critical System graph security Trivy conf 1.00 CVE-2026-41242: protobufjs 6.8.8 — .migration-backup/package-lock.json

protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will …

VulnCve 2026 41242 1 TP · 0 FP

critical System graph security Trivy conf 1.00 CVE-2026-48063: @whiskeysockets/baileys 7.0.0-rc.9 — .migration-backup/package-lock.json

Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via th…

VulnCve 2026 48063

critical System graph security Trivy conf 1.00 CVE-2026-59873: tar 6.2.1 — .migration-backup/package-lock.json

tar: node-tar: Denial of Service via crafted gzip bomb node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, a…

VulnCve 2026 59873

high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 2.5.5 — .migration-backup/package-lock.json

form-data: form-data: Form field override via CRLF injection form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…

VulnCve 2026 12143 1 TP · 0 FP

high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 2.5.5 — pnpm-lock.yaml

form-data: form-data: Form field override via CRLF injection form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…

VulnCve 2026 12143

high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 4.0.5 — .migration-backup/package-lock.json

form-data: form-data: Form field override via CRLF injection form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…

VulnCve 2026 12143

high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 4.0.5 — pnpm-lock.yaml

form-data: form-data: Form field override via CRLF injection form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…

VulnCve 2026 12143

high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 2.0.2 — .migration-backup/package-lock.json

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…

VulnCve 2026 13149

high System graph security Trivy conf 1.00 CVE-2026-13676: fast-uri 3.1.0 — .migration-backup/package-lock.json

fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, …

VulnCve 2026 13676

high System graph security Trivy conf 1.00 CVE-2026-14257: brace-expansion 2.0.2 — .migration-backup/package-lock.json

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the lengt…

VulnCve 2026 14257

high System graph security Trivy conf 1.00 CVE-2026-16221: fast-uri 3.1.0 — .migration-backup/package-lock.json

fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL p…

VulnCve 2026 16221

high System graph security Trivy conf 1.00 CVE-2026-18446: fast-uri 3.1.0 — .migration-backup/package-lock.json

fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash bac…

VulnCve 2026 18446

high System graph security Trivy conf 1.00 CVE-2026-23745: tar 6.2.1 — .migration-backup/package-lock.json

node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure be…

VulnCve 2026 23745

high System graph security Trivy conf 1.00 CVE-2026-23950: tar 6.2.1 — .migration-backup/package-lock.json

node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On c…

VulnCve 2026 23950

high System graph security Trivy conf 1.00 CVE-2026-24842: tar 6.2.1 — .migration-backup/package-lock.json

node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink crea…

VulnCve 2026 24842

high System graph security Trivy conf 1.00 CVE-2026-25547: @isaacs/brace-expansion 5.0.0 — .migration-backup/package-lock.json

brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range e…

VulnCve 2026 25547

high System graph security Trivy conf 1.00 CVE-2026-25639: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ a…

VulnCve 2026 25639

high System graph security Trivy conf 1.00 CVE-2026-26278: fast-xml-parser 5.3.5 — .migration-backup/package-lock.json

fast-xml-parser: fast-xml-parser: Denial of Service via unlimited XML entity expansion fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to d…

VulnCve 2026 26278

high System graph security Trivy conf 1.00 CVE-2026-26960: tar 6.2.1 — .migration-backup/package-lock.json

node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outs…

VulnCve 2026 26960

high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 10.1.1 — .migration-backup/package-lock.json

minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …

VulnCve 2026 26996

high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 5.1.6 — .migration-backup/package-lock.json

minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …

VulnCve 2026 26996

high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 9.0.5 — .migration-backup/package-lock.json

minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …

VulnCve 2026 26996

high System graph security Trivy conf 1.00 CVE-2026-27606: rollup 2.79.2 — .migration-backup/package-lock.json

rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal.…

VulnCve 2026 27606

high System graph security Trivy conf 1.00 CVE-2026-27606: rollup 4.54.0 — .migration-backup/package-lock.json

rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal.…

VulnCve 2026 27606

high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 10.1.1 — .migration-backup/package-lock.json

minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…

VulnCve 2026 27903

high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 5.1.6 — .migration-backup/package-lock.json

minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…

VulnCve 2026 27903

high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 9.0.5 — .migration-backup/package-lock.json

minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…

VulnCve 2026 27903

high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 10.1.1 — .migration-backup/package-lock.json

minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…

VulnCve 2026 27904

high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 5.1.6 — .migration-backup/package-lock.json

minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…

VulnCve 2026 27904

high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 9.0.5 — .migration-backup/package-lock.json

minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…

VulnCve 2026 27904

high System graph security Trivy conf 1.00 CVE-2026-29786: tar 6.2.1 — .migration-backup/package-lock.json

node-tar: hardlink path traversal via drive-relative linkpath node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables …

VulnCve 2026 29786

high System graph security Trivy conf 1.00 CVE-2026-31802: tar 6.2.1 — .migration-backup/package-lock.json

tar: tar: File overwrite via drive-relative symlink traversal node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, …

VulnCve 2026 31802

high System graph security Trivy conf 1.00 CVE-2026-33036: fast-xml-parser 5.3.5 — .migration-backup/package-lock.json

fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, …

VulnCve 2026 33036

high System graph security Trivy conf 1.00 CVE-2026-33151: socket.io-parser 4.2.5 — .migration-backup/package-lock.json

socket.io: Socket.IO: Denial of Service due to excessive buffering of specially crafted packets Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for …

VulnCve 2026 33151

high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 2.3.1 — .migration-backup/package-lock.json

picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…

VulnCve 2026 33671

high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 4.0.3 — .migration-backup/package-lock.json

picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…

VulnCve 2026 33671

high System graph security Trivy conf 1.00 CVE-2026-34601: @xmldom/xmldom 0.8.11 — .migration-backup/package-lock.json

xmldom: xmldom: XML structure injection via CDATA terminator xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-control…

VulnCve 2026 34601

high System graph security Trivy conf 1.00 CVE-2026-39356: drizzle-orm 0.39.3 — .migration-backup/package-lock.json

Drizzle ORM has SQL injection via improperly escaped SQL identifiers Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimite…

VulnCve 2026 39356

high System graph security Trivy conf 1.00 CVE-2026-39363: vite 7.3.0 — .migration-backup/package-lock.json

Vite: Vite: Information disclosure via WebSocket connection bypasses access control Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fe…

