Your dependencies cross-checked against the OSV vulnerability database.
-
Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
-
Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
-
Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
-
Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
-
Worth fixing GHSA-3xgq-45jj-v275 Regular Expression Denial of Service (ReDoS) in cross-spawn
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2024-21538). Fix: Update that package to its patched version.
-
Worth fixing GHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the response
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole. Fix: Update that package to its patched version.
-
Worth fixing GHSA-5j98-mcp5-4vw2 glob CLI: Command injection via -c/--cmd executes matches with shell:true
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2025-64756). Fix: Update that package to its patched version.
-
Worth fixing GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
-
Worth fixing GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
-
Worth fixing GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
-
Worth fixing GHSA-mwcw-c2x4-8c55 Predictable results in nanoid generation when given non-integer values
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2024-55565). Fix: Update that package to its patched version.
-
Worth fixing GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-33672). Fix: Update that package to its patched version.
-
Worth fixing GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-33671). Fix: Update that package to its patched version.
-
Worth fixing GHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-45623). Fix: Update that package to its patched version.
-
Worth fixing GHSA-fxqj-rqcc-2cmp PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-69153). Fix: Update that package to its patched version.
-
Worth fixing GHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-41305). Fix: Update that package to its patched version.
-
Worth fixing GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole. Fix: Update that package to its patched version.
-
Worth fixing GHSA-mw96-cpmx-2vgc Rollup 4 has Arbitrary File Write via Path Traversal
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-27606). Fix: Update that package to its patched version.
-
Worth fixing GHSA-356w-63v5-8wf4 Vite has an `server.fs.deny` bypass with an invalid `request-target`
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2025-32395). Fix: Update that package to its patched version.
-
Worth fixing GHSA-4r4m-qw57-chr8 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2025-31125). Fix: Update that package to its patched version.
-
Worth fixing GHSA-4w7w-66w2-5vf9 Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-39365). Fix: Update that package to its patched version.
-
Worth fixing GHSA-859w-5945-r5v3 Vite's server.fs.deny bypassed with /. for files under project root
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2025-46565). Fix: Update that package to its patched version.
-
Worth fixing GHSA-93m4-6634-74q7 vite allows server.fs.deny bypass via backslash on Windows
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2025-62522). Fix: Update that package to its patched version.
-
Worth fixing GHSA-c27g-q93r-2cwf launch-editor vulnerable to command injection via the crafted request on Windows
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2024-52011). Fix: Update that package to its patched version.
-
Worth fixing GHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate paths
/workdirs/scan-f6513527-5ab1-43b6-baf1-eed85c887fc7/yarn.lock
A package you depend on has a known security hole (CVE-2026-53571). Fix: Update that package to its patched version.