gov/vuln/detail/CVE-2026-44728"],"description":"@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44728","epss":0.00125,"percentile":0.02185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44728","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44728","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.4"],"state":"fixed","available":[{"version":"7.29.4","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.09812499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44728","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44728","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp"],"description":"Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44728","epss":0.00125,"percentile":0.02185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44728","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44728","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/plugin-transform-modules-systemjs","version":"7.12.13"}},"found":{"vulnerabilityID":"GHSA-fv7c-fp4j-7gwp","versionConstraint":">=7.12.0,<=7.29.3 (semantic)"},"fix":{"suggestedVersion":"7.29.4"}}],"artifact":{"id":"pkg:npm/%40babel/plugin-transform-modules-systemjs@7.12.13?package-id=ae5e0c741f95bdd5","name":"@babel/plugin-transform-modules-systemjs","version":"7.12.13","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/plugin-transform-modules-systemjs:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules-systemjs:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules_systemjs:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules_systemjs:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/plugin-transform-modules-systemjs@7.12.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-fv7c-fp4j-7gwp","dataSource":"https://github.com/advisories/GHSA-fv7c-fp4j-7gwp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp","https://nvd.nist.gov/vuln/detail/CVE-2026-44728"],"description":"@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44728","epss":0.00125,"percentile":0.02185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44728","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44728","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.4"],"state":"fixed","available":[{"version":"7.29.4","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.09812499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44728","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44728","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp"],"description":"Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44728","epss":0.00125,"percentile":0.02185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44728","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44728","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/plugin-transform-modules-systemjs","version":"7.12.13"}},"found":{"vulnerabilityID":"GHSA-fv7c-fp4j-7gwp","versionConstraint":">=7.12.0,<=7.29.3 (semantic)"},"fix":{"suggestedVersion":"7.29.4"}}],"artifact":{"id":"pkg:npm/%40babel/plugin-transform-modules-systemjs@7.12.13?package-id=011effc44aa2c9c8","name":"@babel/plugin-transform-modules-systemjs","version":"7.12.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/plugin-transform-modules-systemjs:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules-systemjs:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules_systemjs:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules_systemjs:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin:\\@babel\\/plugin-transform-modules-systemjs:7.12.13:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin:\\@babel\\/plugin_transform_modules_systemjs:7.12.13:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/plugin-transform-modules-systemjs@7.12.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-fv7c-fp4j-7gwp","dataSource":"https://github.com/advisories/GHSA-fv7c-fp4j-7gwp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp","https://nvd.nist.gov/vuln/detail/CVE-2026-44728"],"description":"@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44728","epss":0.00125,"percentile":0.02185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44728","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44728","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.4"],"state":"fixed","available":[{"version":"7.29.4","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.09812499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44728","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44728","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp"],"description":"Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44728","epss":0.00125,"percentile":0.02185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44728","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44728","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/plugin-transform-modules-systemjs","version":"7.20.11"}},"found":{"vulnerabilityID":"GHSA-fv7c-fp4j-7gwp","versionConstraint":">=7.12.0,<=7.29.3 (semantic)"},"fix":{"suggestedVersion":"7.29.4"}}],"artifact":{"id":"pkg:npm/%40babel/plugin-transform-modules-systemjs@7.20.11?package-id=e3b62108e0f7634d","name":"@babel/plugin-transform-modules-systemjs","version":"7.20.11","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/plugin-transform-modules-systemjs:\\@babel\\/plugin-transform-modules-systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules-systemjs:\\@babel\\/plugin_transform_modules_systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules_systemjs:\\@babel\\/plugin-transform-modules-systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules_systemjs:\\@babel\\/plugin_transform_modules_systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules:\\@babel\\/plugin-transform-modules-systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules:\\@babel\\/plugin_transform_modules_systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules:\\@babel\\/plugin-transform-modules-systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules:\\@babel\\/plugin_transform_modules_systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform:\\@babel\\/plugin-transform-modules-systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform:\\@babel\\/plugin_transform_modules_systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform:\\@babel\\/plugin-transform-modules-systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform:\\@babel\\/plugin_transform_modules_systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin:\\@babel\\/plugin-transform-modules-systemjs:7.20.11:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin:\\@babel\\/plugin_transform_modules_systemjs:7.20.11:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/plugin-transform-modules-systemjs@7.20.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-fv7c-fp4j-7gwp","dataSource":"https://github.com/advisories/GHSA-fv7c-fp4j-7gwp","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp","https://nvd.nist.gov/vuln/detail/CVE-2026-44728"],"description":"@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44728","epss":0.00125,"percentile":0.02185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44728","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44728","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.4"],"state":"fixed","available":[{"version":"7.29.4","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.09812499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-44728","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44728","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/babel/babel/security/advisories/GHSA-fv7c-fp4j-7gwp"],"description":"Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":1.5,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44728","epss":0.00125,"percentile":0.02185,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44728","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44728","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/plugin-transform-modules-systemjs","version":"7.22.5"}},"found":{"vulnerabilityID":"GHSA-fv7c-fp4j-7gwp","versionConstraint":">=7.12.0,<=7.29.3 (semantic)"},"fix":{"suggestedVersion":"7.29.4"}}],"artifact":{"id":"pkg:npm/%40babel/plugin-transform-modules-systemjs@7.22.5?package-id=c6623d1ae6d0332c","name":"@babel/plugin-transform-modules-systemjs","version":"7.22.