VulnCve 2026 39363

high System graph security Trivy conf 1.00 CVE-2026-39364: vite 7.3.0 — .migration-backup/package-lock.json

vite: Vite: Information disclosure via query parameter manipulation on the development server Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with …

VulnCve 2026 39364

high System graph security Trivy conf 1.00 CVE-2026-41672: @xmldom/xmldom 0.8.11 — .migration-backup/package-lock.json

xmldom: @xmldom/xmldom: xmldom: Arbitrary XML Node Injection xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlle…

VulnCve 2026 41672

high System graph security Trivy conf 1.00 CVE-2026-41673: @xmldom/xmldom 0.8.11 — .migration-backup/package-lock.json

@xmldom/xmldom: xmldom: xmldom: Denial of Service via deeply nested XML documents xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive …

VulnCve 2026 41673

high System graph security Trivy conf 1.00 CVE-2026-41674: @xmldom/xmldom 0.8.11 — .migration-backup/package-lock.json

xmldom: xmldom: Arbitrary XML markup injection xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (in…

VulnCve 2026 41674

high System graph security Trivy conf 1.00 CVE-2026-41675: @xmldom/xmldom 0.8.11 — .migration-backup/package-lock.json

xmldom: xmldom: Arbitrary XML node injection via crafted processing instructions xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allow…

VulnCve 2026 41675

high System graph security Trivy conf 1.00 CVE-2026-42033: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: HTTP Transport Hijacking via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) s…

VulnCve 2026 42033

high System graph security Trivy conf 1.00 CVE-2026-42035: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Arbitrary HTTP header injection via prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP …

VulnCve 2026 42035

high System graph security Trivy conf 1.00 CVE-2026-42043: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: NO_PROXY bypass via crafted URL Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the …

VulnCve 2026 42043

high System graph security Trivy conf 1.00 CVE-2026-42264: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Prototype pollution allows information disclosure and request manipulation Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the…

VulnCve 2026 42264

high System graph security Trivy conf 1.00 CVE-2026-44289: protobufjs 6.8.8 — .migration-backup/package-lock.json

protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skippi…

VulnCve 2026 44289

high System graph security Trivy conf 1.00 CVE-2026-44290: protobufjs 6.8.8 — .migration-backup/package-lock.json

protobufjs: protobufjs: Denial of Service via crafted schema protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf …

VulnCve 2026 44290

high System graph security Trivy conf 1.00 CVE-2026-44291: protobufjs 6.8.8 — .migration-backup/package-lock.json

protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode fu…

VulnCve 2026 44291

high System graph security Trivy conf 1.00 CVE-2026-44293: protobufjs 6.8.8 — .migration-backup/package-lock.json

protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe …

VulnCve 2026 44293

high System graph security Trivy conf 1.00 CVE-2026-44486: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Information disclosure of proxy credentials via HTTP redirects Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent throug…

VulnCve 2026 44486

high System graph security Trivy conf 1.00 CVE-2026-44487: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Information disclosure of proxy credentials via redirect flows Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct re…

VulnCve 2026 44487

high System graph security Trivy conf 1.00 CVE-2026-44488: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Denial of Service due to unenforced request and response size limits Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Appli…

VulnCve 2026 44488

high System graph security Trivy conf 1.00 CVE-2026-44494: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the applicatio…

VulnCve 2026 44494

high System graph security Trivy conf 1.00 CVE-2026-44495: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Information disclosure due to prototype pollution vulnerability Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same Jav…

VulnCve 2026 44495

high System graph security Trivy conf 1.00 CVE-2026-44496: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF co…

VulnCve 2026 44496

high System graph security Trivy conf 1.00 CVE-2026-44728: @babel/plugin-transform-modules-systemjs 7.28.5 — .migration-backup/package-lock.json

Babel is a compiler for writing next generation JavaScript. From 7.12. ... Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code t…

VulnCve 2026 44728

high System graph security Trivy conf 1.00 CVE-2026-45623: postcss 8.5.6 — .migration-backup/package-lock.json

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PA…

VulnCve 2026 45623

high System graph security Trivy conf 1.00 CVE-2026-4800: lodash 4.17.23 — .migration-backup/package-lock.json

lodash: lodash: Arbitrary code execution via untrusted input in template imports Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both p…

VulnCve 2026 4800

high System graph security Trivy conf 1.00 CVE-2026-4867: path-to-regexp 0.1.12 — .migration-backup/package-lock.json

path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c o…

VulnCve 2026 4867

high System graph security Trivy conf 1.00 CVE-2026-48712: protobufjs 6.8.8 — .migration-backup/package-lock.json

protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or…

VulnCve 2026 48712

high System graph security Trivy conf 1.00 CVE-2026-48712: protobufjs 7.5.6 — .migration-backup/package-lock.json

protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or…

VulnCve 2026 48712

high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.18.3 — .migration-backup/package-lock.json

ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…

VulnCve 2026 48779

high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.20.1 — pnpm-lock.yaml

ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…

VulnCve 2026 48779

high System graph security Trivy conf 1.00 CVE-2026-5079: multer 2.1.1 — .migration-backup/package-lock.json

multer: Multer: Denial of Service via deeply nested field names in multipart form data Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in fi…

VulnCve 2026 5079

high System graph security Trivy conf 1.00 CVE-2026-5079: multer 2.1.1 — pnpm-lock.yaml

multer: Multer: Denial of Service via deeply nested field names in multipart form data Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in fi…

VulnCve 2026 5079

high System graph security Trivy conf 1.00 CVE-2026-53571: vite 7.3.0 — .migration-backup/package-lock.json

vite: `server.fs.deny` bypass on Windows alternate paths Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive…

VulnCve 2026 53571

high System graph security Trivy conf 1.00 CVE-2026-59724: engine.io 6.6.5 — .migration-backup/package-lock.json

engine.io: Engine.IO: Denial of Service via crafted WebTransport session ID Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited…

VulnCve 2026 59724

high System graph security Trivy conf 1.00 CVE-2026-59725: engine.io 6.6.5 — .migration-backup/package-lock.json

socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST r…

VulnCve 2026 59725

high System graph security Trivy conf 1.00 CVE-2026-59874: tar 6.2.1 — .migration-backup/package-lock.json

tar: Node-tar: Denial of Service via malformed tar archive header node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeated…

