juliusmarminge/form

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  nx.json:4
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2025-55182 next: React Server Components: Pre-authentication remote code execution via unsafe deserialization
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-55182). Fix: Update that package to its patched version.
• Serious CVE-2026-59940 seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-59940). Fix: Update that package to its patched version.
• Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-66035 angular: Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-66035). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50170 @angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-50170). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50171 @angular/common: Angular @angular/common: Denial of Service via malformed digitsInfo parameter
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-50171). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54266 @angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54266). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54268 @angular/common: Angular @angular/common: Denial of Service via crafted date format string
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54268). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-68945 @angular/common: Angular: Cross-Request Response Reuse and State Poisoning in HttpTransferCache
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-68945). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-66412 angular: Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-66412). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-22610 angular: Angular: Cross-site scripting vulnerability in Template Compiler
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-22610). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-32635 @angular/core: @angular/compiler: Angular has XSS in i18n attribute bindings
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-32635). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69151 @angular/compiler: @angular/core: Angular: Cross-Site Scripting via internationalization event handlers
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-69151). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50557 @angular/compiler: @angular/core: Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-50557). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54265 @angular/compiler: Angular: Two-Way Property Binding Sanitization Bypass (XSS)
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54265). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-22610 angular: Angular: Cross-site scripting vulnerability in Template Compiler
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-22610). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27970 @angular/core: Angular: Cross-site scripting via compromised translation files
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-27970). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-32635 @angular/core: @angular/compiler: Angular has XSS in i18n attribute bindings
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-32635). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54267 @angular/core: Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54267). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69151 @angular/compiler: @angular/core: Angular: Cross-Site Scripting via internationalization event handlers
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-69151). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-50557 @angular/compiler: @angular/core: Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-50557). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-52725 @angular/core: @angular/core: Cross-Site Scripting (XSS) via dynamic component creation bypass
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-52725). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-21884 react-router: @remix-run/react: React Router SSR XSS in ScrollRestoration
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-21884). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-22029 @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-22029). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-40181 react-router: React Router: Open redirect vulnerability via specially crafted URLs
  pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-40181). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-g93w-mfhg-p222 Angular vulnerable to XSS in i18n attribute bindings
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-32635). Fix: Update that package to its patched version.
• Serious GHSA-g93w-mfhg-p222 Angular vulnerable to XSS in i18n attribute bindings
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-32635). Fix: Update that package to its patched version.
• Serious GHSA-wf6x-7x77-mvgw Immutable is vulnerable to Prototype Pollution
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-29063). Fix: Update that package to its patched version.
• Serious GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Serious GHSA-mv8w-475r-vwqw seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-59940). Fix: Update that package to its patched version.
• Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
• Serious GHSA-hffm-xvc3-vprc simple-git is vulnerable to Remote Code Execution
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-6951). Fix: Update that package to its patched version.
• Serious GHSA-r275-fr43-pm7q simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-28292). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-47429). Fix: Update that package to its patched version.
• Serious GHSA-xv26-6w52-cph6 websocket-driver: Message corruption via abuse of protocol length headers
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54466). Fix: Update that package to its patched version.
• Worth fixing GHSA-39pv-4j6c-2g6v @angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54266). Fix: Update that package to its patched version.
• Worth fixing GHSA-48r7-hpm6-gfxm @angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54268). Fix: Update that package to its patched version.
• Worth fixing GHSA-58c5-g7wp-6w37 Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-66035). Fix: Update that package to its patched version.
• Worth fixing GHSA-jhpw-976m-542j Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-68945). Fix: Update that package to its patched version.
• Worth fixing GHSA-p3vc-36g9-x9gr @angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-50171). Fix: Update that package to its patched version.
• Worth fixing GHSA-q6f4-qqrg-jv6x @angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-50170). Fix: Update that package to its patched version.
• Worth fixing GHSA-58w9-8g37-x9v5 @angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-54265). Fix: Update that package to its patched version.
• Worth fixing GHSA-f3m7-gqxr-g87x Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-50557). Fix: Update that package to its patched version.
• Worth fixing GHSA-jj27-h5hq-8x99 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-69151). Fix: Update that package to its patched version.
• Worth fixing GHSA-jrmj-c5cx-3cw6 Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-22610). Fix: Update that package to its patched version.
• Worth fixing GHSA-v4hv-rgfq-gp49 Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2025-66412). Fix: Update that package to its patched version.
• Worth fixing GHSA-692r-grfm-v8x7 @angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-52725). Fix: Update that package to its patched version.
• Worth fixing GHSA-f3m7-gqxr-g87x Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
  /workdirs/scan-acc3c7cd-8dca-41ab-8c5d-86ae6fd7fe80/pnpm-lock.yaml
  A package you depend on has a known security hole (CVE-2026-50557). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout