{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d9f3b2d961efb1d1", "name": "TODO/FIXME marker in shipping code \u2014 track-installation.js:317", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 track-installation.js:317"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-914c57fd30b3ed15", "name": "TODO/FIXME marker in shipping code \u2014 src/utils/capture.ts:35", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/utils/capture.ts:35"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-815dc4ee7d2f992b", "name": "TODO/FIXME marker in shipping code \u2014 src/utils/files/text.ts:27", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/utils/files/text.ts:27"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-c4bf1b77f81ae0db", "name": "TODO/FIXME marker in shipping code \u2014 src/remote-device/remote-channel.ts:170", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/remote-device/remote-channel.ts:170"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-3cf5d87ef8c0579d", "name": "TODO/FIXME marker in shipping code \u2014 src/tools/edit.ts:325", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/tools/edit.ts:325"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-68f3c3c7191b7d3b", "name": "detect child process \u2014 scripts/download-all-ripgrep.cjs:124", "shortDescription": {"text": "detect child process \u2014 scripts/download-all-ripgrep.cjs:124"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `tarPath`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-cdfd58c199b5a2f3", "name": "detect child process \u2014 scripts/publish-release.cjs:93", "shortDescription": {"text": "detect child process \u2014 scripts/publish-release.cjs:93"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-3f78193a99c53d6d", "name": "detect child process \u2014 src/terminal-manager.ts:256", "shortDescription": {"text": "detect child process \u2014 src/terminal-manager.ts:256"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `command`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-8d748e4e2ad991b2", "name": "unknown value with script tag \u2014 src/ui/resources.ts:59", "shortDescription": {"text": "unknown value with script tag \u2014 src/ui/resources.ts:59"}, "fullDescription": {"text": "Cannot determine what 'cssInlined' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'cssInlined' is not externally controlled, or sanitize this data.\n\nRule: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-0615b34084c78189", "name": "CVE-2026-29087: @hono/node-server 1.19.7 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-29087: @hono/node-server 1.19.7 \u2014 package-lock.json"}, "fullDescription": {"text": "@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware\n\n@hono/node-server allows running the Hono application on Node.js. Prior to version 1.19.10, when using @hono/node-server's static file serving together with route-based middleware protections (e.g. protecting /admin/*), inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes (%2F) may be evaluated differently by routing/middleware matching versus static file path resolution, enabling a bypass where middl\n\nPackage: @hono/node-server\nInstalled: 1.19.7\nFixed in: 1.19.10\nSeverity: HIGH\nFix: Upgrade @hono/node-server to 1.19.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed4a273ce469ac12", "name": "CVE-2026-39406: @hono/node-server 1.19.7 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-39406: @hono/node-server 1.19.7 \u2014 package-lock.json"}, "fullDescription": {"text": "@hono/node-server: Middleware bypass via repeated slashes in serveStatic\n\n@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.13, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in 1.19.13.\n\nPackage: @hono/node-server\nInstalled: 1.19.7\nFixed in: 1.19.13\nSeverity: MEDIUM\nFix: Upgrade @hono/node-server to 1.19.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4cfb90809aa72f94", "name": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.7 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.7 \u2014 package-lock.json"}, "fullDescription": {"text": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nThe same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t\n\nPackage: @hono/node-server\nInstalled: 1.19.7\nFixed in: 2.0.5\nSeverity: MEDIUM\nFix: Upgrade @hono/node-server to 2.0.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d3ad5e4f2ac7ae6", "name": "CVE-2026-0621: @modelcontextprotocol/sdk 1.25.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-0621: @modelcontextprotocol/sdk 1.25.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Anthropic's MCP TypeScript SDK has a ReDoS vulnerability\n\nAnthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.\n\nPackage: @modelcontextprotocol/sdk\nInstalled: 1.25.1\nFixed in: 1.25.2\nSeverity: HIGH\nFix: Upgrade @modelcontextprotocol/sdk to 1.25.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5eb5cefcf548196a", "name": "CVE-2026-25536: @modelcontextprotocol/sdk 1.25.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-25536: @modelcontextprotocol/sdk 1.25.1 \u2014 package-lock.json"}, "fullDescription": {"text": "@modelcontextprotocol/sdk: @modelcontextprotocol/sdk cross-client data leak\n\nMCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.\n\nPackage: @modelcontextprotocol/sdk\nInstalled: 1.25.1\nFixed in: 1.26.0\nSeverity: HIGH\nFix: Upgrade @modelcontextprotocol/sdk to 1.26.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4457907f6cda3da9", "name": "CVE-2025-69873: ajv 8.17.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-69873: ajv 8.17.1 \u2014 package-lock.json"}, "fullDescription": {"text": "ajv: ReDoS via $data reference\n\najv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds\n\nPackage: ajv\nInstalled: 8.17.1\nFixed in: 8.18.0, 6.14.0\nSeverity: MEDIUM\nFix: Upgrade ajv to 8.18.0, 6.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-118fb928ee6354db", "name": "CVE-2026-27699: basic-ftp 5.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27699: basic-ftp 5.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "basic-ftp: basic-ftp: File overwrite due to path traversal\n\nThe `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()`\u00a0method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory. Version 5.2.0 patches the issue.\n\nPackage: basic-ftp\nInstalled: 5.1.0\nFixed in: 5.2.0\nSeverity: CRITICAL\nFix: Upgrade basic-ftp to 5.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-958949f3eea1a17c", "name": "CVE-2026-41324: basic-ftp 5.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-41324: basic-ftp 5.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "basic-ftp: basic-ftp: Denial of Service via unbounded memory growth from malicious directory listings\n\nbasic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.\n\nPackage: basic-ftp\nInstalled: 5.1.0\nFixed in: 5.3.0\nSeverity: HIGH\nFix: Upgrade basic-ftp to 5.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-27795cb89c64cdb3", "name": "CVE-2026-44240: basic-ftp 5.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44240: basic-ftp 5.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "basic-ftp: basic-ftp: Client-side Denial of Service via unterminated multiline FTP responses\n\nbasic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a res\n\nPackage: basic-ftp\nInstalled: 5.1.0\nFixed in: 5.3.1\nSeverity: HIGH\nFix: Upgrade basic-ftp to 5.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-66b91d9f6cacc41c", "name": "GHSA-6v7q-wjvx-w8wg: basic-ftp 5.1.0 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-6v7q-wjvx-w8wg: basic-ftp 5.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands\n\n## Summary\n\nbasic-ftp's CRLF injection protection (added in commit 2ecc8e2 for GHSA-chqc-8p9q-pq6q) is incomplete. Two code paths bypass the `protectWhitespace()` control character check: (1) the `login()` method directly concatenates user-supplied credentials into USER/PASS FTP commands without any validation, and (2) the `_openDir()` method sends an MKD command before `cd()` invokes `protectWhitespace()`, creating a TOCTOU bypass. Both vectors allow an attacker who controls input to inject arb\n\nPackage: basic-ftp\nInstalled: 5.1.0\nFixed in: 5.2.2\nSeverity: HIGH\nFix: Upgrade basic-ftp to 5.2.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4584e5503768a719", "name": "CVE-2026-12590: body-parser 1.20.4 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-12590: body-parser 1.20.4 \u2014 package-lock.json"}, "fullDescription": {"text": "body-parser: body-parser: Denial of Service via invalid limit option\n\nImpact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars\n\nPackage: body-parser\nInstalled: 1.20.4\nFixed in: 1.20.6, 2.3.0\nSeverity: LOW\nFix: Upgrade body-parser to 1.20.6, 2.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c11829f375e6d960", "name": "CVE-2026-12590: body-parser 2.2.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 package-lock.json"}, "fullDescription": {"text": "body-parser: body-parser: Denial of Service via invalid limit option\n\nImpact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars\n\nPackage: body-parser\nInstalled: 2.2.2\nFixed in: 1.20.6, 2.3.0\nSeverity: LOW\nFix: Upgrade body-parser to 1.20.6, 2.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0902a6c5b29d085f", "name": "CVE-2026-13149: brace-expansion 1.1.12 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 1.1.12 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 1.1.12\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-90695f815b9a3061", "name": "CVE-2026-33750: brace-expansion 1.1.12 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 1.1.12 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 1.1.12\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4934edf4b6b87848", "name": "CVE-2026-13149: brace-expansion 2.0.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 2.0.2 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 2.0.2\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-95cc0f822c484166", "name": "CVE-2026-33750: brace-expansion 2.0.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 2.0.2 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 2.0.2\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4adf6d36ffd584f8", "name": "CVE-2026-13676: fast-uri 3.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-13676: fast-uri 3.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization\n\nfast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 4.0.1, 3.1.3, 2.4.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 4.0.1, 3.1.3, 2.4.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bf5bc3c980b78418", "name": "CVE-2026-16221: fast-uri 3.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-16221: fast-uri 3.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x  ...\n\nImpact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 2.4.3, 3.1.4, 4.1.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.3, 3.1.4, 4.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-795a1c1a931b0551", "name": "CVE-2026-6321: fast-uri 3.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-6321: fast-uri 3.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies\n\nfast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Version\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 3.1.1\nSeverity: HIGH\nFix: Upgrade fast-uri to 3.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf47d36fffbc9566", "name": "CVE-2026-6322: fast-uri 3.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-6322: fast-uri 3.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling\n\nfast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a differ\n\nPackage: fast-uri\nInstalled: 3.1.0\nFixed in: 3.1.2\nSeverity: HIGH\nFix: Upgrade fast-uri to 3.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-902ccb2c1dafff34", "name": "CVE-2026-31808: file-type 21.2.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-31808: file-type 21.2.0 \u2014 package-lock.json"}, "fullDescription": {"text": "file-type: file-type: Denial of Service due to infinite loop in ASF file parsing\n\nfile-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type\n\nPackage: file-type\nInstalled: 21.2.0\nFixed in: 21.3.1\nSeverity: MEDIUM\nFix: Upgrade file-type to 21.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f32289b21ca68b8", "name": "CVE-2026-32630: file-type 21.2.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-32630: file-type 21.2.0 \u2014 package-lock.json"}, "fullDescription": {"text": "file-type: file-type: Denial of Service via excessive memory growth from crafted ZIP files\n\nfile-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). The ZIP inflate output limit is enforced for stream-based detection, but not for known-size inputs. As a result, a small compressed ZIP can cause file-type to inflate and process a much larger payload while probing ZIP-based formats such as OOXML. Thi\n\nPackage: file-type\nInstalled: 21.2.0\nFixed in: 21.3.2\nSeverity: MEDIUM\nFix: Upgrade file-type to 21.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f91d1092345283b1", "name": "CVE-2026-22817: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-22817: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono\u2019s JWK/JWKS JWT verification middleware allowed the JWT header\u2019s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly speci\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.11.4\nSeverity: HIGH\nFix: Upgrade hono to 4.11.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-85bb7f4b0c826a6d", "name": "CVE-2026-22818: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-22818: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks \"alg\" (untrusted header.alg fallback)\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono\u2019s JWK/JWKS JWT verification middleware allowed the algorithm specified in the JWT header to influence signature verification when the selected JWK did not explicitly define an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. The JWK/JWKS JWT verification middleware has been updated to require an expl\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.11.4\nSeverity: HIGH\nFix: Upgrade hono to 4.11.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3b6a13221adb6db4", "name": "CVE-2026-29045: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-29045: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono vulnerable to arbitrary file access via serveStatic vulnerability \n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections (e.g. app.use('/admin/*', ...)), inconsistent URL decoding allowed protected static resources to be accessed without authorization. The router used decodeURI, while serveStatic used decodeURIComponent. This mismatch allowed paths containing encoded slashes (%2F) to bypass middleware protections while still resolving\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.4\nSeverity: HIGH\nFix: Upgrade hono to 4.12.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-660af9a2e6f1179f", "name": "CVE-2026-54290: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54290: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to arbitrary origins. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.25\nSeverity: HIGH\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-39ee17a203c2bc85", "name": "CVE-2026-24398: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-24398: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable to an IP address validation bypass. The `IPV4_REGEX` pattern and `convertIPv4ToBinary` function in `src/utils/ipaddr.ts` do not properly validate that IPv4 octet values are within the valid range of 0-255, allowing attackers to craft malformed IP addresses that bypass IP-based access controls. Version 4.11.7 contains a patch for the issue.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.11.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.11.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0070dda3bfbea44e", "name": "CVE-2026-24472: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-24472: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono cache middleware ignores \"Cache-Control: private\" leading to Web Cache Deception\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an information disclosure vulnerability caused by improper handling of HTTP cache control directives. The middleware does not respect standard cache control headers such as `Cache-Control: private` or `Cache-Control: no-store`, which may result in private or authenticated responses being cached and subsequently exposed to unauthorized users. Version 4.11.7 has \n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.11.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.11.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45ecf2a89678013a", "name": "CVE-2026-24473: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-24473: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys. Version 4.11.7 contains a patch for the issue.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.11.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.11.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-12547b76711e9dc8", "name": "CVE-2026-24771: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-24771: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono vulnerable to XSS through ErrorBoundary component \n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, a Cross-Site Scripting (XSS) vulnerability exists in the `ErrorBoundary` component of the hono/jsx library. Under certain usage patterns, untrusted user-controlled strings may be rendered as raw HTML, allowing arbitrary script execution in the victim's browser. Version 4.11.7 patches the issue.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.11.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.11.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b2d7427bcf39342", "name": "CVE-2026-29085: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-29085: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using streamSSE() in Streaming Helper, the event, id, and retry fields were not validated for carriage return (\\r) or newline (\\n) characters. Because the SSE protocol uses line breaks as field delimiters, this could allow injection of additional SSE fields within the same event frame if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.4\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a497c8e15b59e03", "name": "CVE-2026-29086: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-29086: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\\r), or newline characters (\\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.4\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b525b08b7f91fdd1", "name": "CVE-2026-39407: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-39407: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: Middleware bypass via repeated slashes in serveStatic\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path handling inconsistency in serveStatic allows protected static files to be accessed by using repeated slashes (//) in the request path. When route-based middleware (e.g., /admin/*) is used for authorization, the router may not match paths containing repeated slashes, while serveStatic resolves them as normalized paths. This can lead to a middleware bypass. This vulnerability is fixed in \n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-567f137b201a9a00", "name": "CVE-2026-39408: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-39408: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: Path traversal in toSSG() allows writing files outside the output directory\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a path traversal issue in toSSG() allows files to be written outside the configured output directory during static site generation. When using dynamic route parameters via ssgParams, specially crafted values can cause generated file paths to escape the intended output directory. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-12f3055033359551", "name": "CVE-2026-39409: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-39409: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction() does not canonicalize IPv4-mapped IPv6 client addresses (e.g. ::ffff:127.0.0.1) before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause IPv4 rules to fail to match, leading to unintended authorization behavior. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db30463afc4cb96d", "name": "CVE-2026-39410: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-39410: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, a discrepancy between browser cookie parsing and parse() handling allows cookie prefix protections to be bypassed. Cookie names that are treated as distinct by the browser may be normalized to the same key by parse(), allowing attacker-controlled cookies to override legitimate ones. This vulnerability is fixed in 4.12.12.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1098082495262cb", "name": "CVE-2026-44455: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44455: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input is used as a tag name via the programmatic jsx() or createElement() APIs during server-side rendering, specially crafted values may break out of the intended element context and inject unintended HTML. This vulnerability is fixed in 4\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-579a687be113ea43", "name": "CVE-2026-44456: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44456: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: bodyLimit() can be bypassed for chunked / unknown-length requests\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. This vulnerability is fixed in 4.12.16.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.16\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-073b4ed7eb7c623a", "name": "CVE-2026-44457: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44457: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result, a response cached for one authenticated user may be served to subsequent requests from different users. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d1f4cd78f58f451", "name": "CVE-2026-44458: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44458: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono has CSS Declaration Injection via Style Object Values in JSX SSR\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property name can therefore inject additional CSS declarations into the rendered style attribute. The impact is limited to CSS and does not allow JavaScript execution or HTML attribute breakout. This vulnerability is fixed in 4.12.18.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.18\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f68c88ecab451991", "name": "CVE-2026-47673: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-47673: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: JWT middleware accepts any Authorization scheme, not only Bearer\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value \u2014 regardless of the scheme name in the first position \u2014 proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f528476bc6d648a3", "name": "CVE-2026-47674: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-47674: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 \n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule \u2014 such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses \u2014 do not match the normalized rule entry, causing the \n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ab223526d98053a", "name": "CVE-2026-47675: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-47675: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \\r, \\n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed \n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83501649ff591d74", "name": "CVE-2026-47676: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-47676: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.21\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-932e3d6420283688", "name": "CVE-2026-54286: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54286: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to \\, which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as admin\\secret.txt into a nested file under the root and serves it, letting an attacker read static files meant to be protected behind prefix-mounted middleware. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28991021e2556b4d", "name": "CVE-2026-54287: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54287: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 response join multiple Set-Cookie headers into one comma-separated value. Because commas also appear inside cookie attributes (for example Expires dates), clients cannot split the value back into individual cookies and silently drop or misparse them. This vulnerability is fixed in 4.12.25.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-100a367dbd2dbf3a", "name": "CVE-2026-54288: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54288: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to decide whether a body is within the limit. On AWS Lambda (API Gateway v1/v2, ALB, VPC Lattice, and Lambda@Edge) the body is delivered fully buffered and the adapter builds the request with the client-declared Content-Length, which need not match the actual payload. A client can declare a tiny Content-Length while sending a\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d15126d190bd7f7", "name": "CVE-2026-54289: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-54289: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request mid\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.25\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.25"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-079981fc194c4de2", "name": "CVE-2026-56761: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-56761: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR\n\nhono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering that allows attackers to inject unintended html by using malformed attribute names. Attackers can craft specially crafted attribute keys containing characters like quotes or angle brackets to break html tag boundaries and inject arbitrary attributes or elements.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.14\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-477867b2fff864c6", "name": "CVE-2026-59895: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59895: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bdf80f95151fdd91", "name": "CVE-2026-59897: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59897: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.27\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ed3c7730a752db0", "name": "GHSA-26pp-8wgv-hjvm: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-26pp-8wgv-hjvm: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono missing validation of cookie name on write path in setCookie()\n\n## Summary\n\nCookie names are not validated on the write path when using `setCookie()`, `serialize()`, or `serializeSigned()` to generate Set-Cookie headers.\n\nWhile certain cookie attributes such as domain and path are validated, the cookie name itself may contain invalid characters.\n\nThis results in inconsistent handling of cookie names between parsing (read path) and serialization (write path).\n\n## Details\n\nWhen applications use `setCookie()`, `serialize()`, or `serializeSigned()` with a user-c\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.12\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-602ff2bc8bb2654f", "name": "GHSA-v8w9-8mx6-g223: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-v8w9-8mx6-g223: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })\n\n## Summary\n\nWhen using `parseBody({ dot: true })` in HonoRequest, specially crafted form field names such as `__proto__.x` could create objects containing a `__proto__` property.\n\nIf the parsed result is later merged into regular JavaScript objects using unsafe merge patterns, this may lead to prototype pollution in the target object.\n\n## Details\n\nThe `parseBody({ dot: true })` feature supports dot notation to construct nested objects from form field names.\n\nIn previous versions, the `__proto__`\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.12.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c9b81767c753257", "name": "CVE-2026-44459: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44459: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()\n\nHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not exploitable by an anonymous attacker; it only manifests when a malformed claim value reaches verify() \u2014 typically when the application itself issues such tokens, or when the signing key is otherwise unde\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.12.18\nSeverity: LOW\nFix: Upgrade hono to 4.12.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-338e730cc67eb100", "name": "GHSA-gq3j-xvxp-8hrf: hono 4.11.3 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-gq3j-xvxp-8hrf: hono 4.11.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Hono added timing comparison hardening in basicAuth and bearerAuth\n\n## Summary\n\nThe `basicAuth` and `bearerAuth` middlewares previously used a comparison that was not fully timing-safe.\n\nThe `timingSafeEqual` function used normal string equality (`===`) when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing differences.\n\nThe implementation has been updated to use a safer comparison method.\n\n\n## Details\n\nThe issue was caused by the use of normal string equality (`===`) when comparing hash values ins\n\nPackage: hono\nInstalled: 4.11.3\nFixed in: 4.11.10\nSeverity: LOW\nFix: Upgrade hono to 4.11.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb6002efe0da8368", "name": "CVE-2026-42338: ip-address 10.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42338: ip-address 10.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input\n\nip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods,\n\nPackage: ip-address\nInstalled: 10.1.0\nFixed in: 10.1.1\nSeverity: MEDIUM\nFix: Upgrade ip-address to 10.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dbd8976598a4b700", "name": "CVE-2026-59869: js-yaml 3.14.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59869: js-yaml 3.14.2 \u2014 package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.\n\nPackage: js-yaml\nInstalled: 3.14.2\nFixed in: 3.15.0, 4.3.0\nSeverity: HIGH\nFix: Upgrade js-yaml to 3.15.0, 4.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ded989c6472b1e57", "name": "CVE-2026-53550: js-yaml 3.14.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-53550: js-yaml 3.14.2 \u2014 package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML merge keys\n\njs-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerabil\n\nPackage: js-yaml\nInstalled: 3.14.2\nFixed in: 4.2.0, 3.15.0\nSeverity: MEDIUM\nFix: Upgrade js-yaml to 4.2.0, 3.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc0ccd78b70c150d", "name": "CVE-2026-59869: js-yaml 4.1.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 3.15.0, 4.3.0\nSeverity: HIGH\nFix: Upgrade js-yaml to 3.15.0, 4.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-316f7609b2d00795", "name": "CVE-2026-53550: js-yaml 4.1.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML merge keys\n\njs-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerabil\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 4.2.0, 3.15.0\nSeverity: MEDIUM\nFix: Upgrade js-yaml to 4.2.0, 3.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1abded8178a0539b", "name": "CVE-2026-48801: linkify-it 5.0.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-48801: linkify-it 5.0.0 \u2014 package-lock.json"}, "fullDescription": {"text": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability\n\nlinkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N\u00b2) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service tr\n\nPackage: linkify-it\nInstalled: 5.0.0\nFixed in: 5.0.1\nSeverity: HIGH\nFix: Upgrade linkify-it to 5.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ec5ca415b2fe268d", "name": "CVE-2026-59887: linkify-it 5.0.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59887: linkify-it 5.0.0 \u2014 package-lock.json"}, "fullDescription": {"text": "linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text\n\nlinkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.\n\nPackage: linkify-it\nInstalled: 5.0.0\nFixed in: 5.0.2\nSeverity: HIGH\nFix: Upgrade linkify-it to 5.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cb613a5e3859c421", "name": "CVE-2026-2327: markdown-it 14.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-2327: markdown-it 14.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "markdown-it: markdown-it: Denial of Service via Regular Expression Denial of Service in linkify function\n\nVersions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\\*+$/ in the linkify function. An attacker can supply a long sequence of * characters followed by a non-matching character, which triggers excessive backtracking and may lead to a denial-of-service condition.\n\nPackage: markdown-it\nInstalled: 14.1.0\nFixed in: 14.1.1\nSeverity: MEDIUM\nFix: Upgrade markdown-it to 14.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df2c68cf354219fb", "name": "CVE-2026-48988: markdown-it 14.1.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-48988: markdown-it 14.1.0 \u2014 package-lock.json"}, "fullDescription": {"text": "markdown-it is a Markdown parser. Versions 14.1.1 and below contain a  ...\n\nmarkdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typo\n\nPackage: markdown-it\nInstalled: 14.1.0\nFixed in: 14.2.0\nSeverity: MEDIUM\nFix: Upgrade markdown-it to 14.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64ecea76e6bc5e09", "name": "CVE-2026-26996: minimatch 3.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-26996: minimatch 3.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) \n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5547d992435923f9", "name": "CVE-2026-27903: minimatch 3.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27903: minimatch 3.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call\n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc1422d1987f9a44", "name": "CVE-2026-27904: minimatch 3.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27904: minimatch 3.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe\n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4ec88b724d2f418c", "name": "CVE-2026-26996: minimatch 5.1.6 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-26996: minimatch 5.1.6 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) \n\nPackage: minimatch\nInstalled: 5.1.6\nFixed in: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c47ca5360d3f0fe7", "name": "CVE-2026-27903: minimatch 5.1.6 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27903: minimatch 5.1.6 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call\n\nPackage: minimatch\nInstalled: 5.1.6\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3bfb8e4cc920548c", "name": "CVE-2026-27904: minimatch 5.1.6 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27904: minimatch 5.1.6 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe\n\nPackage: minimatch\nInstalled: 5.1.6\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c709783425d67f93", "name": "CVE-2026-26996: minimatch 9.0.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-26996: minimatch 9.0.5 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) \n\nPackage: minimatch\nInstalled: 9.0.5\nFixed in: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fd597560071725ac", "name": "CVE-2026-27903: minimatch 9.0.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27903: minimatch 9.0.5 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call\n\nPackage: minimatch\nInstalled: 9.0.5\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8bc7119d765ad06f", "name": "CVE-2026-27904: minimatch 9.0.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27904: minimatch 9.0.5 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe\n\nPackage: minimatch\nInstalled: 9.0.5\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-803b31b526d395e7", "name": "CVE-2026-4867: path-to-regexp 0.1.12 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-4867: path-to-regexp 0.1.12 \u2014 package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters\n\nImpact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\n\n\nPackage: path-to-regexp\nInstalled: 0.1.12\nFixed in: 0.1.13\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 0.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c5910492003881b8", "name": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions\n\nImpact:\n\nA bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.\n\nPatches:\n\nFixed in version 8.4.0.\n\nWorkarounds:\n\nLimit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.\n\nPackage: path-to-regexp\nInstalled: 8.3.0\nFixed in: 8.4.0\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 8.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d14a76dccc37cb3d", "name": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards\n\nImpact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a too\n\nPackage: path-to-regexp\nInstalled: 8.3.0\nFixed in: 8.4.0\nSeverity: MEDIUM\nFix: Upgrade path-to-regexp to 8.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47cda05433ffe784", "name": "CVE-2026-33671: picomatch 2.3.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 package-lock.json"}, "fullDescription": {"text": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users \n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: HIGH\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c46fa4398483f6d4", "name": "CVE-2026-33672: picomatch 2.3.