VulnCve 2026 59874

high System graph security Trivy conf 1.00 CVE-2026-6321: fast-uri 3.1.0 — .migration-backup/package-lock.json

fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory r…

VulnCve 2026 6321

high System graph security Trivy conf 1.00 CVE-2026-6322: fast-uri 3.1.0 — .migration-backup/package-lock.json

fast-uri: fast-uri: URI authority bypass due to improper delimiter handling fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a…

VulnCve 2026 6322

high System graph security Trivy conf 1.00 CVE-2026-67213: nanoid 3.3.11 — .migration-backup/package-lock.json

nanoid: nanoid: Denial of Service via infinite loop in random ID generation nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit conditio…

VulnCve 2026 67213

high System graph security Trivy conf 1.00 CVE-2026-67213: nanoid 3.3.12 — pnpm-lock.yaml

nanoid: nanoid: Denial of Service via infinite loop in random ID generation nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit conditio…

VulnCve 2026 67213

high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 3.3.11 — .migration-backup/package-lock.json

nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …

VulnCve 2026 67214

high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 3.3.12 — pnpm-lock.yaml

nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …

VulnCve 2026 67214

high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 5.1.11 — pnpm-lock.yaml

nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …

VulnCve 2026 67214

high System graph security Trivy conf 1.00 CVE-2026-67214: nanoid 5.1.6 — .migration-backup/package-lock.json

nanoid: nanoid: Denial of Service via negative size input in non-secure module functions nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the …

VulnCve 2026 67214

high System graph security Trivy conf 1.00 CVE-2026-69152: brace-expansion 2.0.2 — .migration-backup/package-lock.json

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-altern…

VulnCve 2026 69152

high System graph security Trivy conf 1.00 CVE-2026-69185: socket.io-parser 4.2.5 — .migration-backup/package-lock.json

socket.io-parser: Socket.IO: Denial of Service via memory exhaustion from crafted packets Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary a…

VulnCve 2026 69185

high System graph security Trivy conf 1.00 CVE-2026-69185: socket.io-parser 4.2.6 — pnpm-lock.yaml

socket.io-parser: Socket.IO: Denial of Service via memory exhaustion from crafted packets Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary a…

VulnCve 2026 69185

high System graph security Trivy conf 1.00 CVE-2026-73566: tar 6.2.1 — .migration-backup/package-lock.json

tar: node-tar: Denial of Service via crafted long-path tar archive node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when ta…

VulnCve 2026 73566

high System graph security Trivy conf 1.00 CVE-2026-73646: postcss 8.5.15 — pnpm-lock.yaml

postcss: PostCSS: Information disclosure via path traversal in source map auto-loading PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sour…

VulnCve 2026 73646

high System graph security Trivy conf 1.00 CVE-2026-73646: postcss 8.5.6 — .migration-backup/package-lock.json

postcss: PostCSS: Information disclosure via path traversal in source map auto-loading PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sour…

VulnCve 2026 73646

high System graph api Wiring conf 0.90 Dangling fetch: DELETE /api/appointments/${id} (artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:131)

`artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:131` calls `DELETE /api/appointments/${id}` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matchi…

artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:131 Dangling fetchFetch

high System graph api Wiring conf 0.90 Dangling fetch: GET /api/export/${type} (artifacts/pregasquad-manager/src/pages/AdminSettings.tsx:531)

`artifacts/pregasquad-manager/src/pages/AdminSettings.tsx:531` calls `GET /api/export/${type}` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/ex…

artifacts/pregasquad-manager/src/pages/AdminSettings.tsx:531 Dangling fetchFetch

high System graph api Wiring conf 0.90 Dangling fetch: GET /api/notifications/broadcast/last (artifacts/pregasquad-manager/src/pages/WhatsApp.tsx:1025)

`artifacts/pregasquad-manager/src/pages/WhatsApp.tsx:1025` calls `GET /api/notifications/broadcast/last` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matc…

artifacts/pregasquad-manager/src/pages/WhatsApp.tsx:1025 Dangling fetchFetch

high System graph api Wiring conf 0.90 Dangling fetch: POST /api/appointments (artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:108)

`artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:108` calls `POST /api/appointments` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/ap…

artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:108 Dangling fetchFetch

high System graph api Wiring conf 0.90 Dangling fetch: POST /api/appointments (artifacts/pregasquad-manager/src/pages/Clients.tsx:264)

`artifacts/pregasquad-manager/src/pages/Clients.tsx:264` calls `POST /api/appointments` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/appointme…

artifacts/pregasquad-manager/src/pages/Clients.tsx:264 Dangling fetchFetch

high System graph api Wiring conf 0.90 Dangling fetch: POST /api/appointments (artifacts/pregasquad-manager/src/pages/POS.tsx:195)

`artifacts/pregasquad-manager/src/pages/POS.tsx:195` calls `POST /api/appointments` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: `/appointments`

artifacts/pregasquad-manager/src/pages/POS.tsx:195 Dangling fetchFetch

high System graph api Wiring conf 0.90 Dangling fetch: PUT /api/appointments/${id} (artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:92)

`artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:92` calls `PUT /api/appointments/${id}` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it. Tool: fetch Normalized path used for matching: …

artifacts/pregasquad-manager/src/pages/BookingHistory.tsx:92 Dangling fetchFetch

high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — .migration-backup/Dockerfile

Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: .migration-backup/Dockerfile

Misconfig

high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile

Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile

Misconfig

high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile.api

Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile.api

Misconfig

high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile.manager

Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile.manager

Misconfig

high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — Dockerfile.api

'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*' Rule: DS-0029 Severity: HIGH Target: Dockerfile.api

Misconfig

high System graph security Trivy conf 1.00 GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 — .migration-backup/package-lock.json

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() ### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` i…

VulnGhsa 5c6j r48x rmvq

high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.34.5 — .migration-backup/package-lock.json

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…

VulnGhsa f88m g3jw g9cj

high System graph security Trivy conf 1.00 GHSA-gcfj-64vw-6mp9: axios 1.16.1 — pnpm-lock.yaml

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning ## Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when `Object.prototype.proxy` is polluted and request configuration is materialized as a regular object before dispatc…

VulnGhsa gcfj 64vw 6mp9

high System graph security Semgrep conf 0.75 react insecure request — .migration-backup/server/replit_integrations/object_storage/objectStorage.ts:280