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/plugin-transform-modules-systemjs:\\@babel\\/plugin-transform-modules-systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules-systemjs:\\@babel\\/plugin_transform_modules_systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules_systemjs:\\@babel\\/plugin-transform-modules-systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules_systemjs:\\@babel\\/plugin_transform_modules_systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules:\\@babel\\/plugin-transform-modules-systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform-modules:\\@babel\\/plugin_transform_modules_systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules:\\@babel\\/plugin-transform-modules-systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform_modules:\\@babel\\/plugin_transform_modules_systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform:\\@babel\\/plugin-transform-modules-systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin-transform:\\@babel\\/plugin_transform_modules_systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform:\\@babel\\/plugin-transform-modules-systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin_transform:\\@babel\\/plugin_transform_modules_systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin:\\@babel\\/plugin-transform-modules-systemjs:7.22.5:*:*:*:*:*:*:*","cpe:2.3:a:\\@babel\\/plugin:\\@babel\\/plugin_transform_modules_systemjs:7.22.5:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/plugin-transform-modules-systemjs@7.22.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-vmf3-w455-68vh","dataSource":"https://github.com/advisories/GHSA-vmf3-w455-68vh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.16"],"state":"fixed","available":[{"version":"7.5.16","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.09281999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-53655","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"2.2.2"}},"found":{"vulnerabilityID":"GHSA-vmf3-w455-68vh","versionConstraint":"<=7.5.15 (semantic)"},"fix":{"suggestedVersion":"7.5.16"}}],"artifact":{"id":"pkg:npm/tar@2.2.2?package-id=e884233c7fdf0ed7","name":"tar","version":"2.2.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:2.2.2:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:2.2.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@2.2.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-vmf3-w455-68vh","dataSource":"https://github.com/advisories/GHSA-vmf3-w455-68vh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.16"],"state":"fixed","available":[{"version":"7.5.16","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.09281999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-53655","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-vmf3-w455-68vh","versionConstraint":"<=7.5.15 (semantic)"},"fix":{"suggestedVersion":"7.5.16"}}],"artifact":{"id":"pkg:npm/tar@4.4.19?package-id=f54b22f29fe4eaf2","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-vmf3-w455-68vh","dataSource":"https://github.com/advisories/GHSA-vmf3-w455-68vh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.16"],"state":"fixed","available":[{"version":"7.5.16","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.09281999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-53655","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53655","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"],"description":"node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53655","epss":0.00156,"percentile":0.04757,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53655","cwe":"CWE-436","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.8"}},"found":{"vulnerabilityID":"GHSA-vmf3-w455-68vh","versionConstraint":"<=7.5.15 (semantic)"},"fix":{"suggestedVersion":"7.5.16"}}],"artifact":{"id":"pkg:npm/tar@4.4.8?package-id=4d499cd090196700","name":"tar","version":"4.4.8","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:node.js:*:*","cpe:2.3:a:tar_project:tar:4.4.8:*:*:*:*:rust:*:*","cpe:2.3:a:isaacs:tar:4.4.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-5rqw-r77c-jp79","dataSource":"https://github.com/advisories/GHSA-5rqw-r77c-jp79","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-5rqw-r77c-jp79","https://nvd.nist.gov/vuln/detail/CVE-2026-34779"],"description":"Electron: AppleScript injection in app.moveToApplicationsFolder on macOS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":1.1,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34779","epss":0.00161,"percentile":0.05258,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34779","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.092575},"relatedVulnerabilities":[{"id":"CVE-2026-34779","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34779","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-5rqw-r77c-jp79"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt. Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":1.1,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34779","epss":0.00161,"percentile":0.05258,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34779","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-5rqw-r77c-jp79","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-6r2x-8pq8-9489","dataSource":"https://github.com/advisories/GHSA-6r2x-8pq8-9489","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-6r2x-8pq8-9489","https://nvd.nist.gov/vuln/detail/CVE-2024-46993"],"description":"Electron vulnerable to Heap Buffer Overflow in NativeImage","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":4.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-46993","epss":0.00156,"percentile":0.04745,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-46993","cwe":"CWE-122","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["28.3.2"],"state":"fixed","available":[{"version":"28.3.2","date":"2025-07-01","kind":"first-observed"}]},"advisories":[],"risk":0.07332000000000001},"relatedVulnerabilities":[{"id":"CVE-2024-46993","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-46993","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-6r2x-8pq8-9489"],"description":"Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 28.3.2, 29.3.3, and 30.0.3, the nativeImage.createFromPath() and nativeImage.createFromBuffer() functions call a function downstream that is vulnerable to a heap buffer overflow. An Electron program that uses either of the affected functions is vulnerable to a buffer overflow if an attacker is in control of the image's height, width, and contents. This issue has been patched in versions  28.3.2, 29.3.3, and 30.0.3. There are no workarounds for this issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-46993","epss":0.00156,"percentile":0.04745,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2024-46993","cwe":"CWE-122","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-6r2x-8pq8-9489","versionConstraint":"<28.3.2 (semantic)"},"fix":{"suggestedVersion":"28.3.2"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-5c9j-mhmv-5xgx","dataSource":"https://github.com/advisories/GHSA-5c9j-mhmv-5xgx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgx"],"description":"Electron: shell.openPath path validation bypass via embedded null byte","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6,"exploitabilityScore":0.8,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70603","epss":0.00132,"percentile":0.02778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70603","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-70603","cwe":"CWE-158","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.6"],"state":"fixed","available":[{"version":"39.8.6","date":"2026-08-05","kind":"first-observed"}]},"advisories":[],"risk":0.07260000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-70603","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70603","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgx"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6,"exploitabilityScore":0.8,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70603","epss":0.00132,"percentile":0.02778,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70603","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-70603","cwe":"CWE-158","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-5c9j-mhmv-5xgx","versionConstraint":"<39.8.6 (semantic)"},"fix":{"suggestedVersion":"39.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-xj5x-m3f3-5x3h","dataSource":"https://github.com/advisories/GHSA-xj5x-m3f3-5x3h","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-xj5x-m3f3-5x3h","https://nvd.nist.gov/vuln/detail/CVE-2026-34778"],"description":"Electron: Service worker can spoof executeJavaScript IPC replies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34778","epss":0.00129,"percentile":0.02513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34778","cwe":"CWE-290","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34778","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.07030499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-34778","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34778","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-xj5x-m3f3-5x3h"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, a service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data. Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34778","epss":0.00129,"percentile":0.02513,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34778","cwe":"CWE-290","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34778","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-xj5x-m3f3-5x3h","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-76c9-3jph-rj3q","dataSource":"https://github.com/advisories/GHSA-76c9-3jph-rj3q","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q","https://nvd.nist.gov/vuln/detail/CVE-2025-7339","https://github.com/expressjs/morgan/issues/315","https://github.com/jshttp/on-headers/issues/15","https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867","https://cna.openjsf.org/security-advisories.html"],"description":"on-headers is vulnerable to http response header manipulation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.4,"exploitabilityScore":0.8,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7339","epss":0.00208,"percentile":0.10904,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7339","cwe":"CWE-241","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["1.1.0"],"state":"fixed","available":[{"version":"1.1.0","date":"2025-07-18","kind":"first-observed"}]},"advisories":[],"risk":0.06655999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-7339","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7339","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/morgan/issues/315","https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867","https://github.com/jshttp/on-headers/issues/15","https://github.com/jshttp/on-headers/security/advisories/GHSA-76c9-3jph-rj3q"],"description":"on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.4,"exploitabilityScore":0.8,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7339","epss":0.00208,"percentile":0.10904,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-7339","cwe":"CWE-241","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"on-headers","version":"1.0.2"}},"found":{"vulnerabilityID":"GHSA-76c9-3jph-rj3q","versionConstraint":"<1.1.0 (semantic)"},"fix":{"suggestedVersion":"1.1.0"}}],"artifact":{"id":"pkg:npm/on-headers@1.0.2?package-id=22d4e76a349b63d1","name":"on-headers","version":"1.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:on-headers:on-headers:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:on-headers:on_headers:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:on_headers:on-headers:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:on_headers:on_headers:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:on:on-headers:1.0.2:*:*:*:*:*:*:*","cpe:2.3:a:on:on_headers:1.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/on-headers@1.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-r5p7-gp4j-qhrx","dataSource":"https://github.com/advisories/GHSA-r5p7-gp4j-qhrx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx","https://nvd.nist.gov/vuln/detail/CVE-2026-34777"],"description":"Electron: Incorrect origin passed to permission request handler for iframe requests","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34777","epss":0.00124,"percentile":0.02096,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34777","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.06448000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-34777","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34777","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or webContents.getURL() may inadvertently grant permissions to embedded third-party content. The correct requesting URL remains available via details.requestingUrl. Apps that already check details.requestingUrl are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34777","epss":0.00124,"percentile":0.02096,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34777","cwe":"CWE-346","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-r5p7-gp4j-qhrx","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-3qxv-5xgr-q7w9","dataSource":"https://github.com/advisories/GHSA-3qxv-5xgr-q7w9","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-3qxv-5xgr-q7w9","https://nvd.nist.gov/vuln/detail/CVE-2026-114122","https://github.com/electron/electron/pull/54033","https://github.com/electron/electron/pull/54036","https://github.com/electron/electron/pull/54037","https://github.com/electron/electron/pull/54038","https://github.com/electron/electron/pull/54047","https://github.com/electron/electron/commit/24d8dbc661c6a109476ae59e9a2740b35d005cf4","https://github.com/electron/electron/commit/64ae597deda8956037387b439e6361f0fe936c86","https://github.com/electron/electron/commit/8d48be150c3fd53b0d02854124bdb7858598799c","https://github.com/electron/electron/commit/d496507ffa1693edaa704a4be130fbcb8ecb4ada","https://github.com/electron/electron/commit/d7f87070a8d738e561245d1ade4d6fbb082db80a","https://github.com/electron/electron/releases/tag/v42.11.6","https://github.com/electron/electron/releases/tag/v43.7.3","https://github.com/electron/electron/releases/tag/v44.4.3","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.9"],"description":"Electron: Frame subscription trusts GPU-supplied frame geometry","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":3.9,"exploitabilityScore":0.