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 package-lock.json"}, "fullDescription": {"text": "picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (int\n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: MEDIUM\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90884fe11c1cadc2", "name": "CVE-2026-8723: qs 6.14.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-8723: qs 6.14.1 \u2014 package-lock.json"}, "fullDescription": {"text": "### Summary    `qs.stringify` throws `TypeError` when called with `arr ...\n\n### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti\n\nPackage: qs\nInstalled: 6.14.1\nFixed in: 6.15.2\nSeverity: MEDIUM\nFix: Upgrade qs to 6.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7cdd521af41d4c52", "name": "CVE-2026-2391: qs 6.14.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-2391: qs 6.14.1 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs's arrayLimit bypass in comma parsing allows denial of service\n\n### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?\n\nPackage: qs\nInstalled: 6.14.1\nFixed in: 6.14.2\nSeverity: LOW\nFix: Upgrade qs to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-696edaf1bfda3eab", "name": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 package-lock.json", "shortDescription": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 package-lock.json"}, "fullDescription": {"text": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\n### Impact\n\nA number of vulnerabilities, two rated as \"High\" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.\n\nThose processing untrusted input with versions of sharp prior to 0.35.0 are affected.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.\n\n#### Using a globally-installed libvips?\n\nP\n\nPackage: sharp\nInstalled: 0.34.5\nFixed in: 0.35.0\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-851605077465984e", "name": "CVE-2026-59873: tar 6.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59873: tar 6.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "tar: node-tar: Denial of Service via crafted gzip bomb\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.19\nSeverity: CRITICAL\nFix: Upgrade tar to 7.5.19"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-69d789785350595a", "name": "CVE-2026-23745: tar 6.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-23745: tar 6.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives\n\nnode-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.3\nSeverity: HIGH\nFix: Upgrade tar to 7.5.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c946639a409a0ce5", "name": "CVE-2026-23950: tar 6.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-23950: tar 6.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition\n\nnode-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `\u00df` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.4\nSeverity: HIGH\nFix: Upgrade tar to 7.5.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9a7d2f5847a0eb3d", "name": "CVE-2026-24842: tar 6.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-24842: tar 6.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check\n\nnode-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.7\nSeverity: HIGH\nFix: Upgrade tar to 7.5.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ca8a7ca37716a7b7", "name": "CVE-2026-26960: tar 6.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-26960: tar 6.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation\n\nnode-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.8\nSeverity: HIGH\nFix: Upgrade tar to 7.5.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-763369e5f8680ced", "name": "CVE-2026-29786: tar 6.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-29786: tar 6.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: hardlink path traversal via drive-relative linkpath\n\nnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.10\nSeverity: HIGH\nFix: Upgrade tar to 7.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5e7ae67c52bd2930", "name": "CVE-2026-31802: tar 6.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-31802: tar 6.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "tar: tar: File overwrite via drive-relative symlink traversal\n\nnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.11\nSeverity: HIGH\nFix: Upgrade tar to 7.5.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-97ba98f700869c71", "name": "CVE-2026-59874: tar 6.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59874: tar 6.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "tar: Node-tar: Denial of Service via malformed tar archive header\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.18\nSeverity: HIGH\nFix: Upgrade tar to 7.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-38dca3a84efbe33b", "name": "CVE-2026-53655: tar 6.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-53655: tar 6.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: File smuggling due to inconsistent tar archive parsing\n\nnode-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the by\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.16\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86749584ac58cc31", "name": "CVE-2026-59871: tar 6.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59871: tar 6.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: Denial of Service due to incorrect PAX path handling\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.18\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8615fe47ce7097b2", "name": "CVE-2026-59875: tar 6.2.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-59875: tar 6.2.1 \u2014 package-lock.json"}, "fullDescription": {"text": "node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.\n\nPackage: tar\nInstalled: 6.2.1\nFixed in: 7.5.17\nSeverity: MEDIUM\nFix: Upgrade tar to 7.5.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-267576bdb824da7d", "name": "CVE-2026-44705: tmp 0.2.5 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-44705: tmp 0.2.5 \u2014 package-lock.json"}, "fullDescription": {"text": "tmp is a temporary file and directory creator for node.js. Prior to 0. ...\n\ntmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running pr\n\nPackage: tmp\nInstalled: 0.2.5\nFixed in: 0.2.6\nSeverity: HIGH\nFix: Upgrade tmp to 0.2.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4739f516a66919b1", "name": "CVE-2026-41907: uuid 8.3.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-41907: uuid 8.3.2 \u2014 package-lock.json"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 8.3.2\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d3b41d24d73cf707", "name": "CVE-2026-48779: ws 8.18.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9f5abd1f03b5df58", "name": "CVE-2026-45736: ws 8.18.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a3527e70129fb18", "name": "DS-0002: Image user should not be 'root' \u2014 Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c4041c454cda88e", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc55229a7a3c078d", "name": "Agent authority lacks a verifier contract: .mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f015ff12ea0106f2", "name": "Agent instruction contains unpinned remote install: skills/terminal/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: skills/terminal/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a00d3690fd9302d", "name": "Agent authority lacks a verifier contract: skills/computer-health-check/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/computer-health-check/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c84f56ed10e57f8", "name": "Agent instruction contains unpinned remote install: plugins/cursor/skills/terminal/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: plugins/cursor/skills/terminal/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f3cd901b0874127", "name": "Agent authority lacks a verifier contract: plugins/cursor/skills/computer-health-check/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: plugins/cursor/skills/computer-health-check/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3563a9ff8dbefcc", "name": "Agent instruction contains unpinned remote install: plugins/claude/skills/terminal/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: plugins/claude/skills/terminal/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-123f41f596bf590e", "name": "Agent authority lacks a verifier contract: plugins/claude/skills/computer-health-check/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: plugins/claude/skills/computer-health-check/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c670d627a573d04", "name": "SkillSpector SC2 (supply-chain) in skills/ai-tools-setup/references/hermes.md", "shortDescription": {"text": "SkillSpector SC2 (supply-chain) in skills/ai-tools-setup/references/hermes.md"}, "fullDescription": {"text": "curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash\n\nRemote code is downloaded and executed. This bypasses code review and could introduce malicious code.\n\nSkill: ai-tools-setup\nRule: SC2  Category: supply-chain\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-72a3e57f4e02a183", "name": "SkillSpector TM2 (tool-misuse) in skills/ai-tools-setup/references/hermes.md", "shortDescription": {"text": "SkillSpector TM2 (tool-misuse) in skills/ai-tools-setup/references/hermes.md"}, "fullDescription": {"text": "| bash\n\nTool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.\n\nSkill: ai-tools-setup\nRule: TM2  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-b540010da0b01ec8", "name": "SkillSpector PE2 (priv-esc) in skills/computer-health-check/SKILL.md", "shortDescription": {"text": "SkillSpector PE2 (priv-esc) in skills/computer-health-check/SKILL.md"}, "fullDescription": {"text": "sudo\n\nCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.\n\nSkill: computer-health-check\nRule: PE2  Category: priv-esc\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-a943d245247746f6", "name": "SkillSpector PE2 (priv-esc) in skills/computer-health-check/references/linux.md", "shortDescription": {"text": "SkillSpector PE2 (priv-esc) in skills/computer-health-check/references/linux.md"}, "fullDescription": {"text": "sudo\n\nCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.\n\nSkill: computer-health-check\nRule: PE2  Category: priv-esc\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-b5ea51a0db63a2bf", "name": "SkillSpector RA2 (rogue-agent) in skills/computer-health-check/references/linux.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in skills/computer-health-check/references/linux.md"}, "fullDescription": {"text": "systemctl --user list-unit-files --state=enable\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: computer-health-check\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-2c2d9a52a8f8d6f8", "name": "SkillSpector RA2 (rogue-agent) in skills/computer-health-check/references/macos.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in skills/computer-health-check/references/macos.md"}, "fullDescription": {"text": "plist\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: computer-health-check\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-e1a9c90b0f368de8", "name": "SkillSpector TM1 (tool-misuse) in skills/computer-health-check/references/linux.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/computer-health-check/references/linux.md"}, "fullDescription": {"text": "rm -rf \"$HOME/.local/share/Trash/\"\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: computer-health-check\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-37cdecfc3df7d995", "name": "SkillSpector TM1 (tool-misuse) in skills/computer-health-check/references/macos.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/computer-health-check/references/macos.md"}, "fullDescription": {"text": "rm -rf \"$HOME/.Trash/\"\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: computer-health-check\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-4987bb3334f447d6", "name": "SkillSpector EA2 (excessive-agency) in skills/desktop-commander-overview/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in skills/desktop-commander-overview/SKILL.md"}, "fullDescription": {"text": "without asking\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: desktop-commander-overview\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-5018604068566566", "name": "SkillSpector SC2 (supply-chain) in skills/terminal/SKILL.md", "shortDescription": {"text": "SkillSpector SC2 (supply-chain) in skills/terminal/SKILL.md"}, "fullDescription": {"text": "curl / HTTP**: fine for inspection (`curl -i https://...`). Be careful with\n  anything that pipes a downloaded script straight into a shell\n  (`curl ... | sh\n\nRemote code is downloaded and executed. This bypasses code review and could introduce malicious code.\n\nSkill: terminal\nRule: SC2  Category: supply-chain\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-6d42751de4becb26", "name": "SkillSpector TM1 (tool-misuse) in skills/terminal/SKILL.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in skills/terminal/SKILL.md"}, "fullDescription": {"text": "rm -rf`, `Remove-Item -Recurse -Force`, `del /\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: terminal\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-6565712ca560fd9d", "name": "SkillSpector SC2 (supply-chain) in plugins/claude/skills/ai-tools-setup/references/hermes.md", "shortDescription": {"text": "SkillSpector SC2 (supply-chain) in plugins/claude/skills/ai-tools-setup/references/hermes.md"}, "fullDescription": {"text": "curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash\n\nRemote code is downloaded and executed. This bypasses code review and could introduce malicious code.\n\nSkill: ai-tools-setup\nRule: SC2  Category: supply-chain\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-d0f4d9f301c00e10", "name": "SkillSpector TM2 (tool-misuse) in plugins/claude/skills/ai-tools-setup/references/hermes.md", "shortDescription": {"text": "SkillSpector TM2 (tool-misuse) in plugins/claude/skills/ai-tools-setup/references/hermes.md"}, "fullDescription": {"text": "| bash\n\nTool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.\n\nSkill: ai-tools-setup\nRule: TM2  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-5534a19aa8c951bc", "name": "SkillSpector PE2 (priv-esc) in plugins/claude/skills/computer-health-check/SKILL.md", "shortDescription": {"text": "SkillSpector PE2 (priv-esc) in plugins/claude/skills/computer-health-check/SKILL.md"}, "fullDescription": {"text": "sudo\n\nCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.\n\nSkill: computer-health-check\nRule: PE2  Category: priv-esc\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-11f599297ca102cf", "name": "SkillSpector PE2 (priv-esc) in plugins/claude/skills/computer-health-check/references/linux.md", "shortDescription": {"text": "SkillSpector PE2 (priv-esc) in plugins/claude/skills/computer-health-check/references/linux.md"}, "fullDescription": {"text": "sudo\n\nCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.\n\nSkill: computer-health-check\nRule: PE2  Category: priv-esc\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-8bef5b72e2dff92a", "name": "SkillSpector RA2 (rogue-agent) in plugins/claude/skills/computer-health-check/references/linux.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in plugins/claude/skills/computer-health-check/references/linux.md"}, "fullDescription": {"text": "systemctl --user list-unit-files --state=enable\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: computer-health-check\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-1d6ce8807d299bbb", "name": "SkillSpector RA2 (rogue-agent) in plugins/claude/skills/computer-health-check/references/macos.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in plugins/claude/skills/computer-health-check/references/macos.md"}, "fullDescription": {"text": "plist\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: computer-health-check\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-f837c8cb651136a6", "name": "SkillSpector TM1 (tool-misuse) in plugins/claude/skills/computer-health-check/references/linux.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in plugins/claude/skills/computer-health-check/references/linux.md"}, "fullDescription": {"text": "rm -rf \"$HOME/.local/share/Trash/\"\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: computer-health-check\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-173f25acb3f3c1ea", "name": "SkillSpector TM1 (tool-misuse) in plugins/claude/skills/computer-health-check/references/macos.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in plugins/claude/skills/computer-health-check/references/macos.md"}, "fullDescription": {"text": "rm -rf \"$HOME/.Trash/\"\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: computer-health-check\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-dc7c83e58b7e846d", "name": "SkillSpector EA2 (excessive-agency) in plugins/claude/skills/desktop-commander-overview/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in plugins/claude/skills/desktop-commander-overview/SKILL.md"}, "fullDescription": {"text": "without asking\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: desktop-commander-overview\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-940298754b23827a", "name": "SkillSpector SC2 (supply-chain) in plugins/claude/skills/terminal/SKILL.md", "shortDescription": {"text": "SkillSpector SC2 (supply-chain) in plugins/claude/skills/terminal/SKILL.md"}, "fullDescription": {"text": "curl / HTTP**: fine for inspection (`curl -i https://...`). Be careful with\n  anything that pipes a downloaded script straight into a shell\n  (`curl ... | sh\n\nRemote code is downloaded and executed. This bypasses code review and could introduce malicious code.\n\nSkill: terminal\nRule: SC2  Category: supply-chain\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-619e55487eb3e0c1", "name": "SkillSpector TM1 (tool-misuse) in plugins/claude/skills/terminal/SKILL.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in plugins/claude/skills/terminal/SKILL.md"}, "fullDescription": {"text": "rm -rf`, `Remove-Item -Recurse -Force`, `del /\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: terminal\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-8bcd4ef8fe4e33f2", "name": "SkillSpector SC2 (supply-chain) in plugins/cursor/skills/ai-tools-setup/references/hermes.md", "shortDescription": {"text": "SkillSpector SC2 (supply-chain) in plugins/cursor/skills/ai-tools-setup/references/hermes.md"}, "fullDescription": {"text": "curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash\n\nRemote code is downloaded and executed. This bypasses code review and could introduce malicious code.