Unencrypted request over HTTP detected. Rule: typescript.react.security.react-insecure-request.react-insecure-request Severity: ERROR OWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures CWE: CWE-319: Cleartext Transmission of Sensitive In…

.migration-backup/server/replit_integrations/object_storage/objectStorage.ts:280 SecurityReact

high System graph security Semgrep conf 0.75 react insecure request — artifacts/api-server/src/replit_integrations/object_storage/objectStorage.ts:280

Unencrypted request over HTTP detected. Rule: typescript.react.security.react-insecure-request.react-insecure-request Severity: ERROR OWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures CWE: CWE-319: Cleartext Transmission of Sensitive In…

artifacts/api-server/src/replit_integrations/object_storage/objectStorage.ts:280 SecurityReact

high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — .migration-backup/server/certs/qz-private-key.pem

Trivy detected a possible secret in `.migration-backup/server/certs/qz-private-key.pem`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or environm…

Secret

high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — artifacts/api-server/server/certs/qz-private-key.pem

Trivy detected a possible secret in `artifacts/api-server/server/certs/qz-private-key.pem`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or envir…

Secret

high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — artifacts/api-server/src/certs/qz-private-key.pem

Trivy detected a possible secret in `artifacts/api-server/src/certs/qz-private-key.pem`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or environm…

Secret

high System graph security Trivy conf 1.00 Secret leak: Asymmetric Private Key — server/certs/qz-private-key.pem

Trivy detected a possible secret in `server/certs/qz-private-key.pem`. Rule: private-key Severity: HIGH Match (redacted): **************************************************************** Action: rotate the credential and remove it from the repo. Use a secrets manager or environment variables.

Secret

high System graph dependencies dependencies conf 1.00 Vulnerable dependency multer 2.1.1: GHSA-72gw-mp4g-v24j

OSV.dev reports `multer` at version `2.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-72gw-mp4g-v24j (aka CVE-2026-5079). Multer vulnerable to Denial of Service via deeply nested field names Aliases: CVE-2026-5079 Advisory: https://osv.dev/vulnerability/GHSA-72gw-mp4g-v24j Fix: upgrade `…

artifacts/api-server/package.json ScaOsvGhsa 72gw mp4g v24j

high System graph dependencies dependencies conf 0.90 Vulnerable dependency nanoid 3.3.12: GHSA-28wg-ghj8-5hjv

OSV.dev reports `nanoid` at version `3.3.12` (resolved in `artifacts/mockup-sandbox/package-lock.json`) is affected by GHSA-28wg-ghj8-5hjv (aka CVE-2026-67214). nanoid: non-secure generators can loop indefinitely with negative size Aliases: CVE-2026-67214 Advisory: https://osv.dev/vulnerability/G…

artifacts/mockup-sandbox/package-lock.json ScaOsvGhsa 28wg ghj8 5hjv

high System graph dependencies dependencies conf 0.90 Vulnerable dependency nanoid 3.3.12: GHSA-2v37-7h3g-55p8

OSV.dev reports `nanoid` at version `3.3.12` (resolved in `artifacts/mockup-sandbox/package-lock.json`) is affected by GHSA-2v37-7h3g-55p8 (aka CVE-2026-67213). nanoid: custom generators can loop indefinitely when size is zero Aliases: CVE-2026-67213 Advisory: https://osv.dev/vulnerability/GHSA-2…

artifacts/mockup-sandbox/package-lock.json ScaOsvGhsa 2v37 7h3g 55p8

high System graph dependencies dependencies conf 1.00 Vulnerable dependency nanoid 5.1.11: GHSA-28wg-ghj8-5hjv

OSV.dev reports `nanoid` at version `5.1.11` (resolved in `pnpm-lock.yaml`) is affected by GHSA-28wg-ghj8-5hjv (aka CVE-2026-67214). nanoid: non-secure generators can loop indefinitely with negative size Aliases: CVE-2026-67214 Advisory: https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv Fix: upgr…

artifacts/api-server/package.json ScaOsvGhsa 28wg ghj8 5hjv

high System graph dependencies dependencies conf 0.90 Vulnerable dependency vite 7.3.3: GHSA-fx2h-pf6j-xcff

OSV.dev reports `vite` at version `7.3.3` (resolved in `artifacts/mockup-sandbox/package-lock.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571). vite: `server.fs.deny` bypass on Windows alternate paths Aliases: CVE-2026-53571 Advisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcf…

artifacts/mockup-sandbox/package.json ScaOsvGhsa fx2h pf6j xcff

high System graph dependencies dependencies conf 1.00 Vulnerable dependency ws 8.20.1: GHSA-96hv-2xvq-fx4p

OSV.dev reports `ws` at version `8.20.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779). ws: Memory exhaustion DoS from tiny fragments and data chunks Aliases: CVE-2026-48779 Advisory: https://osv.dev/vulnerability/GHSA-96hv-2xvq-fx4p Fix: upgrade `ws` past…

pnpm-lock.yaml ScaOsvGhsa 96hv 2xvq fx4p

medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — artifacts/mockup-sandbox/src/components/ui/chart.tsx:79

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

artifacts/mockup-sandbox/src/components/ui/chart.tsx:79 Fq dangerous html

medium System graph frontend Frontend quality conf 0.80 `dangerouslySetInnerHTML` used in a React component — artifacts/pregasquad-manager/src/components/ui/chart.tsx:81

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

artifacts/pregasquad-manager/src/components/ui/chart.tsx:81 Fq dangerous html

medium System graph quality Production readiness conf 1.00 Composite production-readiness gap

Multiple low-cost hardening controls are missing together: license, ci, tests, operator-readme, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation.

Repo hardeningGenerated repo pattern

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data

A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.