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114122","epss":0.00186,"percentile":0.08241,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114122","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["42.11.6"],"state":"fixed","available":[{"version":"42.11.6","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.06417},"relatedVulnerabilities":[{"id":"CVE-2026-114122","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114122","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/electron/electron/commit/24d8dbc661c6a109476ae59e9a2740b35d005cf4","https://github.com/electron/electron/commit/64ae597deda8956037387b439e6361f0fe936c86","https://github.com/electron/electron/commit/8d48be150c3fd53b0d02854124bdb7858598799c","https://github.com/electron/electron/commit/d496507ffa1693edaa704a4be130fbcb8ecb4ada","https://github.com/electron/electron/commit/d7f87070a8d738e561245d1ade4d6fbb082db80a","https://github.com/electron/electron/pull/54036","https://github.com/electron/electron/pull/54037","https://github.com/electron/electron/pull/54038","https://github.com/electron/electron/pull/54047","https://github.com/electron/electron/releases/tag/v42.11.6","https://github.com/electron/electron/releases/tag/v43.7.3","https://github.com/electron/electron/releases/tag/v44.4.3","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.9","https://github.com/electron/electron/security/advisories/GHSA-3qxv-5xgr-q7w9"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could supply inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing captured frame images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":3.9,"exploitabilityScore":0.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114122","epss":0.00186,"percentile":0.08241,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114122","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-3qxv-5xgr-q7w9","versionConstraint":"<42.11.6 (semantic)"},"fix":{"suggestedVersion":"42.11.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-h3v5-h239-pg29","dataSource":"https://github.com/advisories/GHSA-h3v5-h239-pg29","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-h3v5-h239-pg29","https://nvd.nist.gov/vuln/detail/CVE-2026-114124","https://github.com/electron/electron/pull/54033","https://github.com/electron/electron/pull/54036","https://github.com/electron/electron/pull/54037","https://github.com/electron/electron/pull/54038","https://github.com/electron/electron/pull/54047","https://github.com/electron/electron/commit/24d8dbc661c6a109476ae59e9a2740b35d005cf4","https://github.com/electron/electron/commit/64ae597deda8956037387b439e6361f0fe936c86","https://github.com/electron/electron/commit/8d48be150c3fd53b0d02854124bdb7858598799c","https://github.com/electron/electron/commit/d496507ffa1693edaa704a4be130fbcb8ecb4ada","https://github.com/electron/electron/commit/d7f87070a8d738e561245d1ade4d6fbb082db80a","https://github.com/electron/electron/releases/tag/v42.11.6","https://github.com/electron/electron/releases/tag/v43.7.3","https://github.com/electron/electron/releases/tag/v44.4.3","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.9"],"description":"Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":3.9,"exploitabilityScore":0.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114124","epss":0.00185,"percentile":0.08167,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114124","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["42.11.6"],"state":"fixed","available":[{"version":"42.11.6","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.06382499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-114124","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114124","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/electron/electron/commit/24d8dbc661c6a109476ae59e9a2740b35d005cf4","https://github.com/electron/electron/commit/64ae597deda8956037387b439e6361f0fe936c86","https://github.com/electron/electron/commit/8d48be150c3fd53b0d02854124bdb7858598799c","https://github.com/electron/electron/commit/d496507ffa1693edaa704a4be130fbcb8ecb4ada","https://github.com/electron/electron/commit/d7f87070a8d738e561245d1ade4d6fbb082db80a","https://github.com/electron/electron/pull/54033","https://github.com/electron/electron/pull/54036","https://github.com/electron/electron/pull/54037","https://github.com/electron/electron/pull/54038","https://github.com/electron/electron/pull/54047","https://github.com/electron/electron/releases/tag/v42.11.6","https://github.com/electron/electron/releases/tag/v43.7.3","https://github.com/electron/electron/releases/tag/v44.4.3","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.9","https://github.com/electron/electron/security/advisories/GHSA-h3v5-h239-pg29"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could provide inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":3.9,"exploitabilityScore":0.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114124","epss":0.00185,"percentile":0.08167,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114124","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-h3v5-h239-pg29","versionConstraint":"<42.11.6 (semantic)"},"fix":{"suggestedVersion":"42.11.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-jm7p-cc5g-qwxx","dataSource":"https://github.com/advisories/GHSA-jm7p-cc5g-qwxx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx","https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35"],"description":"Electron: Parent process code-sign check is spoofable","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"exploitabilityScore":1.1,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70597","epss":0.00104,"percentile":0.00991,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70597","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.8"],"state":"fixed","available":[{"version":"39.8.8","date":"2026-08-05","kind":"first-observed"}]},"advisories":[],"risk":0.058759999999999986},"relatedVulnerabilities":[{"id":"CVE-2026-70597","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70597","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35","https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"exploitabilityScore":1.1,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70597","epss":0.00104,"percentile":0.00991,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70597","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-jm7p-cc5g-qwxx","versionConstraint":"<39.8.8 (semantic)"},"fix":{"suggestedVersion":"39.8.8"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-x8rc-wpg4-grpf","dataSource":"https://github.com/advisories/GHSA-x8rc-wpg4-grpf","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf"],"description":"Electron: Cross-origin iframe can position native autofill popup","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70600","epss":0.00179,"percentile":0.07433,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70600","cwe":"CWE-1021","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.8"],"state":"fixed","available":[{"version":"39.8.8","date":"2026-08-05","kind":"first-observed"}]},"advisories":[],"risk":0.054595000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-70600","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70600","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70600","epss":0.00179,"percentile":0.07433,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70600","cwe":"CWE-1021","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-x8rc-wpg4-grpf","versionConstraint":"<39.8.8 (semantic)"},"fix":{"suggestedVersion":"39.8.8"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-vv43-5jgx-7qv8","dataSource":"https://github.com/advisories/GHSA-vv43-5jgx-7qv8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-vv43-5jgx-7qv8","https://github.com/electron/electron/pull/50745","https://github.com/electron/electron/commit/01faabfc250801a980fc94d64608046c67fc1cd9","https://github.com/electron/electron/commit/15e2928a5c5f01759107b414010e220d90d59cef","https://github.com/electron/electron/commit/a0f9ff4cc0340545008424232d49caadd9c0c767","https://github.com/electron/electron/commit/b8f25c4cedb2e0f5f475912b709aba19c57c26be","https://github.com/electron/electron/releases/tag/v39.8.10","https://github.com/electron/electron/releases/tag/v41.10.5","https://github.com/electron/electron/releases/tag/v42.0.0-beta.2"],"description":"Electron: Local race condition in Squirrel.Mac update installation on macOS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102672","epss":0.00093,"percentile":0.00516,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102672","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.10"],"state":"fixed","available":[{"version":"39.8.10","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.054405},"relatedVulnerabilities":[{"id":"CVE-2026-102672","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102672","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/commit/01faabfc250801a980fc94d64608046c67fc1cd9","https://github.com/electron/electron/commit/15e2928a5c5f01759107b414010e220d90d59cef","https://github.com/electron/electron/commit/a0f9ff4cc0340545008424232d49caadd9c0c767","https://github.com/electron/electron/commit/b8f25c4cedb2e0f5f475912b709aba19c57c26be","https://github.com/electron/electron/pull/50745","https://github.com/electron/electron/releases/tag/v39.8.10","https://github.com/electron/electron/releases/tag/v41.10.5","https://github.com/electron/electron/releases/tag/v42.0.0-beta.2","https://github.com/electron/electron/security/advisories/GHSA-vv43-5jgx-7qv8"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application's files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squirrel.Mac-based automatic updates are not affected. This issue is fixed in versions 39.8.10, 41.10.5, and 42.0.0-beta.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"exploitabilityScore":0.8,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102672","epss":0.00093,"percentile":0.00516,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102672","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-vv43-5jgx-7qv8","versionConstraint":"<39.8.10 (semantic)"},"fix":{"suggestedVersion":"39.8.10"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-9899-m83m-qhpj","dataSource":"https://github.com/advisories/GHSA-9899-m83m-qhpj","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-9899-m83m-qhpj","https://nvd.nist.gov/vuln/detail/CVE-2026-34766"],"description":"Electron: USB device selection not validated against filtered device list","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":0.8,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34766","epss":0.00165,"percentile":0.05689,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34766","cwe":"CWE-862","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.05197499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-34766","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34766","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/electron/electron/security/advisories/GHSA-9899-m83m-qhpj"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, the select-usb-device event callback did not validate the chosen device ID against the filtered list that was presented to the handler. An app whose handler could be influenced to select a device ID outside the filtered set would grant access to a device that did not match the renderer's requested filters or was listed in exclusionFilters. The WebUSB security blocklist remained enforced regardless, so security-sensitive devices on the blocklist were not affected. The practical impact is limited to apps with unusual device-selection logic. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":0.8,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34766","epss":0.00165,"percentile":0.05689,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34766","cwe":"CWE-862","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-9899-m83m-qhpj","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x5r-pxfx-6jf8","dataSource":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8","https://babeljs.io/docs/options#inputsourcemap","https://nvd.nist.gov/vuln/detail/CVE-2026-49356"],"description":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.6"],"state":"fixed","available":[{"version":"7.29.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.04712},"relatedVulnerabilities":[{"id":"CVE-2026-49356","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49356","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"],"description":"Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/core","version":"7.12.17"}},"found":{"vulnerabilityID":"GHSA-4x5r-pxfx-6jf8","versionConstraint":"<=7.29.0 (semantic)"},"fix":{"suggestedVersion":"7.29.6"}}],"artifact":{"id":"pkg:npm/%40babel/core@7.12.17?package-id=1448a22af253698e","name":"@babel/core","version":"7.12.17","type":"npm","locations":[{"path":"/lib/ui-toolkit/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/core:\\@babel\\/core:7.12.17:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/core@7.12.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x5r-pxfx-6jf8","dataSource":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8","https://babeljs.io/docs/options#inputsourcemap","https://nvd.nist.gov/vuln/detail/CVE-2026-49356"],"description":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.6"],"state":"fixed","available":[{"version":"7.29.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.04712},"relatedVulnerabilities":[{"id":"CVE-2026-49356","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49356","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"],"description":"Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/core","version":"7.12.17"}},"found":{"vulnerabilityID":"GHSA-4x5r-pxfx-6jf8","versionConstraint":"<=7.29.0 (semantic)"},"fix":{"suggestedVersion":"7.29.6"}}],"artifact":{"id":"pkg:npm/%40babel/core@7.12.17?package-id=431ebab9e40e5394","name":"@babel/core","version":"7.12.17","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/core:\\@babel\\/core:7.12.17:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/core@7.12.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-4x5r-pxfx-6jf8","dataSource":"https://github.com/advisories/GHSA-4x5r-pxfx-6jf8","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8","https://babeljs.io/docs/options#inputsourcemap","https://nvd.nist.gov/vuln/detail/CVE-2026-49356"],"description":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.29.6"],"state":"fixed","available":[{"version":"7.29.6","date":"2026-06-15","kind":"first-observed"}]},"advisories":[],"risk":0.04712},"relatedVulnerabilities":[{"id":"CVE-2026-49356","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49356","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"],"description":"Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.6,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.2,"exploitabilityScore":1.5,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49356","epss":0.00152,"percentile":0.04306,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49356","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-49356","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@babel/core","version":"7.12.17"}},"found":{"vulnerabilityID":"GHSA-4x5r-pxfx-6jf8","versionConstraint":"<=7.29.0 (semantic)"},"fix":{"suggestedVersion":"7.29.6"}}],"artifact":{"id":"pkg:npm/%40babel/core@7.12.17?package-id=5ca40ababcf6fcb5","name":"@babel/core","version":"7.12.17","type":"npm","locations":[{"path":"/lib/wsd-core/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@babel\\/core:\\@babel\\/core:7.12.17:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40babel/core@7.12.