\n\nSkill: ai-tools-setup\nRule: SC2  Category: supply-chain\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-508a490f16b093a7", "name": "SkillSpector TM2 (tool-misuse) in plugins/cursor/skills/ai-tools-setup/references/hermes.md", "shortDescription": {"text": "SkillSpector TM2 (tool-misuse) in plugins/cursor/skills/ai-tools-setup/references/hermes.md"}, "fullDescription": {"text": "| bash\n\nTool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.\n\nSkill: ai-tools-setup\nRule: TM2  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-e2ffe771e0855d89", "name": "SkillSpector PE2 (priv-esc) in plugins/cursor/skills/computer-health-check/SKILL.md", "shortDescription": {"text": "SkillSpector PE2 (priv-esc) in plugins/cursor/skills/computer-health-check/SKILL.md"}, "fullDescription": {"text": "sudo\n\nCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.\n\nSkill: computer-health-check\nRule: PE2  Category: priv-esc\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-634d5b5e9ed0bf13", "name": "SkillSpector PE2 (priv-esc) in plugins/cursor/skills/computer-health-check/references/linux.md", "shortDescription": {"text": "SkillSpector PE2 (priv-esc) in plugins/cursor/skills/computer-health-check/references/linux.md"}, "fullDescription": {"text": "sudo\n\nCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.\n\nSkill: computer-health-check\nRule: PE2  Category: priv-esc\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-ba5670c10809beb5", "name": "SkillSpector RA2 (rogue-agent) in plugins/cursor/skills/computer-health-check/references/linux.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in plugins/cursor/skills/computer-health-check/references/linux.md"}, "fullDescription": {"text": "systemctl --user list-unit-files --state=enable\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: computer-health-check\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-b7e7a2de436ad36d", "name": "SkillSpector RA2 (rogue-agent) in plugins/cursor/skills/computer-health-check/references/macos.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in plugins/cursor/skills/computer-health-check/references/macos.md"}, "fullDescription": {"text": "plist\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: computer-health-check\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-9759b10f39c98d17", "name": "SkillSpector TM1 (tool-misuse) in plugins/cursor/skills/computer-health-check/references/linux.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in plugins/cursor/skills/computer-health-check/references/linux.md"}, "fullDescription": {"text": "rm -rf \"$HOME/.local/share/Trash/\"\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: computer-health-check\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-24ff9f01995f1a9f", "name": "SkillSpector TM1 (tool-misuse) in plugins/cursor/skills/computer-health-check/references/macos.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in plugins/cursor/skills/computer-health-check/references/macos.md"}, "fullDescription": {"text": "rm -rf \"$HOME/.Trash/\"\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: computer-health-check\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-8fd0f2c2abcbed71", "name": "SkillSpector EA2 (excessive-agency) in plugins/cursor/skills/desktop-commander-overview/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in plugins/cursor/skills/desktop-commander-overview/SKILL.md"}, "fullDescription": {"text": "without asking\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: desktop-commander-overview\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-9e16c4fb927aa384", "name": "SkillSpector SC2 (supply-chain) in plugins/cursor/skills/terminal/SKILL.md", "shortDescription": {"text": "SkillSpector SC2 (supply-chain) in plugins/cursor/skills/terminal/SKILL.md"}, "fullDescription": {"text": "curl / HTTP**: fine for inspection (`curl -i https://...`). Be careful with\n  anything that pipes a downloaded script straight into a shell\n  (`curl ... | sh\n\nRemote code is downloaded and executed. This bypasses code review and could introduce malicious code.\n\nSkill: terminal\nRule: SC2  Category: supply-chain\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5ca39fa71af69b47", "name": "SkillSpector TM1 (tool-misuse) in plugins/cursor/skills/terminal/SKILL.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in plugins/cursor/skills/terminal/SKILL.md"}, "fullDescription": {"text": "rm -rf`, `Remove-Item -Recurse -Force`, `del /\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: terminal\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan skills/ai-tools-setup --format sarif --"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ca65d9563c664ed", "name": "Docker base image is tag-pinned but not digest-pinned: node:lts-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:lts-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e954496c395293f", "name": "Insecure pattern 'exec_used' in setup-claude-server.js:128", "shortDescription": {"text": "Insecure pattern 'exec_used' in setup-claude-server.js:128"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-39edcdafaee920b7", "name": "Insecure pattern 'node_child_process' in setup-claude-server.js:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in setup-claude-server.js:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-20ec9afaa192204a", "name": "Insecure pattern 'exec_used' in uninstall-claude-server.js:86", "shortDescription": {"text": "Insecure pattern 'exec_used' in uninstall-claude-server.js:86"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ef7212a3b80c430c", "name": "Insecure pattern 'node_child_process' in uninstall-claude-server.js:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in uninstall-claude-server.js:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-d57ce0d6bcf0fd64", "name": "Insecure pattern 'node_child_process' in scripts/download-all-ripgrep.cjs:117", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/download-all-ripgrep.cjs:117"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-ee090e1b975eb739", "name": "Insecure pattern 'node_child_process' in scripts/publish-release.cjs:17", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/publish-release.cjs:17"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-94624dd1b8b1f6d5", "name": "Insecure pattern 'node_child_process' in scripts/build-mcpb.cjs:16", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/build-mcpb.cjs:16"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-4820b704afeb4352", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/shared/tool-shell.ts:39", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/shared/tool-shell.ts:39"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-54b036df4ba41a06", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/config-editor/src/app.ts:594", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/config-editor/src/app.ts:594"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-b1bb1bf7df3ce55f", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/config-editor/src/array-modal.ts:100", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/config-editor/src/array-modal.ts:100"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-de9e8acba1f412f5", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/file-preview/src/document-outline.ts:106", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/file-preview/src/document-outline.ts:106"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-9703747787ac9249", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/file-preview/src/directory-controller.ts:200", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/file-preview/src/directory-controller.ts:200"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-7e53efabfe47fdd8", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/file-preview/src/app.ts:268", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/file-preview/src/app.ts:268"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-d221523ba418ab48", "name": "Insecure pattern 'node_child_process' in src/utils/system-info.ts:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/utils/system-info.ts:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-f21dcf700686b2cc", "name": "Insecure pattern 'node_child_process' in src/utils/ripgrep-resolver.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/utils/ripgrep-resolver.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5d21cad4dd2b2984", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5c6e806454f7092", "name": "Install-time lifecycle script performs network/shell-sensitive actions", "shortDescription": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c25f20adaddc01cf", "name": "Very large file: src/server.ts (1699 lines)", "shortDescription": {"text": "Very large file: src/server.ts (1699 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6af267e1f6e65bef", "name": "Very large file: src/ui/file-preview/src/markdown/editor.ts (1650 lines)", "shortDescription": {"text": "Very large file: src/ui/file-preview/src/markdown/editor.ts (1650 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b8c5a212fcfe82d", "name": "Very large file: src/ui/file-preview/src/markdown/controller.ts (1213 lines)", "shortDescription": {"text": "Very large file: src/ui/file-preview/src/markdown/controller.ts (1213 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 424 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 30 placeholder/mock markers across 3 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85c7085e26b95366", "name": "Legacy-named symbol `create_config_backup` in uninstall-claude-server.js:435", "shortDescription": {"text": "Legacy-named symbol `create_config_backup` in uninstall-claude-server.js:435"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf96a3c170aed871", "name": "Legacy-named symbol `previousOld` in src/ui/file-preview/src/markdown/controller.ts:109", "shortDescription": {"text": "Legacy-named symbol `previousOld` in src/ui/file-preview/src/markdown/controller.ts:109"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bc7c58498addf15", "name": "Legacy-named symbol `direct_5option_v2` in src/utils/usageTracker.ts:537", "shortDescription": {"text": "Legacy-named symbol `direct_5option_v2` in src/utils/usageTracker.ts:537"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca04cc306fecfc8f", "name": "Vulnerable dependency @modelcontextprotocol/sdk 1.25.1: GHSA-345p-7cg4-v4c7", "shortDescription": {"text": "Vulnerable dependency @modelcontextprotocol/sdk 1.25.1: GHSA-345p-7cg4-v4c7"}, "fullDescription": {"text": "OSV.dev reports `@modelcontextprotocol/sdk` at version `1.25.1` (resolved in `package-lock.json`) is affected by GHSA-345p-7cg4-v4c7 (aka CVE-2026-25536).\n\n@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse\n\nAliases: CVE-2026-25536\nAdvisory: https://osv.dev/vulnerability/GHSA-345p-7cg4-v4c7\nFix: upgrade `@modelcontextprotocol/sdk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-285def38db77e981", "name": "Vulnerable dependency @modelcontextprotocol/sdk 1.25.1: GHSA-8r9q-7v3j-jr4g", "shortDescription": {"text": "Vulnerable dependency @modelcontextprotocol/sdk 1.25.1: GHSA-8r9q-7v3j-jr4g"}, "fullDescription": {"text": "OSV.dev reports `@modelcontextprotocol/sdk` at version `1.25.1` (resolved in `package-lock.json`) is affected by GHSA-8r9q-7v3j-jr4g (aka CVE-2026-0621).\n\nAnthropic's MCP TypeScript SDK has a ReDoS vulnerability\n\nAliases: CVE-2026-0621\nAdvisory: https://osv.dev/vulnerability/GHSA-8r9q-7v3j-jr4g\nFix: upgrade `@modelcontextprotocol/sdk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3796523ff81133c2", "name": "Vulnerable dependency file-type 21.2.0: GHSA-5v7r-6r5c-r473", "shortDescription": {"text": "Vulnerable dependency file-type 21.2.0: GHSA-5v7r-6r5c-r473"}, "fullDescription": {"text": "OSV.dev reports `file-type` at version `21.2.0` (resolved in `package-lock.json`) is affected by GHSA-5v7r-6r5c-r473 (aka CVE-2026-31808).\n\nfile-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header\n\nAliases: CVE-2026-31808\nAdvisory: https://osv.dev/vulnerability/GHSA-5v7r-6r5c-r473\nFix: upgrade `file-type` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-520f52c3addfe3eb", "name": "Vulnerable dependency file-type 21.2.0: GHSA-j47w-4g3g-c36v", "shortDescription": {"text": "Vulnerable dependency file-type 21.2.0: GHSA-j47w-4g3g-c36v"}, "fullDescription": {"text": "OSV.dev reports `file-type` at version `21.2.0` (resolved in `package-lock.json`) is affected by GHSA-j47w-4g3g-c36v (aka CVE-2026-32630).\n\nfile-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry\n\nAliases: CVE-2026-32630\nAdvisory: https://osv.dev/vulnerability/GHSA-j47w-4g3g-c36v\nFix: upgrade `file-type` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdeb6e007f379acd", "name": "Vulnerable dependency markdown-it 14.1.0: GHSA-38c4-r59v-3vqw", "shortDescription": {"text": "Vulnerable dependency markdown-it 14.1.0: GHSA-38c4-r59v-3vqw"}, "fullDescription": {"text": "OSV.dev reports `markdown-it` at version `14.1.0` (resolved in `package-lock.json`) is affected by GHSA-38c4-r59v-3vqw (aka CVE-2026-2327).\n\nmarkdown-it is has a Regular Expression Denial of Service (ReDoS)\n\nAliases: CVE-2026-2327\nAdvisory: https://osv.dev/vulnerability/GHSA-38c4-r59v-3vqw\nFix: upgrade `markdown-it` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bdf76a4d9130459", "name": "Vulnerable dependency markdown-it 14.1.0: GHSA-6v5v-wf23-fmfq", "shortDescription": {"text": "Vulnerable dependency markdown-it 14.1.0: GHSA-6v5v-wf23-fmfq"}, "fullDescription": {"text": "OSV.dev reports `markdown-it` at version `14.1.0` (resolved in `package-lock.json`) is affected by GHSA-6v5v-wf23-fmfq (aka CVE-2026-48988).\n\nmarkdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations\n\nAliases: CVE-2026-48988\nAdvisory: https://osv.dev/vulnerability/GHSA-6v5v-wf23-fmfq\nFix: upgrade `markdown-it` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7f72c856462d27b", "name": "Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj", "shortDescription": {"text": "Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj"}, "fullDescription": {"text": "OSV.dev reports `sharp` at version `0.34.5` (resolved in `package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj.\n\nsharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj\nFix: upgrade `sharp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-31e4fb85b4cbe6a8", "name": "Vulnerable dependency @hono/node-server 1.19.7: GHSA-92pp-h63x-v22m", "shortDescription": {"text": "Vulnerable dependency @hono/node-server 1.19.7: GHSA-92pp-h63x-v22m"}, "fullDescription": {"text": "OSV.dev reports `@hono/node-server` at version `1.19.7` (resolved in `package-lock.json`) is affected by GHSA-92pp-h63x-v22m (aka CVE-2026-39406).\nNote: `@hono/node-server` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\n@hono/node-server: Middleware bypass via repeated slashes in serveStatic\n\nAliases: CVE-2026-39406\nAdvisory: https://osv.dev/vulnerability/GHSA-92pp-h63x-v22m\nFix: upgrade `@hono/node-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-47a4d4bb8257e24e", "name": "Vulnerable dependency @hono/node-server 1.19.7: GHSA-frvp-7c67-39w9", "shortDescription": {"text": "Vulnerable dependency @hono/node-server 1.19.7: GHSA-frvp-7c67-39w9"}, "fullDescription": {"text": "OSV.dev reports `@hono/node-server` at version `1.19.7` (resolved in `package-lock.json`) is affected by GHSA-frvp-7c67-39w9.\nNote: `@hono/node-server` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNode.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)\n\nAdvisory: https://osv.dev/vulnerability/GHSA-frvp-7c67-39w9\nFix: upgrade `@hono/node-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-aa2611a63511d2a7", "name": "Vulnerable dependency @hono/node-server 1.19.7: GHSA-wc8c-qw6v-h7f6", "shortDescription": {"text": "Vulnerable dependency @hono/node-server 1.19.7: GHSA-wc8c-qw6v-h7f6"}, "fullDescription": {"text": "OSV.dev reports `@hono/node-server` at version `1.19.7` (resolved in `package-lock.json`) is affected by GHSA-wc8c-qw6v-h7f6.\nNote: `@hono/node-server` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wc8c-qw6v-h7f6\nFix: upgrade `@hono/node-server` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e8d77ca63cdd2701", "name": "Vulnerable dependency body-parser 2.2.2: GHSA-v422-hmwv-36x6", "shortDescription": {"text": "Vulnerable dependency body-parser 2.2.2: GHSA-v422-hmwv-36x6"}, "fullDescription": {"text": "OSV.dev reports `body-parser` at version `2.2.2` (resolved in `package-lock.json`) is affected by GHSA-v422-hmwv-36x6.\nNote: `body-parser` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v422-hmwv-36x6\nFix: upgrade `body-parser` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a809b2c67b4c88e5", "name": "Vulnerable dependency ajv 8.17.1: GHSA-2g4f-4pwh-qvx6", "shortDescription": {"text": "Vulnerable dependency ajv 8.17.1: GHSA-2g4f-4pwh-qvx6"}, "fullDescription": {"text": "OSV.dev reports `ajv` at version `8.17.1` (resolved in `package-lock.json`) is affected by GHSA-2g4f-4pwh-qvx6 (aka CVE-2025-69873).\nNote: `ajv` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\najv has ReDoS when using `$data` option\n\nAliases: CVE-2025-69873\nAdvisory: https://osv.dev/vulnerability/GHSA-2g4f-4pwh-qvx6\nFix: upgrade `ajv` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-89172c187baf1165", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-17c8fe3de04ea014", "name": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `package-lock.json`) is affected by GHSA-f886-m6hf-6m8v (aka CVE-2026-33750).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: Zero-step sequence causes process hang and memory exhaustion\n\nAliases: CVE-2026-33750\nAdvisory: https://osv.dev/vulnerability/GHSA-f886-m6hf-6m8v\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-693b97f238f36a20", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `package-lock.json`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5084627b4aa56291", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `package-lock.json`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-42d7762fbdc67e0f", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `package-lock.json`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-0b981e12f34240a1", "name": "Vulnerable dependency basic-ftp 5.1.0: GHSA-5rq4-664w-9x2c", "shortDescription": {"text": "Vulnerable dependency basic-ftp 5.1.0: GHSA-5rq4-664w-9x2c"}, "fullDescription": {"text": "OSV.dev reports `basic-ftp` at version `5.1.0` (resolved in `package-lock.json`) is affected by GHSA-5rq4-664w-9x2c (aka CVE-2026-27699).\nNote: `basic-ftp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nBasic FTP has Path Traversal Vulnerability in its downloadToDir()\u00a0method\n\nAliases: CVE-2026-27699\nAdvisory: https://osv.dev/vulnerability/GHSA-5rq4-664w-9x2c\nFix: upgrade `basic-ftp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "critical", "confidence": 0.9}}, {"id": "scanner-87d1591a4e325fe6", "name": "Vulnerable dependency basic-ftp 5.1.0: GHSA-6v7q-wjvx-w8wg", "shortDescription": {"text": "Vulnerable dependency basic-ftp 5.1.0: GHSA-6v7q-wjvx-w8wg"}, "fullDescription": {"text": "OSV.dev reports `basic-ftp` at version `5.1.0` (resolved in `package-lock.json`) is affected by GHSA-6v7q-wjvx-w8wg.