Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

pregasquad/PREGA

https://github.com/pregasquad/PREGA · scanned 2026-09-01 12:04 UTC (1 month, 3 weeks ago)

280 raw signals (0 security + 280 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 3 weeks ago · v1 · 280 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
76.8
/100
Security checks
77
0 findings
System graph
77
100.0% cov · 280 findings
Critical
3
click to filter
Agents
10
2 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: severity: high × excluding tests × Reset all
Severity: Critical 3 High 110 Medium 93 Low 53 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 280 Crowd 0 Layer: Frontend 30 Security 184 Hardware 2 Cicd 1 Quality 29 Dependencies 26 Api 8
Scan summary Repository scanned at 76.8/100 with 100.0% coverage. It contains 2239 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 280 findings — concentrated in security (184), frontend (30), quality (29). Risk profile is high: 3 critical, 110 high, 93 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 110 of 280 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 2.5.5 — .migration-backup/package-lock.json
form-data: form-data: Form field override via CRLF injection form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…
VulnCve 2026 12143 1 TP · 0 FP
high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 2.5.5 — pnpm-lock.yaml
form-data: form-data: Form field override via CRLF injection form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…
VulnCve 2026 12143
high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 4.0.5 — .migration-backup/package-lock.json
form-data: form-data: Form field override via CRLF injection form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…
VulnCve 2026 12143
high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 4.0.5 — pnpm-lock.yaml
form-data: form-data: Form field override via CRLF injection form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…
VulnCve 2026 12143
high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 2.0.2 — .migration-backup/package-lock.json
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-13676: fast-uri 3.1.0 — .migration-backup/package-lock.json
fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, …
VulnCve 2026 13676
high System graph security Trivy conf 1.00 CVE-2026-14257: brace-expansion 2.0.2 — .migration-backup/package-lock.json
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the lengt…
VulnCve 2026 14257
high System graph security Trivy conf 1.00 CVE-2026-16221: fast-uri 3.1.0 — .migration-backup/package-lock.json
fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL p…
VulnCve 2026 16221
high System graph security Trivy conf 1.00 CVE-2026-18446: fast-uri 3.1.0 — .migration-backup/package-lock.json
fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash bac…
VulnCve 2026 18446
high System graph security Trivy conf 1.00 CVE-2026-23745: tar 6.2.1 — .migration-backup/package-lock.json
node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure be…
VulnCve 2026 23745
high System graph security Trivy conf 1.00 CVE-2026-23950: tar 6.2.1 — .migration-backup/package-lock.json
node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On c…
VulnCve 2026 23950
high System graph security Trivy conf 1.00 CVE-2026-24842: tar 6.2.1 — .migration-backup/package-lock.json
node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink crea…
VulnCve 2026 24842
high System graph security Trivy conf 1.00 CVE-2026-25547: @isaacs/brace-expansion 5.0.0 — .migration-backup/package-lock.json
brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range e…
VulnCve 2026 25547
high System graph security Trivy conf 1.00 CVE-2026-25639: axios 1.13.2 — .migration-backup/package-lock.json
axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ a…
VulnCve 2026 25639
high System graph security Trivy conf 1.00 CVE-2026-26278: fast-xml-parser 5.3.5 — .migration-backup/package-lock.json
fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to d…
VulnCve 2026 26278
high System graph security Trivy conf 1.00 CVE-2026-26960: tar 6.2.1 — .migration-backup/package-lock.json
node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outs…
VulnCve 2026 26960
high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 10.1.1 — .migration-backup/package-lock.json
minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …
VulnCve 2026 26996
high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 5.1.6 — .migration-backup/package-lock.json
minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …
VulnCve 2026 26996
high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 9.0.5 — .migration-backup/package-lock.json
minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …
VulnCve 2026 26996
high System graph security Trivy conf 1.00 CVE-2026-27606: rollup 2.79.2 — .migration-backup/package-lock.json
rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal.…
VulnCve 2026 27606
high System graph security Trivy conf 1.00 CVE-2026-27606: rollup 4.54.0 — .migration-backup/package-lock.json
rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal.…
VulnCve 2026 27606
high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 10.1.1 — .migration-backup/package-lock.json
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…
VulnCve 2026 27903
high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 5.1.6 — .migration-backup/package-lock.json
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…
VulnCve 2026 27903
high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 9.0.5 — .migration-backup/package-lock.json
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…
VulnCve 2026 27903
high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 10.1.1 — .migration-backup/package-lock.json
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…
VulnCve 2026 27904
high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 5.1.6 — .migration-backup/package-lock.json
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…
VulnCve 2026 27904
high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 9.0.5 — .migration-backup/package-lock.json
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…
VulnCve 2026 27904
high System graph security Trivy conf 1.00 CVE-2026-29786: tar 6.2.1 — .migration-backup/package-lock.json
node-tar: hardlink path traversal via drive-relative linkpath node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables …
VulnCve 2026 29786
high System graph security Trivy conf 1.00 CVE-2026-31802: tar 6.2.1 — .migration-backup/package-lock.json
tar: tar: File overwrite via drive-relative symlink traversal node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, …
VulnCve 2026 31802
high System graph security Trivy conf 1.00 CVE-2026-33036: fast-xml-parser 5.3.5 — .migration-backup/package-lock.json
fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, …
VulnCve 2026 33036
high System graph security Trivy conf 1.00 CVE-2026-33151: socket.io-parser 4.2.5 — .migration-backup/package-lock.json
socket.io: Socket.IO: Denial of Service due to excessive buffering of specially crafted packets Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for …
VulnCve 2026 33151
high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 2.3.1 — .migration-backup/package-lock.json
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…
VulnCve 2026 33671
high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 4.0.3 — .migration-backup/package-lock.json
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…
VulnCve 2026 33671
high System graph security Trivy conf 1.00 CVE-2026-34601: @xmldom/xmldom 0.8.11 — .migration-backup/package-lock.json
xmldom: xmldom: XML structure injection via CDATA terminator xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-control…
VulnCve 2026 34601
high System graph security Trivy conf 1.00 CVE-2026-39356: drizzle-orm 0.39.3 — .migration-backup/package-lock.json
Drizzle ORM has SQL injection via improperly escaped SQL identifiers Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimite…
VulnCve 2026 39356
high System graph security Trivy conf 1.00 CVE-2026-39363: vite 7.3.0 — .migration-backup/package-lock.json
Vite: Vite: Information disclosure via WebSocket connection bypasses access control Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fe…
VulnCve 2026 39363
high System graph security Trivy conf 1.00 CVE-2026-39364: vite 7.3.0 — .migration-backup/package-lock.json
vite: Vite: Information disclosure via query parameter manipulation on the development server Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with …
VulnCve 2026 39364
high System graph security Trivy conf 1.00 CVE-2026-41672: @xmldom/xmldom 0.8.11 — .migration-backup/package-lock.json
xmldom: @xmldom/xmldom: xmldom: Arbitrary XML Node Injection xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlle…
VulnCve 2026 41672
high System graph security Trivy conf 1.00 CVE-2026-41673: @xmldom/xmldom 0.8.11 — .migration-backup/package-lock.json
@xmldom/xmldom: xmldom: xmldom: Denial of Service via deeply nested XML documents xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive …
VulnCve 2026 41673
high System graph security Trivy conf 1.00 CVE-2026-41674: @xmldom/xmldom 0.8.11 — .migration-backup/package-lock.json
xmldom: xmldom: Arbitrary XML markup injection xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (in…
VulnCve 2026 41674
high System graph security Trivy conf 1.00 CVE-2026-41675: @xmldom/xmldom 0.8.11 — .migration-backup/package-lock.json
xmldom: xmldom: Arbitrary XML node injection via crafted processing instructions xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allow…
VulnCve 2026 41675
high System graph security Trivy conf 1.00 CVE-2026-42033: axios 1.13.2 — .migration-backup/package-lock.json
axios: Axios: HTTP Transport Hijacking via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) s…
VulnCve 2026 42033
high System graph security Trivy conf 1.00 CVE-2026-42035: axios 1.13.2 — .migration-backup/package-lock.json