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-pfmc-3mgc-p6fp","dataSource":"https://github.com/advisories/GHSA-pfmc-3mgc-p6fp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp","https://github.com/electron/electron/commit/2c24640e7b0b9c74fe9f44bce0fde138340ff4fb"],"description":"Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":3.9,"exploitabilityScore":0.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70598","epss":0.00136,"percentile":0.03047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70598","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.10"],"state":"fixed","available":[{"version":"39.8.10","date":"2026-08-05","kind":"first-observed"}]},"advisories":[],"risk":0.04692},"relatedVulnerabilities":[{"id":"CVE-2026-70598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70598","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/electron/electron/commit/2c24640e7b0b9c74fe9f44bce0fde138340ff4fb","https://github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. This issue is fixed in 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":3.9,"exploitabilityScore":0.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-70598","epss":0.00136,"percentile":0.03047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-70598","cwe":"CWE-125","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-pfmc-3mgc-p6fp","versionConstraint":"<39.8.10 (semantic)"},"fix":{"suggestedVersion":"39.8.10"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-jfqx-fxh3-c62j","dataSource":"https://github.com/advisories/GHSA-jfqx-fxh3-c62j","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-jfqx-fxh3-c62j","https://nvd.nist.gov/vuln/detail/CVE-2026-34768"],"description":"Electron: Unquoted executable path in app.setLoginItemSettings on Windows","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":3.9,"exploitabilityScore":0.5,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34768","epss":0.00132,"percentile":0.0276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34768","cwe":"CWE-428","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["38.8.6"],"state":"fixed","available":[{"version":"38.8.6","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.04554},"relatedVulnerabilities":[{"id":"CVE-2026-34768","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34768","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/electron/electron/security/advisories/GHSA-jfqx-fxh3-c62j"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login instead of the intended app. On a default Windows install, standard system directories are protected against writes by standard users, so exploitation typically requires a non-standard install location. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":3.9,"exploitabilityScore":0.5,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34768","epss":0.00132,"percentile":0.0276,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34768","cwe":"CWE-428","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-jfqx-fxh3-c62j","versionConstraint":"<38.8.6 (semantic)"},"fix":{"suggestedVersion":"38.8.6"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-f37v-82c4-4x64","dataSource":"https://github.com/advisories/GHSA-f37v-82c4-4x64","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-f37v-82c4-4x64","https://github.com/electron/electron/pull/50475","https://github.com/electron/electron/commit/a48f03fb8d03933547281ddb2dbb6c6b9e705287","https://github.com/electron/electron/releases/tag/v39.8.5","https://github.com/electron/electron/releases/tag/v40.8.5","https://github.com/electron/electron/releases/tag/v41.1.0","https://github.com/electron/electron/releases/tag/v42.0.0-alpha.5","https://nvd.nist.gov/vuln/detail/CVE-2026-34781"],"description":"Electron: Crash in clipboard.readImage() on malformed clipboard image data","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"exploitabilityScore":1.4,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34781","epss":0.00144,"percentile":0.03673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34781","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["39.8.5"],"state":"fixed","available":[{"version":"39.8.5","date":"2026-04-07","kind":"first-observed"}]},"advisories":[],"risk":0.04176},"relatedVulnerabilities":[{"id":"CVE-2026-34781","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34781","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/electron/electron/security/advisories/GHSA-f37v-82c4-4x64"],"description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process. Apps are only affected if they call clipboard.readImage(). Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"exploitabilityScore":1.4,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34781","epss":0.00144,"percentile":0.03673,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34781","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"electron","version":"3.0.13"}},"found":{"vulnerabilityID":"GHSA-f37v-82c4-4x64","versionConstraint":"<39.8.5 (semantic)"},"fix":{"suggestedVersion":"39.8.5"}}],"artifact":{"id":"pkg:npm/electron@3.0.13?package-id=90b6022f0ebaae46","name":"electron","version":"3.0.13","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:electronjs:electron:3.0.13:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/electron@3.0.13","upstreams":[]}},{"vulnerability":{"id":"GHSA-4vmm-mhcq-4x9j","dataSource":"https://github.com/advisories/GHSA-4vmm-mhcq-4x9j","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/pugjs/constantinople/commit/01d409c0d081dfd65223e6b7767c244156d35f7f","https://bugzilla.redhat.com/show_bug.cgi?id=1577703","https://www.npmjs.com/advisories/568","https://snyk.io/vuln/npm:constantinople:20180421"],"description":"Sandbox Bypass Leading to Arbitrary Code Execution in constantinople","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":5.8},"vendorMetadata":{}}],"fix":{"versions":["3.1.1"],"state":"fixed","available":[{"version":"3.1.1","date":"2020-09-12","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"constantinople","version":"3.0.2"}},"found":{"vulnerabilityID":"GHSA-4vmm-mhcq-4x9j","versionConstraint":"<3.1.1 (semantic)"},"fix":{"suggestedVersion":"3.1.1"}}],"artifact":{"id":"pkg:npm/constantinople@3.0.2?package-id=a2a01516aef54df6","name":"constantinople","version":"3.0.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:constantinople:constantinople:3.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/constantinople@3.