\nNote: `basic-ftp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbasic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6v7q-wjvx-w8wg\nFix: upgrade `basic-ftp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-db25f16eaba138d1", "name": "Vulnerable dependency basic-ftp 5.1.0: GHSA-rp42-5vxx-qpwr", "shortDescription": {"text": "Vulnerable dependency basic-ftp 5.1.0: GHSA-rp42-5vxx-qpwr"}, "fullDescription": {"text": "OSV.dev reports `basic-ftp` at version `5.1.0` (resolved in `package-lock.json`) is affected by GHSA-rp42-5vxx-qpwr (aka CVE-2026-41324).\nNote: `basic-ftp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbasic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()\n\nAliases: CVE-2026-41324\nAdvisory: https://osv.dev/vulnerability/GHSA-rp42-5vxx-qpwr\nFix: upgrade `basic-ftp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c765a5182aee9097", "name": "Vulnerable dependency basic-ftp 5.1.0: GHSA-rpmf-866q-6p89", "shortDescription": {"text": "Vulnerable dependency basic-ftp 5.1.0: GHSA-rpmf-866q-6p89"}, "fullDescription": {"text": "OSV.dev reports `basic-ftp` at version `5.1.0` (resolved in `package-lock.json`) is affected by GHSA-rpmf-866q-6p89.\nNote: `basic-ftp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rpmf-866q-6p89\nFix: upgrade `basic-ftp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cab2b270c4f6921d", "name": "Vulnerable dependency brace-expansion 2.0.2: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.0.2` (resolved in `package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-1ae2f57bc52c77e8", "name": "Vulnerable dependency brace-expansion 2.0.2: GHSA-f886-m6hf-6m8v", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-f886-m6hf-6m8v"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.0.2` (resolved in `package-lock.json`) is affected by GHSA-f886-m6hf-6m8v (aka CVE-2026-33750).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: Zero-step sequence causes process hang and memory exhaustion\n\nAliases: CVE-2026-33750\nAdvisory: https://osv.dev/vulnerability/GHSA-f886-m6hf-6m8v\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1b636a45bdf9c032", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `package-lock.json`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\njs-yaml: YAML merge-key chains can force quadratic CPU consumption\n\nAliases: CVE-2026-59869\nAdvisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-4d0a19b03f4897fd", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `package-lock.json`) is affected by GHSA-h67p-54hq-rp68 (aka CVE-2026-53550).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nJS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases\n\nAliases: CVE-2026-53550\nAdvisory: https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-eb25906b5da26a5f", "name": "Vulnerable dependency decompress 4.2.1: GHSA-mp2f-45pm-3cg9", "shortDescription": {"text": "Vulnerable dependency decompress 4.2.1: GHSA-mp2f-45pm-3cg9"}, "fullDescription": {"text": "OSV.dev reports `decompress` at version `4.2.1` (resolved in `package-lock.json`) is affected by GHSA-mp2f-45pm-3cg9 (aka CVE-2026-53486).\nNote: `decompress` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nDecompress: Archive extraction can create files and links outside of the target directory\n\nAliases: CVE-2026-53486\nAdvisory: https://osv.dev/vulnerability/GHSA-mp2f-45pm-3cg9\nFix: upgrade `decompress` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-3cf1d7c4c2d618f8", "name": "Vulnerable dependency diff 4.0.2: GHSA-73rr-hh4g-fpgx", "shortDescription": {"text": "Vulnerable dependency diff 4.0.2: GHSA-73rr-hh4g-fpgx"}, "fullDescription": {"text": "OSV.dev reports `diff` at version `4.0.2` (resolved in `package-lock.json`) is affected by GHSA-73rr-hh4g-fpgx (aka CVE-2026-24001).\nNote: `diff` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\njsdiff has a Denial of Service vulnerability in parsePatch and applyPatch\n\nAliases: CVE-2026-24001\nAdvisory: https://osv.dev/vulnerability/GHSA-73rr-hh4g-fpgx\nFix: upgrade `diff` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-3f43634c2edda34a", "name": "Vulnerable dependency got 8.3.2: GHSA-pfrx-2q88-qq97", "shortDescription": {"text": "Vulnerable dependency got 8.3.2: GHSA-pfrx-2q88-qq97"}, "fullDescription": {"text": "OSV.dev reports `got` at version `8.3.2` (resolved in `package-lock.json`) is affected by GHSA-pfrx-2q88-qq97 (aka CVE-2022-33987).\nNote: `got` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nGot allows a redirect to a UNIX socket\n\nAliases: CVE-2022-33987\nAdvisory: https://osv.dev/vulnerability/GHSA-pfrx-2q88-qq97\nFix: upgrade `got` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a6ca4eccddcabbc4", "name": "Vulnerable dependency http-cache-semantics 3.8.1: GHSA-rc47-6667-2j5j", "shortDescription": {"text": "Vulnerable dependency http-cache-semantics 3.8.1: GHSA-rc47-6667-2j5j"}, "fullDescription": {"text": "OSV.dev reports `http-cache-semantics` at version `3.8.1` (resolved in `package-lock.json`) is affected by GHSA-rc47-6667-2j5j (aka CVE-2022-25881).\nNote: `http-cache-semantics` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nhttp-cache-semantics vulnerable to Regular Expression Denial of Service\n\nAliases: CVE-2022-25881\nAdvisory: https://osv.dev/vulnerability/GHSA-rc47-6667-2j5j\nFix: upgrade `http-cache-semantics` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-9bf68f475e7ee699", "name": "Vulnerable dependency tmp 0.0.33: GHSA-52f5-9888-hmc6", "shortDescription": {"text": "Vulnerable dependency tmp 0.0.33: GHSA-52f5-9888-hmc6"}, "fullDescription": {"text": "OSV.dev reports `tmp` at version `0.0.33` (resolved in `package-lock.json`) is affected by GHSA-52f5-9888-hmc6 (aka CVE-2025-54798).\nNote: `tmp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\ntmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter\n\nAliases: CVE-2025-54798\nAdvisory: https://osv.dev/vulnerability/GHSA-52f5-9888-hmc6\nFix: upgrade `tmp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-916152018d5732b4", "name": "Vulnerable dependency tmp 0.0.33: GHSA-ph9p-34f9-6g65", "shortDescription": {"text": "Vulnerable dependency tmp 0.0.33: GHSA-ph9p-34f9-6g65"}, "fullDescription": {"text": "OSV.dev reports `tmp` at version `0.0.33` (resolved in `package-lock.json`) is affected by GHSA-ph9p-34f9-6g65 (aka CVE-2026-44705).\nNote: `tmp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\ntmp has Path Traversal via unsanitized prefix/postfix that enables directory escape\n\nAliases: CVE-2026-44705\nAdvisory: https://osv.dev/vulnerability/GHSA-ph9p-34f9-6g65\nFix: upgrade `tmp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5428029288d21c4a", "name": "Dependency file-type is a major version behind", "shortDescription": {"text": "Dependency file-type is a major version behind"}, "fullDescription": {"text": "`file-type` is pinned at `21.1.1` in `package.json` while the latest release on the npm registry is `22.0.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `file-type` to `22.0.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-37943f016e22c301", "name": "Dependency glob is two or more major versions behind", "shortDescription": {"text": "Dependency glob is two or more major versions behind"}, "fullDescription": {"text": "`glob` is pinned at `10.3.10` in `package.json` while the latest release on the npm registry is `13.0.6` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `glob` to `13.0.6`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f02b865fee0c4785", "name": "Dependency isbinaryfile is a major version behind", "shortDescription": {"text": "Dependency isbinaryfile is a major version behind"}, "fullDescription": {"text": "`isbinaryfile` is pinned at `5.0.4` in `package.json` while the latest release on the npm registry is `6.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `isbinaryfile` to `6.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-1d759a00cffff1b3", "name": "Dependency open is a major version behind", "shortDescription": {"text": "Dependency open is a major version behind"}, "fullDescription": {"text": "`open` is pinned at `10.2.0` in `package.json` while the latest release on the npm registry is `11.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `open` to `11.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-d637c276d64febc3", "name": "Dependency zod is a major version behind", "shortDescription": {"text": "Dependency zod is a major version behind"}, "fullDescription": {"text": "`zod` is pinned at `3.24.1` in `package.json` while the latest release on the npm registry is `4.4.3` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `zod` to `4.4.3`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30760"}, "properties": {"repository": "wonderwhy-er/DesktopCommanderMCP", "repoUrl": "https://github.com/wonderwhy-er/DesktopCommanderMCP", "branch": "main"}, "results": [{"ruleId": "scanner-d9f3b2d961efb1d1", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 track-installation.js:317"}, "properties": {"repobilityId": "4287a36aa1320ab2", "scanner": "scanner-primary", "fingerprint": "d9f3b2d961efb1d1", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "track-installation.js"}, "region": {"startLine": 317}}}]}, {"ruleId": "scanner-914c57fd30b3ed15", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/utils/capture.ts:35"}, "properties": {"repobilityId": "4aa26ef2be9f3f6b", "scanner": "scanner-primary", "fingerprint": "914c57fd30b3ed15", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/utils/capture.ts"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-815dc4ee7d2f992b", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/utils/files/text.ts:27"}, "properties": {"repobilityId": "91a16886c8cc4272", "scanner": "scanner-primary", "fingerprint": "815dc4ee7d2f992b", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/utils/files/text.ts"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-c4bf1b77f81ae0db", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/remote-device/remote-channel.ts:170"}, "properties": {"repobilityId": "23a0a829d5b1a024", "scanner": "scanner-primary", "fingerprint": "c4bf1b77f81ae0db", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/remote-device/remote-channel.ts"}, "region": {"startLine": 170}}}]}, {"ruleId": "scanner-3cf5d87ef8c0579d", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/tools/edit.ts:325"}, "properties": {"repobilityId": "3a5c02a279839b77", "scanner": "scanner-primary", "fingerprint": "3cf5d87ef8c0579d", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tools/edit.ts"}, "region": {"startLine": 325}}}]}, {"ruleId": "scanner-68f3c3c7191b7d3b", "level": "warning", "message": {"text": "detect child process \u2014 scripts/download-all-ripgrep.cjs:124"}, "properties": {"repobilityId": "d3a450a127dd22c0", "scanner": "scanner-primary", "fingerprint": "68f3c3c7191b7d3b", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/download-all-ripgrep.cjs"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-cdfd58c199b5a2f3", "level": "warning", "message": {"text": "detect child process \u2014 scripts/publish-release.cjs:93"}, "properties": {"repobilityId": "a329f0ff83abeb34", "scanner": "scanner-primary", "fingerprint": "cdfd58c199b5a2f3", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/publish-release.cjs"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-3f78193a99c53d6d", "level": "warning", "message": {"text": "detect child process \u2014 src/terminal-manager.ts:256"}, "properties": {"repobilityId": "0c5e1a55c452c62f", "scanner": "scanner-primary", "fingerprint": "3f78193a99c53d6d", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/terminal-manager.ts"}, "region": {"startLine": 256}}}]}, {"ruleId": "scanner-8d748e4e2ad991b2", "level": "warning", "message": {"text": "unknown value with script tag \u2014 src/ui/resources.ts:59"}, "properties": {"repobilityId": "d843effbcc2d66c0", "scanner": "scanner-primary", "fingerprint": "8d748e4e2ad991b2", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/resources.ts"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-0615b34084c78189", "level": "error", "message": {"text": "CVE-2026-29087: @hono/node-server 1.19.7 \u2014 package-lock.json"}, "properties": {"repobilityId": "f2e5cf6e16347963", "scanner": "scanner-primary", "fingerprint": "0615b34084c78189", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29087"]}}, {"ruleId": "scanner-ed4a273ce469ac12", "level": "warning", "message": {"text": "CVE-2026-39406: @hono/node-server 1.19.7 \u2014 package-lock.json"}, "properties": {"repobilityId": "15631b177ca64f6e", "scanner": "scanner-primary", "fingerprint": "ed4a273ce469ac12", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39406"]}}, {"ruleId": "scanner-4cfb90809aa72f94", "level": "warning", "message": {"text": "GHSA-frvp-7c67-39w9: @hono/node-server 1.19.7 \u2014 package-lock.json"}, "properties": {"repobilityId": "30050d81e6c53f93", "scanner": "scanner-primary", "fingerprint": "4cfb90809aa72f94", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-frvp-7c67-39w9"]}}, {"ruleId": "scanner-8d3ad5e4f2ac7ae6", "level": "error", "message": {"text": "CVE-2026-0621: @modelcontextprotocol/sdk 1.25.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "70fb97894e012f15", "scanner": "scanner-primary", "fingerprint": "8d3ad5e4f2ac7ae6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-0621"]}}, {"ruleId": "scanner-5eb5cefcf548196a", "level": "error", "message": {"text": "CVE-2026-25536: @modelcontextprotocol/sdk 1.25.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "b0a512043e728427", "scanner": "scanner-primary", "fingerprint": "5eb5cefcf548196a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25536"]}}, {"ruleId": "scanner-4457907f6cda3da9", "level": "warning", "message": {"text": "CVE-2025-69873: ajv 8.17.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "f8e92f8faeb89762", "scanner": "scanner-primary", "fingerprint": "4457907f6cda3da9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-69873"]}}, {"ruleId": "scanner-118fb928ee6354db", "level": "error", "message": {"text": "CVE-2026-27699: basic-ftp 5.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "2ddc9ac7c204be92", "scanner": "scanner-primary", "fingerprint": "118fb928ee6354db", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27699"]}}, {"ruleId": "scanner-958949f3eea1a17c", "level": "error", "message": {"text": "CVE-2026-41324: basic-ftp 5.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "92a5b85bfc9d6a3d", "scanner": "scanner-primary", "fingerprint": "958949f3eea1a17c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41324"]}}, {"ruleId": "scanner-27795cb89c64cdb3", "level": "error", "message": {"text": "CVE-2026-44240: basic-ftp 5.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "b3561d4f8244598f", "scanner": "scanner-primary", "fingerprint": "27795cb89c64cdb3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44240"]}}, {"ruleId": "scanner-66b91d9f6cacc41c", "level": "error", "message": {"text": "GHSA-6v7q-wjvx-w8wg: basic-ftp 5.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "7c167888cf2451f8", "scanner": "scanner-primary", "fingerprint": "66b91d9f6cacc41c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-6v7q-wjvx-w8wg"]}}, {"ruleId": "scanner-4584e5503768a719", "level": "note", "message": {"text": "CVE-2026-12590: body-parser 1.20.4 \u2014 package-lock.json"}, "properties": {"repobilityId": "2cc3cf9d6ecedcda", "scanner": "scanner-primary", "fingerprint": "4584e5503768a719", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12590"]}}, {"ruleId": "scanner-c11829f375e6d960", "level": "note", "message": {"text": "CVE-2026-12590: body-parser 2.2.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "2cc3cf9d6ecedcda", "scanner": "scanner-primary", "fingerprint": "c11829f375e6d960", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12590"]}}, {"ruleId": "scanner-0902a6c5b29d085f", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 1.1.12 \u2014 package-lock.json"}, "properties": {"repobilityId": "8775b18ee2ab6ac7", "scanner": "scanner-primary", "fingerprint": "0902a6c5b29d085f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-90695f815b9a3061", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 1.1.12 \u2014 package-lock.json"}, "properties": {"repobilityId": "177d9c72ba8538b6", "scanner": "scanner-primary", "fingerprint": "90695f815b9a3061", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-4934edf4b6b87848", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 2.0.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "8775b18ee2ab6ac7", "scanner": "scanner-primary", "fingerprint": "4934edf4b6b87848", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-95cc0f822c484166", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 2.0.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "177d9c72ba8538b6", "scanner": "scanner-primary", "fingerprint": "95cc0f822c484166", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-4adf6d36ffd584f8", "level": "error", "message": {"text": "CVE-2026-13676: fast-uri 3.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "85801951583e7517", "scanner": "scanner-primary", "fingerprint": "4adf6d36ffd584f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13676"]}}, {"ruleId": "scanner-bf5bc3c980b78418", "level": "error", "message": {"text": "CVE-2026-16221: fast-uri 3.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "be42e91421de6101", "scanner": "scanner-primary", "fingerprint": "bf5bc3c980b78418", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-16221"]}}, {"ruleId": "scanner-795a1c1a931b0551", "level": "error", "message": {"text": "CVE-2026-6321: fast-uri 3.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "05993e7b18c5a816", "scanner": "scanner-primary", "fingerprint": "795a1c1a931b0551", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6321"]}}, {"ruleId": "scanner-cf47d36fffbc9566", "level": "error", "message": {"text": "CVE-2026-6322: fast-uri 3.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "df4c97c1003072e7", "scanner": "scanner-primary", "fingerprint": "cf47d36fffbc9566", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-6322"]}}, {"ruleId": "scanner-902ccb2c1dafff34", "level": "warning", "message": {"text": "CVE-2026-31808: file-type 21.2.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "a1c22e1e7ac7eb54", "scanner": "scanner-primary", "fingerprint": "902ccb2c1dafff34", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31808"]}}, {"ruleId": "scanner-8f32289b21ca68b8", "level": "warning", "message": {"text": "CVE-2026-32630: file-type 21.2.