Mock dataCritical flowGenerated repo pattern

medium System graph security Trivy conf 1.00 CVE-2025-62718: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback …

VulnCve 2025 62718

medium System graph security Trivy conf 1.00 CVE-2025-69873: ajv 8.17.1 — .migration-backup/package-lock.json

ajv: ReDoS via $data reference ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaS…

VulnCve 2025 69873

medium System graph security Trivy conf 1.00 CVE-2026-2739: bn.js 4.12.2 — .migration-backup/package-lock.json

bn.js: bn.js: Denial of Service via calling maskn(0) This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely. Package: bn.j…

VulnCve 2026 2739

medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash 4.17.23 — .migration-backup/package-lock.json

lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…

VulnCve 2026 2950

medium System graph security Trivy conf 1.00 CVE-2026-33349: fast-xml-parser 5.3.5 — .migration-backup/package-lock.json

fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeRead…

VulnCve 2026 33349

medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 2.3.1 — .migration-backup/package-lock.json

picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…

VulnCve 2026 33672

medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 4.0.3 — .migration-backup/package-lock.json

picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…

VulnCve 2026 33672

medium System graph security Trivy conf 1.00 CVE-2026-33750: brace-expansion 2.0.2 — .migration-backup/package-lock.json

brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) caus…

VulnCve 2026 33750

medium System graph security Trivy conf 1.00 CVE-2026-34043: serialize-javascript 6.0.2 — .migration-backup/package-lock.json

serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exh…

VulnCve 2026 34043

medium System graph security Trivy conf 1.00 CVE-2026-39365: vite 7.3.0 — .migration-backup/package-lock.json

vite: Vite: Information disclosure via path traversal in dev server's .map request handling Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFil…

VulnCve 2026 39365

medium System graph security Trivy conf 1.00 CVE-2026-40175: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Remote Code Execution via Prototype Pollution escalation Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leverag…

VulnCve 2026 40175

medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.5.6 — .migration-backup/package-lock.json

postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…

VulnCve 2026 41305

medium System graph security Trivy conf 1.00 CVE-2026-41650: fast-xml-parser 5.3.5 — .migration-backup/package-lock.json

fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or th…

VulnCve 2026 41650

medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — .migration-backup/package-lock.json

uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…

VulnCve 2026 41907

medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — pnpm-lock.yaml

uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…

VulnCve 2026 41907

medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 9.0.1 — .migration-backup/package-lock.json

uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…

VulnCve 2026 41907

medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 9.0.1 — pnpm-lock.yaml

uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…

VulnCve 2026 41907

medium System graph security Trivy conf 1.00 CVE-2026-42034: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). …

VulnCve 2026 42034

medium System graph security Trivy conf 1.00 CVE-2026-42036: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLe…

VulnCve 2026 42036

medium System graph security Trivy conf 1.00 CVE-2026-42037: axios 1.13.2 — .migration-backup/package-lock.json

axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the…

VulnCve 2026 42037

medium System graph security Trivy conf 1.00 CVE-2026-42038: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Information disclosure due to `no_proxy` bypass Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route t…

VulnCve 2026 42038

medium System graph security Trivy conf 1.00 CVE-2026-42039: axios 1.13.2 — .migration-backup/package-lock.json

axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value pas…

VulnCve 2026 42039

medium System graph security Trivy conf 1.00 CVE-2026-42041: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to…

VulnCve 2026 42041

medium System graph security Trivy conf 1.00 CVE-2026-42042: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: XSRF token bypass leading to information disclosure Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXS…

VulnCve 2026 42042

medium System graph security Trivy conf 1.00 CVE-2026-42044: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the ap…

VulnCve 2026 42044

medium System graph security Trivy conf 1.00 CVE-2026-44288: protobufjs 6.8.8 — .migration-backup/package-lock.json

protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a minimal UTF-8 decoder that accepted overlong UTF-8 byte sequences and decode…

VulnCve 2026 44288

medium System graph security Trivy conf 1.00 CVE-2026-44292: protobufjs 6.8.8 — .migration-backup/package-lock.json

protobufjs: protobufjs: Data integrity impact due to prototype pollution protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the…

VulnCve 2026 44292

medium System graph security Trivy conf 1.00 CVE-2026-44294: protobufjs 6.8.8 — .migration-backup/package-lock.json

protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain c…

VulnCve 2026 44294

medium System graph security Trivy conf 1.00 CVE-2026-44490: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Information disclosure and denial of service due to prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency i…

VulnCve 2026 44490

medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.18.3 — .migration-backup/package-lock.json

ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…

VulnCve 2026 45736

medium System graph security Trivy conf 1.00 CVE-2026-45740: protobufjs 6.8.8 — .migration-backup/package-lock.json

protobufjs: protobufjs: Denial of Service via crafted JSON descriptors protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.add…

VulnCve 2026 45740

medium System graph security Trivy conf 1.00 CVE-2026-45740: protobufjs 7.5.6 — .migration-backup/package-lock.json

protobufjs: protobufjs: Denial of Service via crafted JSON descriptors protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.add…

VulnCve 2026 45740

medium System graph security Trivy conf 1.00 CVE-2026-5038: multer 2.1.1 — .migration-backup/package-lock.json

multer: Multer: Denial of Service via aborted or malformed multipart uploads Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the R…

VulnCve 2026 5038

medium System graph security Trivy conf 1.00 CVE-2026-5038: multer 2.1.1 — pnpm-lock.yaml

multer: Multer: Denial of Service via aborted or malformed multipart uploads Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the R…

VulnCve 2026 5038

medium System graph security Trivy conf 1.00 CVE-2026-53632: vite 7.3.0 — .migration-backup/package-lock.json

launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a U…

VulnCve 2026 53632

medium System graph security Trivy conf 1.00 CVE-2026-53655: tar 6.2.1 — .migration-backup/package-lock.json

node-tar: node-tar: File smuggling due to inconsistent tar archive parsing node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata heade…

VulnCve 2026 53655

medium System graph security Trivy conf 1.00 CVE-2026-54269: protobufjs 6.8.8 — .migration-backup/package-lock.json

protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protob…

VulnCve 2026 54269

medium System graph security Trivy conf 1.00 CVE-2026-54269: protobufjs 7.5.6 — .migration-backup/package-lock.json

protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protob…

VulnCve 2026 54269

medium System graph security Trivy conf 1.00 CVE-2026-54269: protobufjs 7.6.1 — pnpm-lock.yaml

protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protob…

VulnCve 2026 54269

medium System graph security Trivy conf 1.00 CVE-2026-59871: tar 6.2.1 — .migration-backup/package-lock.json

node-tar: node-tar: Denial of Service due to incorrect PAX path handling node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindo…

VulnCve 2026 59871

medium System graph security Trivy conf 1.00 CVE-2026-59875: tar 6.2.1 — .migration-backup/package-lock.json

node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.l…

VulnCve 2026 59875

medium System graph security Trivy conf 1.00 CVE-2026-59877: protobufjs 7.5.6 — .migration-backup/package-lock.json

protobufjs: protobufjs: Denial of Service via crafted .proto schema protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a…