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-cxww-7g56-2vh6","dataSource":"https://github.com/advisories/GHSA-cxww-7g56-2vh6","namespace":"github:language:github-action","severity":"High","urls":["https://github.com/actions/download-artifact/security/advisories/GHSA-cxww-7g56-2vh6","https://github.com/advisories/GHSA-6q32-hq47-5qq3","https://snyk.io/research/zip-slip-vulnerability","https://github.com/actions/download-artifact/releases/tag/v4.1.3"],"description":"@actions/download-artifact has an Arbitrary File Write via artifact extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.3,"exploitabilityScore":2.1,"impactScore":5.2},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"fix":{"versions":["4.1.3"],"state":"fixed","available":[{"version":"4.1.3","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"actions/download-artifact","version":"v4"}},"found":{"vulnerabilityID":"GHSA-cxww-7g56-2vh6","versionConstraint":">=4.0.0,<4.1.3 (unknown)"},"fix":{"suggestedVersion":"4.1.3"}}],"artifact":{"id":"pkg:github/actions/download-artifact@v4?package-id=0daeb2e34e4ea161","name":"actions/download-artifact","version":"v4","type":"github-action","locations":[{"path":"/.github/workflows/release-draft.yaml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:actions\\/download-artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download-artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download_artifact:v4:*:*:*:*:*:*:*"],"purl":"pkg:github/actions/download-artifact@v4","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.15.1"],"state":"fixed","available":[{"version":"3.15.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.13.1"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=3.0.0,<3.15.1 (semantic)"},"fix":{"suggestedVersion":"3.15.1"}}],"artifact":{"id":"pkg:npm/js-yaml@3.13.1?package-id=d33db3c848bbbd0c","name":"js-yaml","version":"3.13.1","type":"npm","locations":[{"path":"/ember-electron/backend/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.13.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.13.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.15.1"],"state":"fixed","available":[{"version":"3.15.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=3.0.0,<3.15.1 (semantic)"},"fix":{"suggestedVersion":"3.15.1"}}],"artifact":{"id":"pkg:npm/js-yaml@3.14.1?package-id=7f4e23ed36f92339","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.15.1"],"state":"fixed","available":[{"version":"3.15.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.6.1"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=3.0.0,<3.15.1 (semantic)"},"fix":{"suggestedVersion":"3.15.1"}}],"artifact":{"id":"pkg:npm/js-yaml@3.6.1?package-id=30d141a9595f949a","name":"js-yaml","version":"3.6.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.6.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-8j8c-7jfh-h6hx","dataSource":"https://github.com/advisories/GHSA-8j8c-7jfh-h6hx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/pull/480","https://www.npmjs.com/advisories/813","https://github.com/nodeca/js-yaml/pull/480/commits/e18afbf1edcafb7add2c4c7b22abc8d6ebc2fa61"],"description":"Code Injection in js-yaml","cvss":[],"fix":{"versions":["3.13.1"],"state":"fixed","available":[{"version":"3.13.1","date":"2020-09-12","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.6.1"}},"found":{"vulnerabilityID":"GHSA-8j8c-7jfh-h6hx","versionConstraint":"<3.13.1 (semantic)"},"fix":{"suggestedVersion":"3.13.1"}}],"artifact":{"id":"pkg:npm/js-yaml@3.6.1?package-id=30d141a9595f949a","name":"js-yaml","version":"3.6.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.6.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-5p4m-2wfm-xmqj","dataSource":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"],"description":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.15.1"],"state":"fixed","available":[{"version":"3.15.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.7.0"}},"found":{"vulnerabilityID":"GHSA-5p4m-2wfm-xmqj","versionConstraint":">=3.0.0,<3.15.1 (semantic)"},"fix":{"suggestedVersion":"3.15.1"}}],"artifact":{"id":"pkg:npm/js-yaml@3.7.0?package-id=a0f85ddb9679f590","name":"js-yaml","version":"3.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8j8c-7jfh-h6hx","dataSource":"https://github.com/advisories/GHSA-8j8c-7jfh-h6hx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/pull/480","https://www.npmjs.com/advisories/813","https://github.com/nodeca/js-yaml/pull/480/commits/e18afbf1edcafb7add2c4c7b22abc8d6ebc2fa61"],"description":"Code Injection in js-yaml","cvss":[],"fix":{"versions":["3.13.1"],"state":"fixed","available":[{"version":"3.13.1","date":"2020-09-12","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.7.0"}},"found":{"vulnerabilityID":"GHSA-8j8c-7jfh-h6hx","versionConstraint":"<3.13.1 (semantic)"},"fix":{"suggestedVersion":"3.13.1"}}],"artifact":{"id":"pkg:npm/js-yaml@3.7.0?package-id=a0f85ddb9679f590","name":"js-yaml","version":"3.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-r4q5-vmmm-2653","dataSource":"https://github.com/advisories/GHSA-r4q5-vmmm-2653","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653","https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9"],"description":"follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"fix":{"versions":["1.16.0"],"state":"fixed","available":[{"version":"1.16.0","date":"2026-04-14","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"follow-redirects","version":"1.15.2"}},"found":{"vulnerabilityID":"GHSA-r4q5-vmmm-2653","versionConstraint":"<=1.15.11 (semantic)"},"fix":{"suggestedVersion":"1.16.0"}}],"artifact":{"id":"pkg:npm/follow-redirects@1.15.2?package-id=dc7623ae1813c8e8","name":"follow-redirects","version":"1.15.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:follow-redirects:follow_redirects:1.15.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/follow-redirects@1.15.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7rx3-28cr-v5wh","dataSource":"https://github.com/advisories/GHSA-7rx3-28cr-v5wh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-7rx3-28cr-v5wh","https://github.com/advisories/GHSA-765h-qjxv-5f44","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"],"description":"Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.7"}},"found":{"vulnerabilityID":"GHSA-7rx3-28cr-v5wh","versionConstraint":">=4.6.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.7?package-id=94a6b0a915fbcc9f","name":"handlebars","version":"4.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.7:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-7wwv-vh3v-89cq","dataSource":"https://github.com/advisories/GHSA-7wwv-vh3v-89cq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/highlightjs/highlight.js/security/advisories/GHSA-7wwv-vh3v-89cq","https://github.com/highlightjs/highlight.js/commit/373b9d862401162e832ce77305e49b859e110f9c","https://www.npmjs.com/package/@highlightjs/cdn-assets","https://www.npmjs.com/package/highlight.js"],"description":"ReDOS vulnerabities: multiple grammars","cvss":[],"fix":{"versions":["10.4.1"],"state":"fixed","available":[{"version":"10.4.1","date":"2020-12-05","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"highlight.js","version":"9.18.5"}},"found":{"vulnerabilityID":"GHSA-7wwv-vh3v-89cq","versionConstraint":">=9.0.0,<10.4.1 (semantic)"},"fix":{"suggestedVersion":"10.4.1"}}],"artifact":{"id":"pkg:npm/highlight.js@9.18.5?package-id=f8c0d707086eed2f","name":"highlight.js","version":"9.18.5","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:highlightjs:highlight.js:9.18.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/highlight.js@9.18.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-2pr6-76vf-7546","dataSource":"https://github.com/advisories/GHSA-2pr6-76vf-7546","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/issues/475","https://github.com/nodeca/js-yaml/commit/a567ef3c6e61eb319f0bfc2671d91061afb01235","https://www.npmjs.com/advisories/788","https://www.npmjs.com/advisories/788/versions","https://snyk.io/vuln/SNYK-JS-JSYAML-173999"],"description":"Denial of Service in js-yaml","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.13.0"],"state":"fixed","available":[{"version":"3.13.0","date":"2020-09-12","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.6.1"}},"found":{"vulnerabilityID":"GHSA-2pr6-76vf-7546","versionConstraint":"<3.13.0 (semantic)"},"fix":{"suggestedVersion":"3.13.