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "0be321ee15cbb749", "scanner": "scanner-primary", "fingerprint": "8f32289b21ca68b8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-32630"]}}, {"ruleId": "scanner-f91d1092345283b1", "level": "error", "message": {"text": "CVE-2026-22817: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "e69652913c3ab4ad", "scanner": "scanner-primary", "fingerprint": "f91d1092345283b1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22817"]}}, {"ruleId": "scanner-85bb7f4b0c826a6d", "level": "error", "message": {"text": "CVE-2026-22818: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "4fb7442786260f25", "scanner": "scanner-primary", "fingerprint": "85bb7f4b0c826a6d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22818"]}}, {"ruleId": "scanner-3b6a13221adb6db4", "level": "error", "message": {"text": "CVE-2026-29045: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "db1bf789c866ddbb", "scanner": "scanner-primary", "fingerprint": "3b6a13221adb6db4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29045"]}}, {"ruleId": "scanner-660af9a2e6f1179f", "level": "error", "message": {"text": "CVE-2026-54290: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "ec2d5ea0e28fc031", "scanner": "scanner-primary", "fingerprint": "660af9a2e6f1179f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54290"]}}, {"ruleId": "scanner-39ee17a203c2bc85", "level": "warning", "message": {"text": "CVE-2026-24398: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "10b6710577faf571", "scanner": "scanner-primary", "fingerprint": "39ee17a203c2bc85", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24398"]}}, {"ruleId": "scanner-0070dda3bfbea44e", "level": "warning", "message": {"text": "CVE-2026-24472: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "22a84d963ddd6693", "scanner": "scanner-primary", "fingerprint": "0070dda3bfbea44e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24472"]}}, {"ruleId": "scanner-45ecf2a89678013a", "level": "warning", "message": {"text": "CVE-2026-24473: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "400db81edbd4cb33", "scanner": "scanner-primary", "fingerprint": "45ecf2a89678013a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24473"]}}, {"ruleId": "scanner-12547b76711e9dc8", "level": "warning", "message": {"text": "CVE-2026-24771: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "33de5fa48a188904", "scanner": "scanner-primary", "fingerprint": "12547b76711e9dc8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24771"]}}, {"ruleId": "scanner-1b2d7427bcf39342", "level": "warning", "message": {"text": "CVE-2026-29085: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "abfb4e02d9cb929b", "scanner": "scanner-primary", "fingerprint": "1b2d7427bcf39342", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29085"]}}, {"ruleId": "scanner-0a497c8e15b59e03", "level": "warning", "message": {"text": "CVE-2026-29086: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "320b1cdb4d8ae2f6", "scanner": "scanner-primary", "fingerprint": "0a497c8e15b59e03", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29086"]}}, {"ruleId": "scanner-b525b08b7f91fdd1", "level": "warning", "message": {"text": "CVE-2026-39407: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "2c3e0f2a82a319aa", "scanner": "scanner-primary", "fingerprint": "b525b08b7f91fdd1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39407"]}}, {"ruleId": "scanner-567f137b201a9a00", "level": "warning", "message": {"text": "CVE-2026-39408: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "e2d1874c64fd375e", "scanner": "scanner-primary", "fingerprint": "567f137b201a9a00", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39408"]}}, {"ruleId": "scanner-12f3055033359551", "level": "warning", "message": {"text": "CVE-2026-39409: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "e3674bab07da4128", "scanner": "scanner-primary", "fingerprint": "12f3055033359551", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39409"]}}, {"ruleId": "scanner-db30463afc4cb96d", "level": "warning", "message": {"text": "CVE-2026-39410: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "4510fe67f9df6104", "scanner": "scanner-primary", "fingerprint": "db30463afc4cb96d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39410"]}}, {"ruleId": "scanner-c1098082495262cb", "level": "warning", "message": {"text": "CVE-2026-44455: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "a0434fd9eb6df127", "scanner": "scanner-primary", "fingerprint": "c1098082495262cb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44455"]}}, {"ruleId": "scanner-579a687be113ea43", "level": "warning", "message": {"text": "CVE-2026-44456: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "99f63af0fd68ded8", "scanner": "scanner-primary", "fingerprint": "579a687be113ea43", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44456"]}}, {"ruleId": "scanner-073b4ed7eb7c623a", "level": "warning", "message": {"text": "CVE-2026-44457: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "1d7df349c286f88a", "scanner": "scanner-primary", "fingerprint": "073b4ed7eb7c623a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44457"]}}, {"ruleId": "scanner-8d1f4cd78f58f451", "level": "warning", "message": {"text": "CVE-2026-44458: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "dd4e838af3242534", "scanner": "scanner-primary", "fingerprint": "8d1f4cd78f58f451", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44458"]}}, {"ruleId": "scanner-f68c88ecab451991", "level": "warning", "message": {"text": "CVE-2026-47673: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "10a375b6a914c371", "scanner": "scanner-primary", "fingerprint": "f68c88ecab451991", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47673"]}}, {"ruleId": "scanner-f528476bc6d648a3", "level": "warning", "message": {"text": "CVE-2026-47674: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "aa623861bbcb7147", "scanner": "scanner-primary", "fingerprint": "f528476bc6d648a3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47674"]}}, {"ruleId": "scanner-6ab223526d98053a", "level": "warning", "message": {"text": "CVE-2026-47675: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "2a0547344de18aba", "scanner": "scanner-primary", "fingerprint": "6ab223526d98053a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47675"]}}, {"ruleId": "scanner-83501649ff591d74", "level": "warning", "message": {"text": "CVE-2026-47676: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "eb5ff93ce288d783", "scanner": "scanner-primary", "fingerprint": "83501649ff591d74", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47676"]}}, {"ruleId": "scanner-932e3d6420283688", "level": "warning", "message": {"text": "CVE-2026-54286: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "a4124107c3210c1e", "scanner": "scanner-primary", "fingerprint": "932e3d6420283688", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54286"]}}, {"ruleId": "scanner-28991021e2556b4d", "level": "warning", "message": {"text": "CVE-2026-54287: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "2e0885b613424708", "scanner": "scanner-primary", "fingerprint": "28991021e2556b4d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54287"]}}, {"ruleId": "scanner-100a367dbd2dbf3a", "level": "warning", "message": {"text": "CVE-2026-54288: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "089bf5d2ed227e7c", "scanner": "scanner-primary", "fingerprint": "100a367dbd2dbf3a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54288"]}}, {"ruleId": "scanner-9d15126d190bd7f7", "level": "warning", "message": {"text": "CVE-2026-54289: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "513e53ec1acf658f", "scanner": "scanner-primary", "fingerprint": "9d15126d190bd7f7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54289"]}}, {"ruleId": "scanner-079981fc194c4de2", "level": "warning", "message": {"text": "CVE-2026-56761: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "95ab76607e0f7111", "scanner": "scanner-primary", "fingerprint": "079981fc194c4de2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56761"]}}, {"ruleId": "scanner-477867b2fff864c6", "level": "warning", "message": {"text": "CVE-2026-59895: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "451d29929a7eac68", "scanner": "scanner-primary", "fingerprint": "477867b2fff864c6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59895"]}}, {"ruleId": "scanner-bdf80f95151fdd91", "level": "warning", "message": {"text": "CVE-2026-59897: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "1c3b13e09e8f8a56", "scanner": "scanner-primary", "fingerprint": "bdf80f95151fdd91", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59897"]}}, {"ruleId": "scanner-1ed3c7730a752db0", "level": "warning", "message": {"text": "GHSA-26pp-8wgv-hjvm: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "905df0a799b74504", "scanner": "scanner-primary", "fingerprint": "1ed3c7730a752db0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-26pp-8wgv-hjvm"]}}, {"ruleId": "scanner-602ff2bc8bb2654f", "level": "warning", "message": {"text": "GHSA-v8w9-8mx6-g223: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "b615ccea31a13361", "scanner": "scanner-primary", "fingerprint": "602ff2bc8bb2654f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-v8w9-8mx6-g223"]}}, {"ruleId": "scanner-5c9b81767c753257", "level": "note", "message": {"text": "CVE-2026-44459: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "d25b58e1bb28d46c", "scanner": "scanner-primary", "fingerprint": "5c9b81767c753257", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44459"]}}, {"ruleId": "scanner-338e730cc67eb100", "level": "note", "message": {"text": "GHSA-gq3j-xvxp-8hrf: hono 4.11.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "c976e1d215b17e82", "scanner": "scanner-primary", "fingerprint": "338e730cc67eb100", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-gq3j-xvxp-8hrf"]}}, {"ruleId": "scanner-bb6002efe0da8368", "level": "warning", "message": {"text": "CVE-2026-42338: ip-address 10.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "85dea9d0977e2b95", "scanner": "scanner-primary", "fingerprint": "bb6002efe0da8368", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42338"]}}, {"ruleId": "scanner-dbd8976598a4b700", "level": "error", "message": {"text": "CVE-2026-59869: js-yaml 3.14.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "a4d9df15b5ac9116", "scanner": "scanner-primary", "fingerprint": "dbd8976598a4b700", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59869"]}}, {"ruleId": "scanner-ded989c6472b1e57", "level": "warning", "message": {"text": "CVE-2026-53550: js-yaml 3.14.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "1e461c70b5f472cf", "scanner": "scanner-primary", "fingerprint": "ded989c6472b1e57", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53550"]}}, {"ruleId": "scanner-bc0ccd78b70c150d", "level": "error", "message": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "a4d9df15b5ac9116", "scanner": "scanner-primary", "fingerprint": "bc0ccd78b70c150d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59869"]}}, {"ruleId": "scanner-316f7609b2d00795", "level": "warning", "message": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "1e461c70b5f472cf", "scanner": "scanner-primary", "fingerprint": "316f7609b2d00795", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53550"]}}, {"ruleId": "scanner-1abded8178a0539b", "level": "error", "message": {"text": "CVE-2026-48801: linkify-it 5.0.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "ae15cdacaea493ce", "scanner": "scanner-primary", "fingerprint": "1abded8178a0539b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48801"]}}, {"ruleId": "scanner-ec5ca415b2fe268d", "level": "error", "message": {"text": "CVE-2026-59887: linkify-it 5.0.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "b988c3a935b4c24c", "scanner": "scanner-primary", "fingerprint": "ec5ca415b2fe268d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59887"]}}, {"ruleId": "scanner-cb613a5e3859c421", "level": "warning", "message": {"text": "CVE-2026-2327: markdown-it 14.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "1ea36dfbf8f27420", "scanner": "scanner-primary", "fingerprint": "cb613a5e3859c421", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2327"]}}, {"ruleId": "scanner-df2c68cf354219fb", "level": "warning", "message": {"text": "CVE-2026-48988: markdown-it 14.1.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "4127327c542d6ac5", "scanner": "scanner-primary", "fingerprint": "df2c68cf354219fb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48988"]}}, {"ruleId": "scanner-64ecea76e6bc5e09", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 3.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "94bff1e4bae0d172", "scanner": "scanner-primary", "fingerprint": "64ecea76e6bc5e09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-5547d992435923f9", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 3.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "49768a082ae8a15a", "scanner": "scanner-primary", "fingerprint": "5547d992435923f9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-fc1422d1987f9a44", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 3.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "ad1a2b4ec39282c6", "scanner": "scanner-primary", "fingerprint": "fc1422d1987f9a44", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-4ec88b724d2f418c", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 5.1.6 \u2014 package-lock.json"}, "properties": {"repobilityId": "94bff1e4bae0d172", "scanner": "scanner-primary", "fingerprint": "4ec88b724d2f418c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-c47ca5360d3f0fe7", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 5.1.6 \u2014 package-lock.json"}, "properties": {"repobilityId": "49768a082ae8a15a", "scanner": "scanner-primary", "fingerprint": "c47ca5360d3f0fe7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-3bfb8e4cc920548c", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 5.1.6 \u2014 package-lock.json"}, "properties": {"repobilityId": "ad1a2b4ec39282c6", "scanner": "scanner-primary", "fingerprint": "3bfb8e4cc920548c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-c709783425d67f93", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 9.0.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "94bff1e4bae0d172", "scanner": "scanner-primary", "fingerprint": "c709783425d67f93", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-fd597560071725ac", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 9.0.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "49768a082ae8a15a", "scanner": "scanner-primary", "fingerprint": "fd597560071725ac", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-8bc7119d765ad06f", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 9.0.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "ad1a2b4ec39282c6", "scanner": "scanner-primary", "fingerprint": "8bc7119d765ad06f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-803b31b526d395e7", "level": "error", "message": {"text": "CVE-2026-4867: path-to-regexp 0.1.12 \u2014 package-lock.json"}, "properties": {"repobilityId": "14d7fcb7dded9249", "scanner": "scanner-primary", "fingerprint": "803b31b526d395e7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4867"]}}, {"ruleId": "scanner-c5910492003881b8", "level": "error", "message": {"text": "CVE-2026-4926: path-to-regexp 8.3.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "95dd5b04dfae0f2c", "scanner": "scanner-primary", "fingerprint": "c5910492003881b8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4926"]}}, {"ruleId": "scanner-d14a76dccc37cb3d", "level": "warning", "message": {"text": "CVE-2026-4923: path-to-regexp 8.3.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "a6ce367a3efeafe9", "scanner": "scanner-primary", "fingerprint": "d14a76dccc37cb3d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4923"]}}, {"ruleId": "scanner-47cda05433ffe784", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "4b0be15d9960fbab", "scanner": "scanner-primary", "fingerprint": "47cda05433ffe784", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-c46fa4398483f6d4", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "2083d545c96f670b", "scanner": "scanner-primary", "fingerprint": "c46fa4398483f6d4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-90884fe11c1cadc2", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.14.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "9874f96ea2c6eb3f", "scanner": "scanner-primary", "fingerprint": "90884fe11c1cadc2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-7cdd521af41d4c52", "level": "note", "message": {"text": "CVE-2026-2391: qs 6.14.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "5828ea7bea940935", "scanner": "scanner-primary", "fingerprint": "7cdd521af41d4c52", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2391"]}}, {"ruleId": "scanner-696edaf1bfda3eab", "level": "error", "message": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "d0b02bd3a646af1f", "scanner": "scanner-primary", "fingerprint": "696edaf1bfda3eab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f88m-g3jw-g9cj"]}}, {"ruleId": "scanner-851605077465984e", "level": "error", "message": {"text": "CVE-2026-59873: tar 6.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "f8005d18db55f8c6", "scanner": "scanner-primary", "fingerprint": "851605077465984e", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59873"]}}, {"ruleId": "scanner-69d789785350595a", "level": "error", "message": {"text": "CVE-2026-23745: tar 6.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "6e99379be8786c50", "scanner": "scanner-primary", "fingerprint": "69d789785350595a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23745"]}}, {"ruleId": "scanner-c946639a409a0ce5", "level": "error", "message": {"text": "CVE-2026-23950: tar 6.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "1cff0e6c3c08864f", "scanner": "scanner-primary", "fingerprint": "c946639a409a0ce5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-23950"]}}, {"ruleId": "scanner-9a7d2f5847a0eb3d", "level": "error", "message": {"text": "CVE-2026-24842: tar 6.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "947ccc008e682b3d", "scanner": "scanner-primary", "fingerprint": "9a7d2f5847a0eb3d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24842"]}}, {"ruleId": "scanner-ca8a7ca37716a7b7", "level": "error", "message": {"text": "CVE-2026-26960: tar 6.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "1baa24849c5270af", "scanner": "scanner-primary", "fingerprint": "ca8a7ca37716a7b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26960"]}}, {"ruleId": "scanner-763369e5f8680ced", "level": "error", "message": {"text": "CVE-2026-29786: tar 6.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "58b354cc21e27709", "scanner": "scanner-primary", "fingerprint": "763369e5f8680ced", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29786"]}}, {"ruleId": "scanner-5e7ae67c52bd2930", "level": "error", "message": {"text": "CVE-2026-31802: tar 6.