VulnCve 2026 59877

medium System graph security Trivy conf 1.00 CVE-2026-59877: protobufjs 7.6.1 — pnpm-lock.yaml

protobufjs: protobufjs: Denial of Service via crafted .proto schema protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a…

VulnCve 2026 59877

medium System graph security Trivy conf 1.00 CVE-2026-67312: axios 1.13.2 — .migration-backup/package-lock.json

axios: axios: Denial of Service via uncontrolled recursion in form data processing axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: …

VulnCve 2026 67312

medium System graph security Trivy conf 1.00 CVE-2026-67312: axios 1.16.1 — pnpm-lock.yaml

axios: axios: Denial of Service via uncontrolled recursion in form data processing axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: …

VulnCve 2026 67312

medium System graph security Trivy conf 1.00 CVE-2026-67314: axios 1.16.1 — pnpm-lock.yaml

axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a sep…

VulnCve 2026 67314

medium System graph security Trivy conf 1.00 CVE-2026-67316: axios 1.13.2 — .migration-backup/package-lock.json

axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyles…

VulnCve 2026 67316

medium System graph security Trivy conf 1.00 CVE-2026-67316: axios 1.16.1 — pnpm-lock.yaml

axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyles…

VulnCve 2026 67316

medium System graph security Trivy conf 1.00 CVE-2026-69153: postcss 8.5.15 — pnpm-lock.yaml

postcss: PostCSS: Information disclosure via crafted sourceMappingURL PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unin…

VulnCve 2026 69153

medium System graph security Trivy conf 1.00 CVE-2026-69153: postcss 8.5.6 — .migration-backup/package-lock.json

postcss: PostCSS: Information disclosure via crafted sourceMappingURL PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unin…

VulnCve 2026 69153

medium System graph security Trivy conf 1.00 CVE-2026-8723: qs 6.14.1 — .migration-backup/package-lock.json

qs: qs: Denial of Service due to improper handling of null/undefined array elements ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of…

VulnCve 2026 8723

medium System graph security Trivy conf 1.00 CVE-2026-8723: qs 6.15.1 — pnpm-lock.yaml

qs: qs: Denial of Service due to improper handling of null/undefined array elements ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of…

VulnCve 2026 8723

medium System graph hardware Security conf 1.00 Dockerfile runs as root: Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph security Trivy conf 1.00 DS-0013: 'RUN cd ...' to change directory — Dockerfile

'RUN cd ...' to change directory RUN should not be used to change directory: 'cd artifacts/pregasquad-manager && PORT=8000 BASE_PATH=/ pnpm run build'. Use 'WORKDIR' statement instead. Rule: DS-0013 Severity: MEDIUM Target: Dockerfile

Misconfig

medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — artifacts/pregasquad-manager/src/App.tsx:312

This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.

artifacts/pregasquad-manager/src/App.tsx:312 runtime safetyRobustnessUnhandled promise

medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — artifacts/pregasquad-manager/src/lib/qzPrint.ts:52

This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.

artifacts/pregasquad-manager/src/lib/qzPrint.ts:52 runtime safetyRobustnessUnhandled promise

medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — artifacts/pregasquad-manager/src/pages/Booking.tsx:140

This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.

artifacts/pregasquad-manager/src/pages/Booking.tsx:140 runtime safetyRobustnessUnhandled promise

medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — artifacts/pregasquad-manager/src/pages/Logs.tsx:109

This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.

artifacts/pregasquad-manager/src/pages/Logs.tsx:109 runtime safetyRobustnessUnhandled promise

medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — artifacts/pregasquad-manager/src/pages/Planning.tsx:757

This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.

artifacts/pregasquad-manager/src/pages/Planning.tsx:757 runtime safetyRobustnessUnhandled promise

medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — artifacts/pregasquad-manager/src/pages/Website1.tsx:88

This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.

artifacts/pregasquad-manager/src/pages/Website1.tsx:88 runtime safetyRobustnessUnhandled promise

medium System graph quality Integrity conf 0.90 Fire-and-forget `fetch()` has no rejection handler — artifacts/pregasquad-manager/src/pages/WhatsApp.tsx:1016

This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler.

artifacts/pregasquad-manager/src/pages/WhatsApp.tsx:1016 runtime safetyRobustnessUnhandled promise

medium System graph quality Integrity conf 1.00 Frontend route `/staff-portal/:token` has no Link/navigate to it — artifacts/pregasquad-manager/src/App.tsx

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

Orphan pageWiring

medium System graph security Trivy conf 1.00 GHSA-42h9-826w-cgv3: axios 1.13.2 — .migration-backup/package-lock.json

Axios: Excessive recursion in formDataToJSON can cause denial of service ## Summary Axios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData …

VulnGhsa 42h9 826w cgv3

medium System graph security Trivy conf 1.00 GHSA-42h9-826w-cgv3: axios 1.16.1 — pnpm-lock.yaml

Axios: Excessive recursion in formDataToJSON can cause denial of service ## Summary Axios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData …

VulnGhsa 42h9 826w cgv3

medium System graph security Trivy conf 1.00 GHSA-7q8q-rj6j-mhjq: axios 1.13.2 — .migration-backup/package-lock.json

Axios: Nested axios option objects can consume polluted prototype values ## Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`. The top-level merged config is protected with a null prototype, but…

VulnGhsa 7q8q rj6j mhjq

medium System graph security Trivy conf 1.00 GHSA-7q8q-rj6j-mhjq: axios 1.16.1 — pnpm-lock.yaml

Axios: Nested axios option objects can consume polluted prototype values ## Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`. The top-level merged config is protected with a null prototype, but…

VulnGhsa 7q8q rj6j mhjq

medium System graph security Trivy conf 1.00 GHSA-f4gw-2p7v-4548: axios 1.16.1 — pnpm-lock.yaml

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios ## Summary Axios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when evaluating `NO_PROXY` rules. In Node.js applications that use `HTTP_PROXY` or `HTTPS_PROXY` together with `NO_PROXY=lo…

VulnGhsa f4gw 2p7v 4548

medium System graph security Trivy conf 1.00 GHSA-hcpx-6fm6-wx23: axios 1.16.1 — pnpm-lock.yaml

Axios form serializer maxDepth bypass via {} metatoken ## Summary Axios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in `lib/helpers/toFormData.js`. When serializing an object with a top-level key ending in `{}`, axios calls `JSON.stringify()`…