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.6.1?package-id=30d141a9595f949a","name":"js-yaml","version":"3.6.1","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.6.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2pr6-76vf-7546","dataSource":"https://github.com/advisories/GHSA-2pr6-76vf-7546","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/issues/475","https://github.com/nodeca/js-yaml/commit/a567ef3c6e61eb319f0bfc2671d91061afb01235","https://www.npmjs.com/advisories/788","https://www.npmjs.com/advisories/788/versions","https://snyk.io/vuln/SNYK-JS-JSYAML-173999"],"description":"Denial of Service in js-yaml","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["3.13.0"],"state":"fixed","available":[{"version":"3.13.0","date":"2020-09-12","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.7.0"}},"found":{"vulnerabilityID":"GHSA-2pr6-76vf-7546","versionConstraint":"<3.13.0 (semantic)"},"fix":{"suggestedVersion":"3.13.0"}}],"artifact":{"id":"pkg:npm/js-yaml@3.7.0?package-id=a0f85ddb9679f590","name":"js-yaml","version":"3.7.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.7.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.7.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-253c-mchw-3w2r","dataSource":"https://github.com/advisories/GHSA-253c-mchw-3w2r","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/markdown-it/markdown-it/security/advisories/GHSA-253c-mchw-3w2r","https://github.com/markdown-it/markdown-it/commit/09fa07118dda4c953f058848f53dae88395618ca","https://github.com/markdown-it/markdown-it/commit/aaadcfa6d817b3c5f89afb49d97c7b797a6dd4fd","https://github.com/markdown-it/markdown-it/commit/ad70f6b7cff64bee10e42a774147112480ca0d49"],"description":"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"fix":{"versions":["14.3.1"],"state":"fixed","available":[{"version":"14.3.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"markdown-it","version":"8.4.2"}},"found":{"vulnerabilityID":"GHSA-253c-mchw-3w2r","versionConstraint":"<14.3.1 (semantic)"},"fix":{"suggestedVersion":"14.3.1"}}],"artifact":{"id":"pkg:npm/markdown-it@8.4.2?package-id=26992563bba8d2e3","name":"markdown-it","version":"8.4.2","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:markdown-it_project:markdown-it:8.4.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/markdown-it@8.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4xcv-9jjx-gfj3","dataSource":"https://github.com/advisories/GHSA-4xcv-9jjx-gfj3","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/sindresorhus/mem/commit/da4e4398cb27b602de3bd55f746efa9b4a31702b","https://bugzilla.redhat.com/show_bug.cgi?id=1623744","https://www.npmjs.com/advisories/1084","https://snyk.io/vuln/npm:mem:20180117"],"description":"Denial of Service in mem","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.1,"exploitabilityScore":1.5,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["4.0.0"],"state":"fixed","available":[{"version":"4.0.0","date":"2020-09-12","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"mem","version":"1.1.0"}},"found":{"vulnerabilityID":"GHSA-4xcv-9jjx-gfj3","versionConstraint":"<4.0.0 (semantic)"},"fix":{"suggestedVersion":"4.0.0"}}],"artifact":{"id":"pkg:npm/mem@1.1.0?package-id=64238d9053f24e9c","name":"mem","version":"1.1.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:mem:mem:1.1.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/mem@1.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-j965-2qgj-vjmq","dataSource":"https://github.com/advisories/GHSA-j965-2qgj-vjmq","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/aws/aws-sdk-js/security/advisories/GHSA-j965-2qgj-vjmq"],"description":"JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"aws-sdk","version":"2.0.31"}},"found":{"vulnerabilityID":"GHSA-j965-2qgj-vjmq","versionConstraint":">=2.0.0,<=3.0.0 (semantic)"}}],"artifact":{"id":"pkg:npm/aws-sdk@2.0.31?package-id=cf51df77075ade7c","name":"aws-sdk","version":"2.0.31","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:amazon:aws_sdk_for_javascipt:2.0.31:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/aws-sdk@2.0.31","upstreams":[]}},{"vulnerability":{"id":"GHSA-j965-2qgj-vjmq","dataSource":"https://github.com/advisories/GHSA-j965-2qgj-vjmq","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/aws/aws-sdk-js/security/advisories/GHSA-j965-2qgj-vjmq"],"description":"JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"aws-sdk","version":"2.847.0"}},"found":{"vulnerabilityID":"GHSA-j965-2qgj-vjmq","versionConstraint":">=2.0.0,<=3.0.0 (semantic)"}}],"artifact":{"id":"pkg:npm/aws-sdk@2.847.0?package-id=fc0360e6b45fdcb4","name":"aws-sdk","version":"2.847.0","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:amazon:aws_sdk_for_javascipt:2.847.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/aws-sdk@2.847.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-wxhq-pm8v-cw75","dataSource":"https://github.com/advisories/GHSA-wxhq-pm8v-cw75","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/jakubpawlowicz/clean-css/commit/2929bafbf8cdf7dccb24e0949c70833764fa87e3","https://www.npmjs.com/advisories/785"],"description":"Regular Expression Denial of Service in clean-css","cvss":[],"fix":{"versions":["4.1.11"],"state":"fixed","available":[{"version":"4.1.11","date":"2020-09-12","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"clean-css","version":"3.4.28"}},"found":{"vulnerabilityID":"GHSA-wxhq-pm8v-cw75","versionConstraint":"<4.1.11 (semantic)"},"fix":{"suggestedVersion":"4.1.11"}}],"artifact":{"id":"pkg:npm/clean-css@3.4.28?package-id=d5a9fb4fe989e110","name":"clean-css","version":"3.4.28","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:clean-css:clean-css:3.4.28:*:*:*:*:*:*:*","cpe:2.3:a:clean-css:clean_css:3.4.28:*:*:*:*:*:*:*","cpe:2.3:a:clean_css:clean-css:3.4.28:*:*:*:*:*:*:*","cpe:2.3:a:clean_css:clean_css:3.4.28:*:*:*:*:*:*:*","cpe:2.3:a:clean:clean-css:3.4.28:*:*:*:*:*:*:*","cpe:2.3:a:clean:clean_css:3.4.28:*:*:*:*:*:*:*"],"purl":"pkg:npm/clean-css@3.4.28","upstreams":[]}},{"vulnerability":{"id":"GHSA-442j-39wm-28r2","dataSource":"https://github.com/advisories/GHSA-442j-39wm-28r2","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-442j-39wm-28r2","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"],"description":"Handlebars.js has a Property Access Validation Bypass in container.lookup","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["4.7.9"],"state":"fixed","available":[{"version":"4.7.9","date":"2026-03-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"handlebars","version":"4.7.7"}},"found":{"vulnerabilityID":"GHSA-442j-39wm-28r2","versionConstraint":">=4.0.0,<=4.7.8 (semantic)"},"fix":{"suggestedVersion":"4.7.9"}}],"artifact":{"id":"pkg:npm/handlebars@4.7.7?package-id=94a6b0a915fbcc9f","name":"handlebars","version":"4.7.7","type":"npm","locations":[{"path":"/package-lock.json","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:handlebars.js_project:handlebars.js:4.7.7:*:*:*:*:node.js:*:*","cpe:2.3:a:handlebarsjs:handlebars:4.7.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/handlebars@4.7.7","upstreams":[]}}],"source":{"type":"file","target":"draios/sysdig-inspect"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:07:16.702544111Z"}}