axios: Axios: Arbitrary HTTP header injection via prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP …
VulnCve 2026 42035
high System graph security Trivy conf 1.00 CVE-2026-42043: axios 1.13.2 — .migration-backup/package-lock.json
axios: Axios: NO_PROXY bypass via crafted URL Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the …
VulnCve 2026 42043
high System graph security Trivy conf 1.00 CVE-2026-42264: axios 1.13.2 — .migration-backup/package-lock.json
axios: Axios: Prototype pollution allows information disclosure and request manipulation Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the…
VulnCve 2026 42264
high System graph security Trivy conf 1.00 CVE-2026-44289: protobufjs 6.8.8 — .migration-backup/package-lock.json
protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skippi…
VulnCve 2026 44289
high System graph security Trivy conf 1.00 CVE-2026-44290: protobufjs 6.8.8 — .migration-backup/package-lock.json
protobufjs: protobufjs: Denial of Service via crafted schema protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf …
VulnCve 2026 44290
high System graph security Trivy conf 1.00 CVE-2026-44291: protobufjs 6.8.8 — .migration-backup/package-lock.json
protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode fu…
VulnCve 2026 44291
high System graph security Trivy conf 1.00 CVE-2026-44293: protobufjs 6.8.8 — .migration-backup/package-lock.json
protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe …
VulnCve 2026 44293
high System graph security Trivy conf 1.00 CVE-2026-44486: axios 1.13.2 — .migration-backup/package-lock.json
axios: Axios: Information disclosure of proxy credentials via HTTP redirects Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent throug…
VulnCve 2026 44486
high System graph security Trivy conf 1.00 CVE-2026-44487: axios 1.13.2 — .migration-backup/package-lock.json
axios: Axios: Information disclosure of proxy credentials via redirect flows Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct re…
VulnCve 2026 44487
high System graph security Trivy conf 1.00 CVE-2026-44488: axios 1.13.2 — .migration-backup/package-lock.json
axios: Axios: Denial of Service due to unenforced request and response size limits Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Appli…
VulnCve 2026 44488
high System graph security Trivy conf 1.00 CVE-2026-44494: axios 1.13.2 — .migration-backup/package-lock.json
axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the applicatio…
VulnCve 2026 44494
high System graph security Trivy conf 1.00 CVE-2026-44495: axios 1.13.2 — .migration-backup/package-lock.json
axios: Axios: Information disclosure due to prototype pollution vulnerability Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same Jav…
VulnCve 2026 44495
high System graph security Trivy conf 1.00 CVE-2026-44496: axios 1.13.2 — .migration-backup/package-lock.json
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF co…
VulnCve 2026 44496
high System graph security Trivy conf 1.00 CVE-2026-44728: @babel/plugin-transform-modules-systemjs 7.28.5 — .migration-backup/package-lock.json
Babel is a compiler for writing next generation JavaScript. From 7.12. ... Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code t…
VulnCve 2026 44728
high System graph security Trivy conf 1.00 CVE-2026-45623: postcss 8.5.6 — .migration-backup/package-lock.json
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PA…
VulnCve 2026 45623
high System graph security Trivy conf 1.00 CVE-2026-4800: lodash 4.17.23 — .migration-backup/package-lock.json
lodash: lodash: Arbitrary code execution via untrusted input in template imports Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both p…
VulnCve 2026 4800
high System graph security Trivy conf 1.00 CVE-2026-4867: path-to-regexp 0.1.12 — .migration-backup/package-lock.json
path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c o…
VulnCve 2026 4867
high System graph security Trivy conf 1.00 CVE-2026-48712: protobufjs 6.8.8 — .migration-backup/package-lock.json
protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or…
VulnCve 2026 48712
high System graph security Trivy conf 1.00 CVE-2026-48712: protobufjs 7.5.6 — .migration-backup/package-lock.json
protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or…
VulnCve 2026 48712
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.18.3 — .migration-backup/package-lock.json
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.20.1 — pnpm-lock.yaml
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-5079: multer 2.1.1 — .migration-backup/package-lock.json
multer: Multer: Denial of Service via deeply nested field names in multipart form data Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in fi…
VulnCve 2026 5079
high System graph security Trivy conf 1.00 CVE-2026-5079: multer 2.1.1 — pnpm-lock.yaml
multer: Multer: Denial of Service via deeply nested field names in multipart form data Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in fi…
VulnCve 2026 5079