VulnGhsa hcpx 6fm6 wx23

medium System graph security Trivy conf 1.00 GHSA-jqh4-m9w3-8hp9: axios 1.13.2 — .migration-backup/package-lock.json

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` ## Summary axios’ fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose size cannot be determined before dispatch. Applications that use `adapter: "fetch"` and rely on `maxBodyLengt…

VulnGhsa jqh4 m9w3 8hp9

medium System graph security Trivy conf 1.00 GHSA-jqh4-m9w3-8hp9: axios 1.16.1 — pnpm-lock.yaml

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` ## Summary axios’ fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose size cannot be determined before dispatch. Applications that use `adapter: "fetch"` and rely on `maxBodyLengt…

VulnGhsa jqh4 m9w3 8hp9

medium System graph security Trivy conf 1.00 GHSA-mwf2-3pr3-8698: axios 1.13.2 — .migration-backup/package-lock.json

Axios: HTTP/2 streamed uploads bypass `maxBodyLength` ## Summary Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforcement when requests are sent with `httpVersion: 2`. This affects applications that rely on `maxBodyLength` as a hard cap while…

VulnGhsa mwf2 3pr3 8698

medium System graph security Trivy conf 1.00 GHSA-mwf2-3pr3-8698: axios 1.16.1 — pnpm-lock.yaml

Axios: HTTP/2 streamed uploads bypass `maxBodyLength` ## Summary Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforcement when requests are sent with `httpVersion: 2`. This affects applications that rely on `maxBodyLength` as a hard cap while…

VulnGhsa mwf2 3pr3 8698

medium System graph security Trivy conf 1.00 GHSA-r4q5-vmmm-2653: follow-redirects 1.15.11 — .migration-backup/package-lock.json

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets ## Summary When an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-47…

VulnGhsa r4q5 vmmm 2653

medium System graph security Trivy conf 1.00 GHSA-rgwj-5xj2-c3m3: mysql2 3.16.3 — .migration-backup/package-lock.json

MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS ## Vulnerability Details **File**: `lib/compressed_protocol.js` **Line**: 43 (`zlib.inflate(body, (err, data) => { ... })` inside `handleCompressedPacket`) ### Root Cause When a connection is create…

VulnGhsa rgwj 5xj2 c3m3

medium System graph security Trivy conf 1.00 GHSA-rgwj-5xj2-c3m3: mysql2 3.22.4 — pnpm-lock.yaml

MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS ## Vulnerability Details **File**: `lib/compressed_protocol.js` **Line**: 43 (`zlib.inflate(body, (err, data) => { ... })` inside `handleCompressedPacket`) ### Root Cause When a connection is create…

VulnGhsa rgwj 5xj2 c3m3

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in artifacts/api-server/src/app.ts:8

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

artifacts/api-server/src/app.ts:8 Cors wildcard

medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in artifacts/api-server/src/routes/routes.ts:542

Found a known-risky pattern (cors_wildcard). Review and replace if possible.

artifacts/api-server/src/routes/routes.ts:542 Cors wildcard

medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in artifacts/mockup-sandbox/src/components/ui/chart.tsx:79

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

artifacts/mockup-sandbox/src/components/ui/chart.tsx:79 Dangerous innerhtml

medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in artifacts/pregasquad-manager/src/components/ui/chart.tsx:81

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

artifacts/pregasquad-manager/src/components/ui/chart.tsx:81 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in artifacts/pregasquad-manager/src/components/layout/FirstLogin.tsx:96

Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.

artifacts/pregasquad-manager/src/components/layout/FirstLogin.tsx:96 Local storage auth token

medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in artifacts/pregasquad-manager/src/main.tsx:35

Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.

artifacts/pregasquad-manager/src/main.tsx:35 Local storage auth token

medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected

Found 118 placeholder/mock markers across 32 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.

Mock dataIncompleteGenerated repo pattern

medium System graph quality Placeholder conf 1.00 Runtime service client appears to use placeholder configuration

A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured.

Runtime configService clientGenerated repo pattern

medium System graph quality Tests conf 1.00 Very low test-to-source ratio

0 test file(s) for 251 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.

Coverage

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency multer 2.1.1: GHSA-3p4h-7m6x-2hcm

OSV.dev reports `multer` at version `2.1.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3p4h-7m6x-2hcm (aka CVE-2026-5038). Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads Aliases: CVE-2026-5038 Advisory: https://osv.dev/vulnerability/GHSA-3p4h-7m6x-2hcm Fi…

artifacts/api-server/package.json ScaOsvGhsa 3p4h 7m6x 2hcm

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mysql2 3.22.4: GHSA-rgwj-5xj2-c3m3

OSV.dev reports `mysql2` at version `3.22.4` (resolved in `pnpm-lock.yaml`) is affected by GHSA-rgwj-5xj2-c3m3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rgwj-5xj2-c3m3 Fix: upgrade `mysql2` past the affected range per the advisory.

artifacts/api-server/package.json ScaOsvGhsa rgwj 5xj2 c3m3

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.5.15: GHSA-fxqj-rqcc-2cmp

OSV.dev reports `postcss` at version `8.5.15` (resolved in `pnpm-lock.yaml`) is affected by GHSA-fxqj-rqcc-2cmp. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp Fix: upgrade `postcss` past the affected range per the advisory.

artifacts/pregasquad-manager/package.json ScaOsvGhsa fxqj rqcc 2cmp

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.5.15: GHSA-r28c-9q8g-f849

OSV.dev reports `postcss` at version `8.5.15` (resolved in `pnpm-lock.yaml`) is affected by GHSA-r28c-9q8g-f849. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849 Fix: upgrade `postcss` past the affected range per the advisory.

artifacts/pregasquad-manager/package.json ScaOsvGhsa r28c 9q8g f849

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency vite 7.3.3: GHSA-v6wh-96g9-6wx3

OSV.dev reports `vite` at version `7.3.3` (resolved in `artifacts/mockup-sandbox/package-lock.json`) is affected by GHSA-v6wh-96g9-6wx3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3 Fix: upgrade `vite` past the affected range per the advisory.

artifacts/mockup-sandbox/package.json ScaOsvGhsa v6wh 96g9 6wx3

low System graph api Wiring conf 1.00 146 backend endpoints not called by scanned frontend

