critical System graph security Trivy conf 1.00 CVE-2022-0686: url-parse 1.4.4 — package-lock.json

npm-url-parse: Authorization bypass through user-controlled key Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8. Package: url-parse Installed: 1.4.4 Fixed in: 1.5.8 Severity: CRITICAL Fix: Upgrade url-parse to 1.5.8

VulnCve 2022 0686

critical System graph security Trivy conf 1.00 CVE-2022-1650: eventsource 1.1.0 — package-lock.json

eventsource: Exposure of Sensitive Information Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2. Package: eventsource Installed: 1.1.0 Fixed in: 1.1.1, 2.0.2 Severity: CRITICAL Fix: Upgrade eventsource to 1.1.1, 2.0.2

VulnCve 2022 1650

critical System graph security Trivy conf 1.00 CVE-2025-9288: sha.js 2.4.11 — package-lock.json

sha.js: Missing type checks leading to hash rewind and passing on crafted data Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11. Package: sha.js Installed: 2.4.11 Fixed in: 2.4.12 Severity: CRITICAL Fix: Upgrade sha.js to 2…

VulnCve 2025 9288

high System graph security Trivy conf 1.00 CVE-2020-7733: ua-parser-js 0.7.14 — package-lock.json

nodejs-ua-parser-js: Regular expression denial of service via the regex The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA. Package: ua-parser-js Installed: 0.7.14 Fixed in: 0.7.22 Severity: HI…

VulnCve 2020 7733

high System graph security Trivy conf 1.00 CVE-2020-7733: ua-parser-js 0.7.21 — package-lock.json

nodejs-ua-parser-js: Regular expression denial of service via the regex The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA. Package: ua-parser-js Installed: 0.7.21 Fixed in: 0.7.22 Severity: HI…

VulnCve 2020 7733

high System graph security Trivy conf 1.00 CVE-2020-7793: ua-parser-js 0.7.14 — package-lock.json

nodejs-ua-parser-js: ReDoS in multiple regexes The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info). Package: ua-parser-js Installed: 0.7.14 Fixed in: 0.7.23 Severity: HIGH Fix: Upgrade ua-parse…

VulnCve 2020 7793

high System graph security Trivy conf 1.00 CVE-2020-7793: ua-parser-js 0.7.21 — package-lock.json

nodejs-ua-parser-js: ReDoS in multiple regexes The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info). Package: ua-parser-js Installed: 0.7.21 Fixed in: 0.7.23 Severity: HIGH Fix: Upgrade ua-parse…

VulnCve 2020 7793

high System graph security Trivy conf 1.00 CVE-2021-23337: lodash 4.17.19 — package-lock.json

nodejs-lodash: command injection via template Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Package: lodash Installed: 4.17.19 Fixed in: 4.17.21 Severity: HIGH Fix: Upgrade lodash to 4.17.21

VulnCve 2021 23337

high System graph security Trivy conf 1.00 CVE-2021-27292: ua-parser-js 0.7.14 — package-lock.json

nodejs-ua-parser-js: ReDoS via malicious User-Agent header ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time. Pac…

VulnCve 2021 27292

high System graph security Trivy conf 1.00 CVE-2021-27292: ua-parser-js 0.7.21 — package-lock.json

nodejs-ua-parser-js: ReDoS via malicious User-Agent header ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time. Pac…

VulnCve 2021 27292

high System graph security Trivy conf 1.00 CVE-2021-27516: urijs 1.19.5 — package-lock.json

nodejs-urijs: mishandling certain uses of backslash may lead to confidentiality compromise URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path. Package: urijs Installed: 1.19.5 Fixed in: 1.19.6 Severity: HIGH Fix: Upgrade…

VulnCve 2021 27516

high System graph security Trivy conf 1.00 CVE-2021-3749: axios 0.21.1 — package-lock.json

nodejs-axios: Regular expression denial of service in trim function axios is vulnerable to Inefficient Regular Expression Complexity Package: axios Installed: 0.21.1 Fixed in: 0.21.2 Severity: HIGH Fix: Upgrade axios to 0.21.2

VulnCve 2021 3749

high System graph security Trivy conf 1.00 CVE-2022-0155: follow-redirects 1.14.1 — package-lock.json

follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor Package: follow-redirects Installed: 1.14.1 Fixed in: 1.14.7 Severity: HIGH Fix: Upgrade follow-redirects to 1.14…

VulnCve 2022 0155

high System graph security Trivy conf 1.00 CVE-2022-0235: node-fetch 1.7.1 — package-lock.json

node-fetch: exposure of sensitive information to an unauthorized actor node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor Package: node-fetch Installed: 1.7.1 Fixed in: 3.1.1, 2.6.7 Severity: HIGH Fix: Upgrade node-fetch to 3.1.1, 2.6.7