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "a06984e9d4398fb9", "scanner": "scanner-primary", "fingerprint": "5e7ae67c52bd2930", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31802"]}}, {"ruleId": "scanner-97ba98f700869c71", "level": "error", "message": {"text": "CVE-2026-59874: tar 6.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "fddc56fd8c1ccee1", "scanner": "scanner-primary", "fingerprint": "97ba98f700869c71", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59874"]}}, {"ruleId": "scanner-38dca3a84efbe33b", "level": "warning", "message": {"text": "CVE-2026-53655: tar 6.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "6e1ef9fe4f929ca6", "scanner": "scanner-primary", "fingerprint": "38dca3a84efbe33b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53655"]}}, {"ruleId": "scanner-86749584ac58cc31", "level": "warning", "message": {"text": "CVE-2026-59871: tar 6.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "abf2469fa8d31cf9", "scanner": "scanner-primary", "fingerprint": "86749584ac58cc31", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59871"]}}, {"ruleId": "scanner-8615fe47ce7097b2", "level": "warning", "message": {"text": "CVE-2026-59875: tar 6.2.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "367157b3e8827ec8", "scanner": "scanner-primary", "fingerprint": "8615fe47ce7097b2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59875"]}}, {"ruleId": "scanner-267576bdb824da7d", "level": "error", "message": {"text": "CVE-2026-44705: tmp 0.2.5 \u2014 package-lock.json"}, "properties": {"repobilityId": "1957e99755622c69", "scanner": "scanner-primary", "fingerprint": "267576bdb824da7d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44705"]}}, {"ruleId": "scanner-4739f516a66919b1", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 8.3.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "456116cfa0f62296", "scanner": "scanner-primary", "fingerprint": "4739f516a66919b1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-d3b41d24d73cf707", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "f7e31279300ec7e6", "scanner": "scanner-primary", "fingerprint": "d3b41d24d73cf707", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-9f5abd1f03b5df58", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "7635a49db32e4699", "scanner": "scanner-primary", "fingerprint": "9f5abd1f03b5df58", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-3a3527e70129fb18", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "properties": {"repobilityId": "691787f6b20605df", "scanner": "scanner-primary", "fingerprint": "3a3527e70129fb18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3c4041c454cda88e", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "properties": {"repobilityId": "da995bb2cfa21f65", "scanner": "scanner-primary", "fingerprint": "3c4041c454cda88e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-cc55229a7a3c078d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "properties": {"repobilityId": "51942fb3d5b8b5b4", "scanner": "scanner-primary", "fingerprint": "cc55229a7a3c078d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f015ff12ea0106f2", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: skills/terminal/SKILL.md"}, "properties": {"repobilityId": "f140a5b0c710c331", "scanner": "scanner-primary", "fingerprint": "f015ff12ea0106f2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/terminal/SKILL.md"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-0a00d3690fd9302d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/computer-health-check/SKILL.md"}, "properties": {"repobilityId": "73eb8cea9e6074fa", "scanner": "scanner-primary", "fingerprint": "0a00d3690fd9302d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/computer-health-check/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c84f56ed10e57f8", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: plugins/cursor/skills/terminal/SKILL.md"}, "properties": {"repobilityId": "8d2e9d077375a47b", "scanner": "scanner-primary", "fingerprint": "4c84f56ed10e57f8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/terminal/SKILL.md"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-3f3cd901b0874127", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: plugins/cursor/skills/computer-health-check/SKILL.md"}, "properties": {"repobilityId": "cd0853a09b500075", "scanner": "scanner-primary", "fingerprint": "3f3cd901b0874127", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/computer-health-check/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3563a9ff8dbefcc", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: plugins/claude/skills/terminal/SKILL.md"}, "properties": {"repobilityId": "310e9ce90df3e24b", "scanner": "scanner-primary", "fingerprint": "b3563a9ff8dbefcc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/terminal/SKILL.md"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-123f41f596bf590e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: plugins/claude/skills/computer-health-check/SKILL.md"}, "properties": {"repobilityId": "585033a53f1e116f", "scanner": "scanner-primary", "fingerprint": "123f41f596bf590e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/computer-health-check/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c670d627a573d04", "level": "error", "message": {"text": "SkillSpector SC2 (supply-chain) in skills/ai-tools-setup/references/hermes.md"}, "properties": {"repobilityId": "1b10364f55374e4f", "scanner": "scanner-primary", "fingerprint": "5c670d627a573d04", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/ai-tools-setup/references/hermes.md"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-72a3e57f4e02a183", "level": "error", "message": {"text": "SkillSpector TM2 (tool-misuse) in skills/ai-tools-setup/references/hermes.md"}, "properties": {"repobilityId": "7e72fba1e7dfdba7", "scanner": "scanner-primary", "fingerprint": "72a3e57f4e02a183", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/ai-tools-setup/references/hermes.md"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-b540010da0b01ec8", "level": "warning", "message": {"text": "SkillSpector PE2 (priv-esc) in skills/computer-health-check/SKILL.md"}, "properties": {"repobilityId": "51c87506d263d83a", "scanner": "scanner-primary", "fingerprint": "b540010da0b01ec8", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/computer-health-check/SKILL.md"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-a943d245247746f6", "level": "warning", "message": {"text": "SkillSpector PE2 (priv-esc) in skills/computer-health-check/references/linux.md"}, "properties": {"repobilityId": "a7d466f7dcbd4671", "scanner": "scanner-primary", "fingerprint": "a943d245247746f6", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/computer-health-check/references/linux.md"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-b5ea51a0db63a2bf", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in skills/computer-health-check/references/linux.md"}, "properties": {"repobilityId": "e87340de59dd82f7", "scanner": "scanner-primary", "fingerprint": "b5ea51a0db63a2bf", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/computer-health-check/references/linux.md"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-2c2d9a52a8f8d6f8", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in skills/computer-health-check/references/macos.md"}, "properties": {"repobilityId": "459072f9068a7cc6", "scanner": "scanner-primary", "fingerprint": "2c2d9a52a8f8d6f8", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/computer-health-check/references/macos.md"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-e1a9c90b0f368de8", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/computer-health-check/references/linux.md"}, "properties": {"repobilityId": "f55c6d4ca5604c8c", "scanner": "scanner-primary", "fingerprint": "e1a9c90b0f368de8", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/computer-health-check/references/linux.md"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-37cdecfc3df7d995", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/computer-health-check/references/macos.md"}, "properties": {"repobilityId": "52736ef7ff396fd8", "scanner": "scanner-primary", "fingerprint": "37cdecfc3df7d995", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/computer-health-check/references/macos.md"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-4987bb3334f447d6", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in skills/desktop-commander-overview/SKILL.md"}, "properties": {"repobilityId": "23dbfe37ae0ee401", "scanner": "scanner-primary", "fingerprint": "4987bb3334f447d6", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/desktop-commander-overview/SKILL.md"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-5018604068566566", "level": "error", "message": {"text": "SkillSpector SC2 (supply-chain) in skills/terminal/SKILL.md"}, "properties": {"repobilityId": "55c936553bb4fec2", "scanner": "scanner-primary", "fingerprint": "5018604068566566", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/terminal/SKILL.md"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-6d42751de4becb26", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in skills/terminal/SKILL.md"}, "properties": {"repobilityId": "0cb22b53261f3357", "scanner": "scanner-primary", "fingerprint": "6d42751de4becb26", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/terminal/SKILL.md"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-6565712ca560fd9d", "level": "error", "message": {"text": "SkillSpector SC2 (supply-chain) in plugins/claude/skills/ai-tools-setup/references/hermes.md"}, "properties": {"repobilityId": "b8885a5014176d2c", "scanner": "scanner-primary", "fingerprint": "6565712ca560fd9d", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/ai-tools-setup/references/hermes.md"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-d0f4d9f301c00e10", "level": "error", "message": {"text": "SkillSpector TM2 (tool-misuse) in plugins/claude/skills/ai-tools-setup/references/hermes.md"}, "properties": {"repobilityId": "468529d29ceb57a7", "scanner": "scanner-primary", "fingerprint": "d0f4d9f301c00e10", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/ai-tools-setup/references/hermes.md"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-5534a19aa8c951bc", "level": "warning", "message": {"text": "SkillSpector PE2 (priv-esc) in plugins/claude/skills/computer-health-check/SKILL.md"}, "properties": {"repobilityId": "0256a2250d51230f", "scanner": "scanner-primary", "fingerprint": "5534a19aa8c951bc", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/computer-health-check/SKILL.md"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-11f599297ca102cf", "level": "warning", "message": {"text": "SkillSpector PE2 (priv-esc) in plugins/claude/skills/computer-health-check/references/linux.md"}, "properties": {"repobilityId": "e7c165783f732bc6", "scanner": "scanner-primary", "fingerprint": "11f599297ca102cf", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/computer-health-check/references/linux.md"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-8bef5b72e2dff92a", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in plugins/claude/skills/computer-health-check/references/linux.md"}, "properties": {"repobilityId": "6621d838a391dd5a", "scanner": "scanner-primary", "fingerprint": "8bef5b72e2dff92a", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/computer-health-check/references/linux.md"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-1d6ce8807d299bbb", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in plugins/claude/skills/computer-health-check/references/macos.md"}, "properties": {"repobilityId": "7a3e386f815d3470", "scanner": "scanner-primary", "fingerprint": "1d6ce8807d299bbb", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/computer-health-check/references/macos.md"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-f837c8cb651136a6", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in plugins/claude/skills/computer-health-check/references/linux.md"}, "properties": {"repobilityId": "7ebf07a5cd808758", "scanner": "scanner-primary", "fingerprint": "f837c8cb651136a6", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/computer-health-check/references/linux.md"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-173f25acb3f3c1ea", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in plugins/claude/skills/computer-health-check/references/macos.md"}, "properties": {"repobilityId": "8da0d3c2f0c0f5ef", "scanner": "scanner-primary", "fingerprint": "173f25acb3f3c1ea", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/computer-health-check/references/macos.md"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-dc7c83e58b7e846d", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in plugins/claude/skills/desktop-commander-overview/SKILL.md"}, "properties": {"repobilityId": "6de0ca26675db5b0", "scanner": "scanner-primary", "fingerprint": "dc7c83e58b7e846d", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/desktop-commander-overview/SKILL.md"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-940298754b23827a", "level": "error", "message": {"text": "SkillSpector SC2 (supply-chain) in plugins/claude/skills/terminal/SKILL.md"}, "properties": {"repobilityId": "cc4066b1dc9d390f", "scanner": "scanner-primary", "fingerprint": "940298754b23827a", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/terminal/SKILL.md"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-619e55487eb3e0c1", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in plugins/claude/skills/terminal/SKILL.md"}, "properties": {"repobilityId": "e037b974e2ff88ac", "scanner": "scanner-primary", "fingerprint": "619e55487eb3e0c1", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/claude/skills/terminal/SKILL.md"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-8bcd4ef8fe4e33f2", "level": "error", "message": {"text": "SkillSpector SC2 (supply-chain) in plugins/cursor/skills/ai-tools-setup/references/hermes.md"}, "properties": {"repobilityId": "70012a8270f6aa22", "scanner": "scanner-primary", "fingerprint": "8bcd4ef8fe4e33f2", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/ai-tools-setup/references/hermes.md"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-508a490f16b093a7", "level": "error", "message": {"text": "SkillSpector TM2 (tool-misuse) in plugins/cursor/skills/ai-tools-setup/references/hermes.md"}, "properties": {"repobilityId": "7fbd1ee909686a0e", "scanner": "scanner-primary", "fingerprint": "508a490f16b093a7", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/ai-tools-setup/references/hermes.md"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-e2ffe771e0855d89", "level": "warning", "message": {"text": "SkillSpector PE2 (priv-esc) in plugins/cursor/skills/computer-health-check/SKILL.md"}, "properties": {"repobilityId": "45cc953425c6adca", "scanner": "scanner-primary", "fingerprint": "e2ffe771e0855d89", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/computer-health-check/SKILL.md"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-634d5b5e9ed0bf13", "level": "warning", "message": {"text": "SkillSpector PE2 (priv-esc) in plugins/cursor/skills/computer-health-check/references/linux.md"}, "properties": {"repobilityId": "fbd9c902d78328ff", "scanner": "scanner-primary", "fingerprint": "634d5b5e9ed0bf13", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/computer-health-check/references/linux.md"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-ba5670c10809beb5", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in plugins/cursor/skills/computer-health-check/references/linux.md"}, "properties": {"repobilityId": "5a2176b23d1af7e4", "scanner": "scanner-primary", "fingerprint": "ba5670c10809beb5", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/computer-health-check/references/linux.md"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-b7e7a2de436ad36d", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in plugins/cursor/skills/computer-health-check/references/macos.md"}, "properties": {"repobilityId": "e20a64812f3f442d", "scanner": "scanner-primary", "fingerprint": "b7e7a2de436ad36d", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/computer-health-check/references/macos.md"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-9759b10f39c98d17", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in plugins/cursor/skills/computer-health-check/references/linux.md"}, "properties": {"repobilityId": "90792d64c846dde2", "scanner": "scanner-primary", "fingerprint": "9759b10f39c98d17", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/computer-health-check/references/linux.md"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-24ff9f01995f1a9f", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in plugins/cursor/skills/computer-health-check/references/macos.md"}, "properties": {"repobilityId": "887c87da5a9be8bd", "scanner": "scanner-primary", "fingerprint": "24ff9f01995f1a9f", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/computer-health-check/references/macos.md"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-8fd0f2c2abcbed71", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in plugins/cursor/skills/desktop-commander-overview/SKILL.md"}, "properties": {"repobilityId": "c5d938c3bbedac60", "scanner": "scanner-primary", "fingerprint": "8fd0f2c2abcbed71", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/desktop-commander-overview/SKILL.md"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-9e16c4fb927aa384", "level": "error", "message": {"text": "SkillSpector SC2 (supply-chain) in plugins/cursor/skills/terminal/SKILL.md"}, "properties": {"repobilityId": "5245596fedb7c22b", "scanner": "scanner-primary", "fingerprint": "9e16c4fb927aa384", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/terminal/SKILL.md"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-5ca39fa71af69b47", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in plugins/cursor/skills/terminal/SKILL.md"}, "properties": {"repobilityId": "9b0f8e352308b47d", "scanner": "scanner-primary", "fingerprint": "5ca39fa71af69b47", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/cursor/skills/terminal/SKILL.md"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-1ca65d9563c664ed", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:lts-alpine"}, "properties": {"repobilityId": "6911fddd5d4593b4", "scanner": "scanner-primary", "fingerprint": "1ca65d9563c664ed", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-3e954496c395293f", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in setup-claude-server.js:128"}, "properties": {"repobilityId": "f8904b48ef6ef097", "scanner": "scanner-primary", "fingerprint": "3e954496c395293f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "setup-claude-server.js"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-39edcdafaee920b7", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in setup-claude-server.js:8"}, "properties": {"repobilityId": "9b595df0d699fa4a", "scanner": "scanner-primary", "fingerprint": "39edcdafaee920b7", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "setup-claude-server.