No scanned frontend call matched these backend routes. Sample: USE /uploads, GET /logs/stream, GET /api/logs, GET /api/logs/stream, GET /api/public/page-views, POST /api/public/page-views, GET /api/public/website-testimonials, GET /api/website-testimonials + 138 more. This is fine when endpoints se…

Unused endpoint

low System graph security Trivy conf 1.00 CVE-2026-12590: body-parser 1.20.4 — .migration-backup/package-lock.json

body-parser: body-parser: Denial of Service via invalid limit option Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body…

VulnCve 2026 12590

low System graph security Trivy conf 1.00 CVE-2026-12590: body-parser 2.2.2 — pnpm-lock.yaml

body-parser: body-parser: Denial of Service via invalid limit option Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body…

VulnCve 2026 12590

low System graph security Trivy conf 1.00 CVE-2026-2391: qs 6.14.1 — .migration-backup/package-lock.json

qs: qs's arrayLimit bypass in comma parsing allows denial of service ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit …

VulnCve 2026 2391

low System graph security Trivy conf 1.00 CVE-2026-27942: fast-xml-parser 5.3.5 — .migration-backup/package-lock.json

fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user…

VulnCve 2026 27942

low System graph security Trivy conf 1.00 CVE-2026-3449: @tootallnate/once 2.0.0 — .migration-backup/package-lock.json

@tootallnate/once: @tootallnate/once: Denial of Service due to incorrect control flow scoping with AbortSignal Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a perm…

VulnCve 2026 3449

low System graph security Trivy conf 1.00 CVE-2026-42040: axios 1.13.2 — .migration-backup/package-lock.json

axios: Axios: Incorrect null byte handling can lead to data integrity issues Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses th…

VulnCve 2026 42040

low System graph security Trivy conf 1.00 CVE-2026-49356: @babel/core 7.28.5 — .migration-backup/package-lock.json

@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted cod…

VulnCve 2026 49356

low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — artifacts/pregasquad-manager/src/components/layout/Sidebar.tsx:185

Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

artifacts/pregasquad-manager/src/components/layout/Sidebar.tsx:185 Fq console leak

low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — artifacts/pregasquad-manager/src/components/PushNotifications.tsx:48

Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

artifacts/pregasquad-manager/src/components/PushNotifications.tsx:48 Fq console leak

low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — artifacts/pregasquad-manager/src/hooks/use-salon-data.ts:51

Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

artifacts/pregasquad-manager/src/hooks/use-salon-data.ts:51 Fq console leak

low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — artifacts/pregasquad-manager/src/lib/queryClient.ts:144

Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

artifacts/pregasquad-manager/src/lib/queryClient.ts:144 Fq console leak

low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — artifacts/pregasquad-manager/src/lib/qzPrint.ts:13

Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

artifacts/pregasquad-manager/src/lib/qzPrint.ts:13 Fq console leak

low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — artifacts/pregasquad-manager/src/lib/syncService.ts:149

Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

artifacts/pregasquad-manager/src/lib/syncService.ts:149 Fq console leak

low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — artifacts/pregasquad-manager/src/main.tsx:20

Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

artifacts/pregasquad-manager/src/main.tsx:20 Fq console leak

low System graph quality Debug conf 1.00 Debug logging residue appears in source files

Found 298 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.

CleanupRepo hardeningGenerated repo pattern

low System graph dependencies dependencies conf 0.90 Dependency @google-cloud/storage is a major version behind

`@google-cloud/storage` is pinned at `7.19.0` in `artifacts/api-server/package.json` while the latest release on the npm registry is `8.0.1` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgra…

artifacts/api-server/package.json FreshnessOutdated

low System graph dependencies dependencies conf 0.90 Dependency date-fns is a major version behind

`date-fns` is pinned at `3.6.0` in `artifacts/api-server/package.json` while the latest release on the npm registry is `4.4.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `date-fns` …

artifacts/api-server/package.json FreshnessOutdated

low System graph dependencies dependencies conf 0.90 Dependency nanoid is a major version behind

`nanoid` is pinned at `5.1.11` in `artifacts/api-server/package.json` while the latest release on the npm registry is `6.0.1` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `nanoid` to …

artifacts/api-server/package.json FreshnessOutdated

low System graph dependencies dependencies conf 0.90 Dependency pino is a major version behind

`pino` is pinned at `9.14.0` in `artifacts/api-server/package.json` while the latest release on the npm registry is `10.3.1` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `pino` to `10…

artifacts/api-server/package.json FreshnessOutdated

low System graph dependencies dependencies conf 0.90 Dependency pino-http is a major version behind

`pino-http` is pinned at `10.5.0` in `artifacts/api-server/package.json` while the latest release on the npm registry is `11.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `pino-ht…

artifacts/api-server/package.json FreshnessOutdated

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:24-slim

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:1 containersPinned dependencies

low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — .migration-backup/Dockerfile

No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: .migration-backup/Dockerfile

Misconfig

low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile

No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile

Misconfig

low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile.api

No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile.api

Misconfig

low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile.manager

No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile.manager

Misconfig

low System graph security Trivy conf 1.00 GHSA-g7r4-m6w7-qqqr: esbuild 0.27.3 — pnpm-lock.yaml

esbuild allows arbitrary file read when running the development server on Windows ### Summary The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instea…

VulnGhsa g7r4 m6w7 qqqr

low System graph quality License conf 1.00 No license file detected

No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.

Repo hardeningGenerated repo pattern

low System graph quality Docs conf 1.00 No README detected

No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off.

ReadmeRepo hardeningGenerated repo pattern

low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: artifacts/api-server/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

artifacts/api-server/package.json LockfileReproducibilityGenerated repo pattern

low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: artifacts/pregasquad-manager/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

artifacts/pregasquad-manager/package.json LockfileReproducibilityGenerated repo pattern

low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: lib/api-client-react/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

lib/api-client-react/package.json LockfileReproducibilityGenerated repo pattern

low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: lib/api-zod/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

lib/api-zod/package.json LockfileReproducibilityGenerated repo pattern

low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: lib/db/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

lib/db/package.json LockfileReproducibilityGenerated repo pattern

low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: scripts/package.json

`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.

scripts/package.json LockfileReproducibilityGenerated repo pattern

low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts

preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.

package.json CI/CD securitySupply chainNpm

low System graph quality Complexity conf 1.00 Very large file: artifacts/api-server/src/db.ts (2811 lines)