VulnCve 2022 0235

high System graph security Trivy conf 1.00 CVE-2022-1243: urijs 1.19.5 — package-lock.json

Incorrect protocol extraction via \r, \n and \t characters CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11. Package: urijs Installed: 1.19.5 Fixed in: 1.19.11 Severity: HIGH Fix: Upgrade urijs to 1.19.11

VulnCve 2022 1243

high System graph security Trivy conf 1.00 CVE-2024-45296: path-to-regexp 1.7.0 — package-lock.json

path-to-regexp: Backtracking regular expressions cause ReDoS path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching run…

VulnCve 2024 45296

high System graph security Trivy conf 1.00 CVE-2025-27152: axios 0.21.1 — package-lock.json

axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specifie…

VulnCve 2025 27152

high System graph security Trivy conf 1.00 CVE-2026-25639: axios 0.21.1 — package-lock.json

axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ a…

VulnCve 2026 25639

high System graph security Trivy conf 1.00 CVE-2026-42033: axios 0.21.1 — package-lock.json

axios: Axios: HTTP Transport Hijacking via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) s…

VulnCve 2026 42033

high System graph security Trivy conf 1.00 CVE-2026-42035: axios 0.21.1 — package-lock.json

axios: Axios: Arbitrary HTTP header injection via prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP …

VulnCve 2026 42035

high System graph security Trivy conf 1.00 CVE-2026-42043: axios 0.21.1 — package-lock.json

axios: Axios: NO_PROXY bypass via crafted URL Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the …

VulnCve 2026 42043

high System graph security Trivy conf 1.00 CVE-2026-44486: axios 0.21.1 — package-lock.json

axios: Axios: Information disclosure of proxy credentials via HTTP redirects Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent throug…

VulnCve 2026 44486

high System graph security Trivy conf 1.00 CVE-2026-44487: axios 0.21.1 — package-lock.json

axios: Axios: Information disclosure of proxy credentials via redirect flows Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct re…

VulnCve 2026 44487

high System graph security Trivy conf 1.00 CVE-2026-44492: axios 0.21.1 — package-lock.json

axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a r…

VulnCve 2026 44492

high System graph security Trivy conf 1.00 CVE-2026-44495: axios 0.21.1 — package-lock.json

axios: Axios: Information disclosure due to prototype pollution vulnerability Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same Jav…

VulnCve 2026 44495

high System graph security Trivy conf 1.00 CVE-2026-44496: axios 0.21.1 — package-lock.json

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF co…

VulnCve 2026 44496

high System graph security Trivy conf 1.00 CVE-2026-4800: lodash 4.17.19 — package-lock.json

lodash: lodash: Arbitrary code execution via untrusted input in template imports Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both p…

VulnCve 2026 4800

high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile

Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile

Misconfig

high System graph security Trivy conf 1.00 KSV-0014: Root file system is not read-only — kubernetes/config/app.yaml

Root file system is not read-only Container 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'securityContext.readOnlyRootFilesystem' to true Rule: KSV-0014 Severity: HIGH Target: kubernetes/config/app.yaml

Misconfig

high System graph security Trivy conf 1.00 KSV-0118: Default security context configured — kubernetes/config/app.yaml

Default security context configured container blockexplorer-app-deployment in default namespace is using the default security context Rule: KSV-0118 Severity: HIGH Target: kubernetes/config/app.yaml

Misconfig

high System graph dependencies dependencies conf 0.70 Vulnerable dependency react-dev-utils 4.1.0: GHSA-29gp-92wp-94q8

OSV.dev reports `react-dev-utils` at version `4.1.0` (declared in `package.json`) is affected by GHSA-29gp-92wp-94q8 (aka CVE-2018-6342). Note: `4.1.0` is the declared floor of a range — the installed version may be newer. react-dev-utils on Windows vulnerable to Remote Code Execution Aliases: CV…

package.json ScaOsvGhsa 29gp 92wp 94q8

high System graph dependencies dependencies conf 0.90 Vulnerable dependency webpack-dev-server 2.8.2: GHSA-cf66-xwfp-gvc4

OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-cf66-xwfp-gvc4 (aka CVE-2018-14732). Missing Origin Validation in webpack-dev-server Aliases: CVE-2018-14732 Advisory: https://osv.dev/vulnerability/GHSA-cf66-xwfp-gvc4 Fix: upgrade `webpack-d…

package.json ScaOsvGhsa cf66 xwfp gvc4

medium System graph security Trivy conf 1.00 CVE-2018-6341: react-dom 16.0.0 — package-lock.json

Cross-Site Scripting in react-dom React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2…