high System graph security Trivy conf 1.00 CVE-2026-53571: vite 7.3.0 — .migration-backup/package-lock.json
vite: `server.fs.deny` bypass on Windows alternate paths Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive…
VulnCve 2026 53571
high System graph security Trivy conf 1.00 CVE-2026-59724: engine.io 6.6.5 — .migration-backup/package-lock.json
engine.io: Engine.IO: Denial of Service via crafted WebTransport session ID Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited…
VulnCve 2026 59724
high System graph security Trivy conf 1.00 CVE-2026-59725: engine.io 6.6.5 — .migration-backup/package-lock.json
socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST r…
VulnCve 2026 59725
high System graph security Trivy conf 1.00 CVE-2026-59874: tar 6.2.1 — .migration-backup/package-lock.json
tar: Node-tar: Denial of Service via malformed tar archive header node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeated…
VulnCve 2026 59874
high System graph security Trivy conf 1.00 CVE-2026-6321: fast-uri 3.1.0 — .migration-backup/package-lock.json
fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory r…
VulnCve 2026 6321
high System graph security Trivy conf 1.00 CVE-2026-6322: fast-uri 3.1.0 — .migration-backup/package-lock.json
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a…
VulnCve 2026 6322
high System graph security Trivy conf 1.00 CVE-2026-67213: nanoid 3.3.11 — .migration-backup/package-lock.json
nanoid: nanoid: Denial of Service via infinite loop in random ID generation nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit conditio…
VulnCve 2026 67213
high System graph security Trivy conf 1.00 CVE-2026-67213: nanoid 3.3.12 — pnpm-lock.yaml
nanoid: nanoid: Denial of Service via infinite loop in random ID generation nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit conditio…
VulnCve 2026 67213
high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 3.3.11 — .migration-backup/package-lock.json
nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …
VulnCve 2026 67214
high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 3.3.12 — pnpm-lock.yaml
nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …
VulnCve 2026 67214
high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 5.1.11 — pnpm-lock.yaml
nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …
VulnCve 2026 67214
high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 5.1.6 — .migration-backup/package-lock.json
nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …
VulnCve 2026 67214
high System graph security Trivy conf 1.00 CVE-2026-69152: brace-expansion 2.0.2 — .migration-backup/package-lock.json
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-altern…
VulnCve 2026 69152
high System graph security Trivy conf 1.00 CVE-2026-69185: socket.io-parser 4.2.5 — .migration-backup/package-lock.json
socket.io-parser: Socket.IO: Denial of Service via memory exhaustion from crafted packets Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary a…
VulnCve 2026 69185
high System graph security Trivy conf 1.00 CVE-2026-69185: socket.io-parser 4.2.6 — pnpm-lock.yaml
socket.io-parser: Socket.IO: Denial of Service via memory exhaustion from crafted packets Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary a…
VulnCve 2026 69185
high System graph security Trivy conf 1.00 CVE-2026-73566: tar 6.2.1 — .migration-backup/package-lock.json
tar: node-tar: Denial of Service via crafted long-path tar archive node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when ta…
VulnCve 2026 73566
high System graph security Trivy conf 1.00 CVE-2026-73646: postcss 8.5.15 — pnpm-lock.yaml
postcss: PostCSS: Information disclosure via path traversal in source map auto-loading PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sour…
VulnCve 2026 73646
high System graph security Trivy conf 1.00 CVE-2026-73646: postcss 8.5.6 — .migration-backup/package-lock.json
postcss: PostCSS: Information disclosure via path traversal in source map auto-loading PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sour…
VulnCve 2026 73646
high System graph api Wiring conf 0.90 Dangling fetch: DELETE /api/appointments/${id} (artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:131)
`artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:131` calls `DELETE /api/appointments/${id}` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matchi…
artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:131 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: GET /api/export/${type} (artifacts/pregasquad-manager/src/pages/AdminSettings.tsx:531)
`artifacts/pregasquad-manager/src/pages/AdminSettings.tsx:531` calls `GET /api/export/${type}` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/ex…
artifacts/pregasquad-manager/src/pages/AdminSettings.tsx:531 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: GET /api/notifications/broadcast/last (artifacts/pregasquad-manager/src/pages/WhatsApp.tsx:1025)
