Your dependencies cross-checked against the OSV vulnerability database.
-
Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
-
Serious GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-47429). Fix: Update that package to its patched version.
-
Worth fixing GHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2025-27789). Fix: Update that package to its patched version.
-
Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
-
Worth fixing GHSA-hmw2-7cc7-3qxx form-data: CRLF injection in form-data via unescaped multipart field names and filenames
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-12143). Fix: Update that package to its patched version.
-
Worth fixing GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-59869). Fix: Update that package to its patched version.
-
Worth fixing GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole. Fix: Update that package to its patched version.
-
Worth fixing GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-53550). Fix: Update that package to its patched version.
-
Worth fixing GHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<)
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2025-64718). Fix: Update that package to its patched version.
-
Worth fixing GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2025-13465). Fix: Update that package to its patched version.
-
Worth fixing GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2021-23337). Fix: Update that package to its patched version.
-
Worth fixing GHSA-28wg-ghj8-5hjv nanoid: non-secure generators can loop indefinitely with negative size
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-67214). Fix: Update that package to its patched version.
-
Worth fixing GHSA-2v37-7h3g-55p8 nanoid: custom generators can loop indefinitely when size is zero
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-67213). Fix: Update that package to its patched version.
-
Worth fixing GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-33672). Fix: Update that package to its patched version.
-
Worth fixing GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-33671). Fix: Update that package to its patched version.
-
Worth fixing GHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-45623). Fix: Update that package to its patched version.
-
Worth fixing GHSA-fxqj-rqcc-2cmp PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-69153). Fix: Update that package to its patched version.
-
Worth fixing GHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-41305). Fix: Update that package to its patched version.
-
Worth fixing GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole. Fix: Update that package to its patched version.
-
Worth fixing GHSA-6rw7-vpxm-498p qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2025-15284). Fix: Update that package to its patched version.
-
Worth fixing GHSA-p8p7-x288-28g6 Server-Side Request Forgery in Request
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2023-28155). Fix: Update that package to its patched version.
-
Worth fixing GHSA-mw96-cpmx-2vgc Rollup 4 has Arbitrary File Write via Path Traversal
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-27606). Fix: Update that package to its patched version.
-
Worth fixing GHSA-ph9p-34f9-6g65 tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-44705). Fix: Update that package to its patched version.
-
Worth fixing GHSA-72xf-g2v4-qvf3 tough-cookie Prototype Pollution vulnerability
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2023-26136). Fix: Update that package to its patched version.
-
Worth fixing GHSA-w5hq-g745-h8pq uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
/workdirs/scan-84bca524-3a67-4d3d-877a-d957ec8c48d8/pnpm-lock.yaml
A package you depend on has a known security hole (CVE-2026-41907). Fix: Update that package to its patched version.