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-20ec9afaa192204a", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in uninstall-claude-server.js:86"}, "properties": {"repobilityId": "da23542c40214830", "scanner": "scanner-primary", "fingerprint": "20ec9afaa192204a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uninstall-claude-server.js"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-ef7212a3b80c430c", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in uninstall-claude-server.js:8"}, "properties": {"repobilityId": "1e81d0b855dc7434", "scanner": "scanner-primary", "fingerprint": "ef7212a3b80c430c", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uninstall-claude-server.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-d57ce0d6bcf0fd64", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in scripts/download-all-ripgrep.cjs:117"}, "properties": {"repobilityId": "3608640998ef5a24", "scanner": "scanner-primary", "fingerprint": "d57ce0d6bcf0fd64", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/download-all-ripgrep.cjs"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-ee090e1b975eb739", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in scripts/publish-release.cjs:17"}, "properties": {"repobilityId": "8210f567b17e112b", "scanner": "scanner-primary", "fingerprint": "ee090e1b975eb739", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/publish-release.cjs"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-94624dd1b8b1f6d5", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in scripts/build-mcpb.cjs:16"}, "properties": {"repobilityId": "d702804a1f74abfa", "scanner": "scanner-primary", "fingerprint": "94624dd1b8b1f6d5", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/build-mcpb.cjs"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-4820b704afeb4352", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/shared/tool-shell.ts:39"}, "properties": {"repobilityId": "a998b02660651d05", "scanner": "scanner-primary", "fingerprint": "4820b704afeb4352", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/shared/tool-shell.ts"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-54b036df4ba41a06", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/config-editor/src/app.ts:594"}, "properties": {"repobilityId": "ef42d34ad210b005", "scanner": "scanner-primary", "fingerprint": "54b036df4ba41a06", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/config-editor/src/app.ts"}, "region": {"startLine": 594}}}]}, {"ruleId": "scanner-b1bb1bf7df3ce55f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/config-editor/src/array-modal.ts:100"}, "properties": {"repobilityId": "ebae182c3f592149", "scanner": "scanner-primary", "fingerprint": "b1bb1bf7df3ce55f", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/config-editor/src/array-modal.ts"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-de9e8acba1f412f5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/file-preview/src/document-outline.ts:106"}, "properties": {"repobilityId": "9787cdd88abc5417", "scanner": "scanner-primary", "fingerprint": "de9e8acba1f412f5", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/file-preview/src/document-outline.ts"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-9703747787ac9249", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/file-preview/src/directory-controller.ts:200"}, "properties": {"repobilityId": "0b70717db72f6f34", "scanner": "scanner-primary", "fingerprint": "9703747787ac9249", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/file-preview/src/directory-controller.ts"}, "region": {"startLine": 200}}}]}, {"ruleId": "scanner-7e53efabfe47fdd8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/ui/file-preview/src/app.ts:268"}, "properties": {"repobilityId": "82adc0c441127529", "scanner": "scanner-primary", "fingerprint": "7e53efabfe47fdd8", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ui/file-preview/src/app.ts"}, "region": {"startLine": 268}}}]}, {"ruleId": "scanner-d221523ba418ab48", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in src/utils/system-info.ts:4"}, "properties": {"repobilityId": "41709e5bb5ebbe55", "scanner": "scanner-primary", "fingerprint": "d221523ba418ab48", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/utils/system-info.ts"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-f21dcf700686b2cc", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in src/utils/ripgrep-resolver.ts:1"}, "properties": {"repobilityId": "93a0e165a425f08f", "scanner": "scanner-primary", "fingerprint": "f21dcf700686b2cc", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/utils/ripgrep-resolver.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d21cad4dd2b2984", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "708a4d270047ea78", "scanner": "scanner-primary", "fingerprint": "5d21cad4dd2b2984", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codespell.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-f5c6e806454f7092", "level": "warning", "message": {"text": "Install-time lifecycle script performs network/shell-sensitive actions"}, "properties": {"repobilityId": "714673743ff59cef", "scanner": "scanner-primary", "fingerprint": "f5c6e806454f7092", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c25f20adaddc01cf", "level": "note", "message": {"text": "Very large file: src/server.ts (1699 lines)"}, "properties": {"repobilityId": "5a658d2965d5fcc6", "scanner": "scanner-primary", "fingerprint": "c25f20adaddc01cf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6af267e1f6e65bef", "level": "note", "message": {"text": "Very large file: src/ui/file-preview/src/markdown/editor.ts (1650 lines)"}, "properties": {"repobilityId": "fb3ee4683f8153f4", "scanner": "scanner-primary", "fingerprint": "6af267e1f6e65bef", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3b8c5a212fcfe82d", "level": "note", "message": {"text": "Very large file: src/ui/file-preview/src/markdown/controller.ts (1213 lines)"}, "properties": {"repobilityId": "5a776d894dab87d8", "scanner": "scanner-primary", "fingerprint": "3b8c5a212fcfe82d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "14ff82bbbc6feeff", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "9cefcdcd32dd414c", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "126ac7fc13678e08", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-85c7085e26b95366", "level": "note", "message": {"text": "Legacy-named symbol `create_config_backup` in uninstall-claude-server.js:435"}, "properties": {"repobilityId": "c22b02a13d7158f4", "scanner": "scanner-primary", "fingerprint": "85c7085e26b95366", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bf96a3c170aed871", "level": "note", "message": {"text": "Legacy-named symbol `previousOld` in src/ui/file-preview/src/markdown/controller.ts:109"}, "properties": {"repobilityId": "5e7338f949a7a612", "scanner": "scanner-primary", "fingerprint": "bf96a3c170aed871", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5bc7c58498addf15", "level": "note", "message": {"text": "Legacy-named symbol `direct_5option_v2` in src/utils/usageTracker.ts:537"}, "properties": {"repobilityId": "0faf2750ed337f9b", "scanner": "scanner-primary", "fingerprint": "5bc7c58498addf15", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ca04cc306fecfc8f", "level": "error", "message": {"text": "Vulnerable dependency @modelcontextprotocol/sdk 1.25.1: GHSA-345p-7cg4-v4c7"}, "properties": {"repobilityId": "9eb57c71058b94c2", "scanner": "scanner-primary", "fingerprint": "ca04cc306fecfc8f", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-345p-7cg4-v4c7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-285def38db77e981", "level": "error", "message": {"text": "Vulnerable dependency @modelcontextprotocol/sdk 1.25.1: GHSA-8r9q-7v3j-jr4g"}, "properties": {"repobilityId": "d6a3a9c9cd0216ef", "scanner": "scanner-primary", "fingerprint": "285def38db77e981", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8r9q-7v3j-jr4g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3796523ff81133c2", "level": "warning", "message": {"text": "Vulnerable dependency file-type 21.2.0: GHSA-5v7r-6r5c-r473"}, "properties": {"repobilityId": "602d095b15bc5034", "scanner": "scanner-primary", "fingerprint": "3796523ff81133c2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5v7r-6r5c-r473"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-520f52c3addfe3eb", "level": "warning", "message": {"text": "Vulnerable dependency file-type 21.2.0: GHSA-j47w-4g3g-c36v"}, "properties": {"repobilityId": "e18f8f02fec5e834", "scanner": "scanner-primary", "fingerprint": "520f52c3addfe3eb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j47w-4g3g-c36v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fdeb6e007f379acd", "level": "warning", "message": {"text": "Vulnerable dependency markdown-it 14.1.0: GHSA-38c4-r59v-3vqw"}, "properties": {"repobilityId": "6261f3c22545eeb3", "scanner": "scanner-primary", "fingerprint": "fdeb6e007f379acd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-38c4-r59v-3vqw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1bdf76a4d9130459", "level": "warning", "message": {"text": "Vulnerable dependency markdown-it 14.1.0: GHSA-6v5v-wf23-fmfq"}, "properties": {"repobilityId": "01a88a20352ee866", "scanner": "scanner-primary", "fingerprint": "1bdf76a4d9130459", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6v5v-wf23-fmfq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c7f72c856462d27b", "level": "error", "message": {"text": "Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj"}, "properties": {"repobilityId": "c3222d5482f512fc", "scanner": "scanner-primary", "fingerprint": "c7f72c856462d27b", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f88m-g3jw-g9cj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-31e4fb85b4cbe6a8", "level": "warning", "message": {"text": "Vulnerable dependency @hono/node-server 1.19.7: GHSA-92pp-h63x-v22m"}, "properties": {"repobilityId": "3f37e9354fc08348", "scanner": "scanner-primary", "fingerprint": "31e4fb85b4cbe6a8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-92pp-h63x-v22m", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47a4d4bb8257e24e", "level": "warning", "message": {"text": "Vulnerable dependency @hono/node-server 1.19.7: GHSA-frvp-7c67-39w9"}, "properties": {"repobilityId": "2c28d8edf98035e9", "scanner": "scanner-primary", "fingerprint": "47a4d4bb8257e24e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-frvp-7c67-39w9", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa2611a63511d2a7", "level": "warning", "message": {"text": "Vulnerable dependency @hono/node-server 1.19.7: GHSA-wc8c-qw6v-h7f6"}, "properties": {"repobilityId": "031bee71db69869a", "scanner": "scanner-primary", "fingerprint": "aa2611a63511d2a7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wc8c-qw6v-h7f6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8d77ca63cdd2701", "level": "warning", "message": {"text": "Vulnerable dependency body-parser 2.2.2: GHSA-v422-hmwv-36x6"}, "properties": {"repobilityId": "33169ae6017d1ec9", "scanner": "scanner-primary", "fingerprint": "e8d77ca63cdd2701", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v422-hmwv-36x6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a809b2c67b4c88e5", "level": "warning", "message": {"text": "Vulnerable dependency ajv 8.17.1: GHSA-2g4f-4pwh-qvx6"}, "properties": {"repobilityId": "e37f9a76339c9faa", "scanner": "scanner-primary", "fingerprint": "a809b2c67b4c88e5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2g4f-4pwh-qvx6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89172c187baf1165", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "5d2ce580505ef5a7", "scanner": "scanner-primary", "fingerprint": "89172c187baf1165", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17c8fe3de04ea014", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v"}, "properties": {"repobilityId": "c4fa6cea7167ee7e", "scanner": "scanner-primary", "fingerprint": "17c8fe3de04ea014", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f886-m6hf-6m8v", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-693b97f238f36a20", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "9f7f5897e94c3644", "scanner": "scanner-primary", "fingerprint": "693b97f238f36a20", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5084627b4aa56291", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "1f348c9c38426ebf", "scanner": "scanner-primary", "fingerprint": "5084627b4aa56291", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42d7762fbdc67e0f", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "20c31d31e282c8df", "scanner": "scanner-primary", "fingerprint": "42d7762fbdc67e0f", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0b981e12f34240a1", "level": "error", "message": {"text": "Vulnerable dependency basic-ftp 5.1.0: GHSA-5rq4-664w-9x2c"}, "properties": {"repobilityId": "ff44236805a2fcfa", "scanner": "scanner-primary", "fingerprint": "0b981e12f34240a1", "layer": "dependencies", "severity": "critical", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5rq4-664w-9x2c", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87d1591a4e325fe6", "level": "error", "message": {"text": "Vulnerable dependency basic-ftp 5.1.0: GHSA-6v7q-wjvx-w8wg"}, "properties": {"repobilityId": "e5bdb7d72702b6d5", "scanner": "scanner-primary", "fingerprint": "87d1591a4e325fe6", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6v7q-wjvx-w8wg", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db25f16eaba138d1", "level": "error", "message": {"text": "Vulnerable dependency basic-ftp 5.1.0: GHSA-rp42-5vxx-qpwr"}, "properties": {"repobilityId": "ae6b6f97fa96d9cb", "scanner": "scanner-primary", "fingerprint": "db25f16eaba138d1", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rp42-5vxx-qpwr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c765a5182aee9097", "level": "warning", "message": {"text": "Vulnerable dependency basic-ftp 5.1.0: GHSA-rpmf-866q-6p89"}, "properties": {"repobilityId": "9505b61556d10d16", "scanner": "scanner-primary", "fingerprint": "c765a5182aee9097", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rpmf-866q-6p89", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cab2b270c4f6921d", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "d0f259a88c45355f", "scanner": "scanner-primary", "fingerprint": "cab2b270c4f6921d", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ae2f57bc52c77e8", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 2.0.2: GHSA-f886-m6hf-6m8v"}, "properties": {"repobilityId": "1154f43f37764268", "scanner": "scanner-primary", "fingerprint": "1ae2f57bc52c77e8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f886-m6hf-6m8v", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b636a45bdf9c032", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "properties": {"repobilityId": "bb9354b1169e66e2", "scanner": "scanner-primary", "fingerprint": "1b636a45bdf9c032", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-52cp-r559-cp3m", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4d0a19b03f4897fd", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": "2e7af66f705e9148", "scanner": "scanner-primary", "fingerprint": "4d0a19b03f4897fd", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h67p-54hq-rp68", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eb25906b5da26a5f", "level": "error", "message": {"text": "Vulnerable dependency decompress 4.2.1: GHSA-mp2f-45pm-3cg9"}, "properties": {"repobilityId": "f7434b969c908710", "scanner": "scanner-primary", "fingerprint": "eb25906b5da26a5f", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mp2f-45pm-3cg9", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3cf1d7c4c2d618f8", "level": "note", "message": {"text": "Vulnerable dependency diff 4.0.2: GHSA-73rr-hh4g-fpgx"}, "properties": {"repobilityId": "1d6afa55ef2a872d", "scanner": "scanner-primary", "fingerprint": "3cf1d7c4c2d618f8", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-73rr-hh4g-fpgx", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f43634c2edda34a", "level": "warning", "message": {"text": "Vulnerable dependency got 8.3.2: GHSA-pfrx-2q88-qq97"}, "properties": {"repobilityId": "6f35059ccedbe8c5", "scanner": "scanner-primary", "fingerprint": "3f43634c2edda34a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-pfrx-2q88-qq97", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a6ca4eccddcabbc4", "level": "error", "message": {"text": "Vulnerable dependency http-cache-semantics 3.8.1: GHSA-rc47-6667-2j5j"}, "properties": {"repobilityId": "009abd199adee196", "scanner": "scanner-primary", "fingerprint": "a6ca4eccddcabbc4", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rc47-6667-2j5j", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9bf68f475e7ee699", "level": "note", "message": {"text": "Vulnerable dependency tmp 0.0.33: GHSA-52f5-9888-hmc6"}, "properties": {"repobilityId": "794409f703c021ab", "scanner": "scanner-primary", "fingerprint": "9bf68f475e7ee699", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-52f5-9888-hmc6", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-916152018d5732b4", "level": "error", "message": {"text": "Vulnerable dependency tmp 0.0.33: GHSA-ph9p-34f9-6g65"}, "properties": {"repobilityId": "9d75ae9f71d35879", "scanner": "scanner-primary", "fingerprint": "916152018d5732b4", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-ph9p-34f9-6g65", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5428029288d21c4a", "level": "note", "message": {"text": "Dependency file-type is a major version behind"}, "properties": {"repobilityId": "c97b4300ce7a92ed", "scanner": "scanner-primary", "fingerprint": "5428029288d21c4a", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-37943f016e22c301", "level": "warning", "message": {"text": "Dependency glob is two or more major versions behind"}, "properties": {"repobilityId": "091a1b7060841460", "scanner": "scanner-primary", "fingerprint": "37943f016e22c301", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f02b865fee0c4785", "level": "note", "message": {"text": "Dependency isbinaryfile is a major version behind"}, "properties": {"repobilityId": "fa65e1c2d67edea7", "scanner": "scanner-primary", "fingerprint": "f02b865fee0c4785", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d759a00cffff1b3", "level": "note", "message": {"text": "Dependency open is a major version behind"}, "properties": {"repobilityId": "481275a45a980c51", "scanner": "scanner-primary", "fingerprint": "1d759a00cffff1b3", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d637c276d64febc3", "level": "note", "message": {"text": "Dependency zod is a major version behind"}, "properties": {"repobilityId": "6497a44c2aee361f", "scanner": "scanner-primary", "fingerprint": "d637c276d64febc3", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}]}]}