`artifacts/pregasquad-manager/src/pages/WhatsApp.tsx:1025` calls `GET /api/notifications/broadcast/last` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matc…
artifacts/pregasquad-manager/src/pages/WhatsApp.tsx:1025 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: POST /api/appointments (artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:108)
`artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:108` calls `POST /api/appointments` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/ap…
artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:108 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: POST /api/appointments (artifacts/pregasquad-manager/src/pages/Clients.tsx:264)
`artifacts/pregasquad-manager/src/pages/Clients.tsx:264` calls `POST /api/appointments` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/appointme…
artifacts/pregasquad-manager/src/pages/Clients.tsx:264 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: POST /api/appointments (artifacts/pregasquad-manager/src/pages/POS.tsx:195)
`artifacts/pregasquad-manager/src/pages/POS.tsx:195` calls `POST /api/appointments` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/appointments`
artifacts/pregasquad-manager/src/pages/POS.tsx:195 Dangling fetchFetch
high System graph api Wiring conf 0.90 Dangling fetch: PUT /api/appointments/${id} (artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:92)
`artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:92` calls `PUT /api/appointments/${id}` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: …
artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:92 Dangling fetchFetch
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — .migration-backup/Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: .migration-backup/Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile.api
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile.api
Misconfig
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile.manager
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile.manager
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — Dockerfile.api
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*' Rule: DS-0029 Severity: HIGH Target: Dockerfile.api
Misconfig
high System graph security Trivy conf 1.00 GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 — .migration-backup/package-lock.json
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() ### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` i…
VulnGhsa 5c6j r48x rmvq
high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.34.5 — .migration-backup/package-lock.json
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…
VulnGhsa f88m g3jw g9cj
high System graph security Trivy conf 1.00 GHSA-gcfj-64vw-6mp9: axios 1.16.1 — pnpm-lock.yaml
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning ## Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when `Object.prototype.proxy` is polluted and request configuration is materialized as a regular object before dispatc…
VulnGhsa gcfj 64vw 6mp9
high System graph security Semgrep conf 0.75 react insecure request — .migration-backup/server/replit_integrations/object_storage/objectStorage.ts:280
Unencrypted request over HTTP detected. Rule: typescript.react.security.react-insecure-request.react-insecure-request Severity: ERROR OWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures CWE: CWE-319: Cleartext Transmission of Sensitive In…
.migration-backup/server/replit_integrations/object_storage/objectStorage.ts:280 SecurityReact
high System graph security Semgrep conf 0.75 react insecure request — artifacts/api-server/src/replit_integrations/object_storage/objectStorage.ts:280
Unencrypted request over HTTP detected. Rule: typescript.react.security.react-insecure-request.react-insecure-request Severity: ERROR OWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures CWE: CWE-319: Cleartext Transmission of Sensitive In…
artifacts/api-server/src/replit_integrations/object_storage/objectStorage.ts:280 SecurityReact
high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — .migration-backup/server/certs/qz-private-key.pem
Trivy detected a possible secret in `.migration-backup/server/certs/qz-private-key.pem`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or environm…
Secret
high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — artifacts/api-server/server/certs/qz-private-key.pem
Trivy detected a possible secret in `artifacts/api-server/server/certs/qz-private-key.pem`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or envir…
Secret
high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — artifacts/api-server/src/certs/qz-private-key.pem
Trivy detected a possible secret in `artifacts/api-server/src/certs/qz-private-key.pem`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or environm…
Secret
high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — server/certs/qz-private-key.pem
Trivy detected a possible secret in `server/certs/qz-private-key.pem`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or environment variables.
Secret
high System graph dependencies dependencies conf 1.00 Vulnerable dependency multer 2.1.1: GHSA-72gw-mp4g-v24j
OSV.dev reports `multer` at version `2.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-72gw-mp4g-v24j (aka CVE-2026-5079). Multer vulnerable to Denial of Service via deeply nested field names Aliases: CVE-2026-5079 Advisory: https://osv.dev/vulnerability/GHSA-72gw-mp4g-v24j Fix: upgrade `…
artifacts/api-server/package.json ScaOsvGhsa 72gw mp4g v24j
high System graph dependencies dependencies conf 0.90 Vulnerable dependency nanoid 3.3.12: GHSA-28wg-ghj8-5hjv
OSV.dev reports `nanoid` at version `3.3.12` (resolved in `artifacts/mockup-sandbox/package-lock.json`) is affected by GHSA-28wg-ghj8-5hjv (aka CVE-2026-67214). nanoid: non-secure generators can loop indefinitely with negative size Aliases: CVE-2026-67214 Advisory: https://osv.dev/vulnerability/G…
artifacts/mockup-sandbox/package-lock.json ScaOsvGhsa 28wg ghj8 5hjv
high System graph dependencies dependencies conf 0.90 Vulnerable dependency nanoid 3.3.12: GHSA-2v37-7h3g-55p8
OSV.dev reports `nanoid` at version `3.3.12` (resolved in `artifacts/mockup-sandbox/package-lock.json`) is affected by GHSA-2v37-7h3g-55p8 (aka CVE-2026-67213). nanoid: custom generators can loop indefinitely when size is zero Aliases: CVE-2026-67213 Advisory: https://osv.dev/vulnerability/GHSA-2…
artifacts/mockup-sandbox/package-lock.json ScaOsvGhsa 2v37 7h3g 55p8
high System graph dependencies dependencies conf 1.00 Vulnerable dependency nanoid 5.1.11: GHSA-28wg-ghj8-5hjv
OSV.dev reports `nanoid` at version `5.1.11` (resolved in `pnpm-lock.yaml`) is affected by GHSA-28wg-ghj8-5hjv (aka CVE-2026-67214). nanoid: non-secure generators can loop indefinitely with negative size Aliases: CVE-2026-67214 Advisory: https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv Fix: upgr…
artifacts/api-server/package.json ScaOsvGhsa 28wg ghj8 5hjv
high System graph dependencies dependencies conf 0.90 Vulnerable dependency vite 7.3.3: GHSA-fx2h-pf6j-xcff
OSV.dev reports `vite` at version `7.3.3` (resolved in `artifacts/mockup-sandbox/package-lock.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571). vite: `server.fs.deny` bypass on Windows alternate paths Aliases: CVE-2026-53571 Advisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcf…
artifacts/mockup-sandbox/package.json ScaOsvGhsa fx2h pf6j xcff
high System graph dependencies dependencies conf 1.00 Vulnerable dependency ws 8.20.1: GHSA-96hv-2xvq-fx4p
OSV.dev reports `ws` at version `8.20.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779). ws: Memory exhaustion DoS from tiny fragments and data chunks Aliases: CVE-2026-48779 Advisory: https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p Fix: upgrade `ws` past…
pnpm-lock.yaml ScaOsvGhsa 96hv 2xvq fx4p
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/27185afd-42ec-4e25-9404-3a8383de3555/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/27185afd-42ec-4e25-9404-3a8383de3555/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.