VulnCve 2018 6341

medium System graph security Trivy conf 1.00 CVE-2020-28500: lodash 4.17.19 — package-lock.json

nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. Package: lodash Installed: 4.17.19 Fixed in: 4.17.21 Severity: MEDIUM Fix: Upgrade lodash…

VulnCve 2020 28500

medium System graph security Trivy conf 1.00 CVE-2020-8124: url-parse 1.4.4 — package-lock.json

npmjs-url-parse: Improper validation of protocol of the returned URL Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks. Package: url-parse Installed: 1.4.4 Fixed in: 1.4.5 Severity: MEDIUM …

VulnCve 2020 8124

medium System graph security Trivy conf 1.00 CVE-2021-27515: url-parse 1.4.4 — package-lock.json

nodejs-url-parse: mishandling certain uses of backslash may lead to confidentiality compromise url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path. Package: url-parse Installed: 1.4.4 Fixed in: 1.5.0 Severity: MEDIUM Fix: Upgrade u…

VulnCve 2021 27515

medium System graph security Trivy conf 1.00 CVE-2021-3647: urijs 1.19.5 — package-lock.json

URIjs Vulnerable to Hostname spoofing via backslashes in URL URI.js is vulnerable to URL Redirection to Untrusted Site Package: urijs Installed: 1.19.5 Fixed in: 1.19.7 Severity: MEDIUM Fix: Upgrade urijs to 1.19.7

VulnCve 2021 3647

medium System graph security Trivy conf 1.00 CVE-2021-3664: url-parse 1.4.4 — package-lock.json

nodejs-url-parse: URL Redirection to Untrusted Site url-parse is vulnerable to URL Redirection to Untrusted Site Package: url-parse Installed: 1.4.4 Fixed in: 1.5.2 Severity: MEDIUM Fix: Upgrade url-parse to 1.5.2

VulnCve 2021 3664

medium System graph security Trivy conf 1.00 CVE-2022-0512: url-parse 1.4.4 — package-lock.json

nodejs-url-parse: authorization bypass through user-controlled key Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6. Package: url-parse Installed: 1.4.4 Fixed in: 1.5.6 Severity: MEDIUM Fix: Upgrade url-parse to 1.5.6

VulnCve 2022 0512

medium System graph security Trivy conf 1.00 CVE-2022-0536: follow-redirects 1.14.1 — package-lock.json

follow-redirects: Exposure of Sensitive Information via Authorization Header leak Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8. Package: follow-redirects Installed: 1.14.1 Fixed in: 1.14.8 Severity: MEDIUM Fix: Upgrade follow-redirec…

VulnCve 2022 0536

medium System graph security Trivy conf 1.00 CVE-2022-0613: urijs 1.19.5 — package-lock.json

urijs: Authorization Bypass Through User-Controlled Key Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8. Package: urijs Installed: 1.19.5 Fixed in: 1.19.8 Severity: MEDIUM Fix: Upgrade urijs to 1.19.8

VulnCve 2022 0613

medium System graph security Trivy conf 1.00 CVE-2022-0639: url-parse 1.4.4 — package-lock.json

npm-url-parse: Authorization Bypass Through User-Controlled Key Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7. Package: url-parse Installed: 1.4.4 Fixed in: 1.5.7 Severity: MEDIUM Fix: Upgrade url-parse to 1.5.7

VulnCve 2022 0639

medium System graph security Trivy conf 1.00 CVE-2022-0691: url-parse 1.4.4 — package-lock.json

npm-url-parse: authorization bypass through user-controlled key Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9. Package: url-parse Installed: 1.4.4 Fixed in: 1.5.9 Severity: MEDIUM Fix: Upgrade url-parse to 1.5.9

VulnCve 2022 0691

medium System graph security Trivy conf 1.00 CVE-2022-0868: urijs 1.19.5 — package-lock.json

Open Redirect in urijs Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10. Package: urijs Installed: 1.19.5 Fixed in: 1.19.10 Severity: MEDIUM Fix: Upgrade urijs to 1.19.10

VulnCve 2022 0868

medium System graph security Trivy conf 1.00 CVE-2022-1233: urijs 1.19.5 — package-lock.json

URL Confusion When Scheme Not Supplied in medialize/uri.js URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11. Package: urijs Installed: 1.19.5 Fixed in: 1.19.11 Severity: MEDIUM Fix: Upgrade urijs to 1.19.11

VulnCve 2022 1233

medium System graph security Trivy conf 1.00 CVE-2022-24723: urijs 1.19.5 — package-lock.json

urijs: Leading white space bypasses protocol validation URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whi…

VulnCve 2022 24723

medium System graph security Trivy conf 1.00 CVE-2023-26159: follow-redirects 1.14.1 — package-lock.json

follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, i…

VulnCve 2023 26159

medium System graph security Trivy conf 1.00 CVE-2023-45857: axios 0.21.1 — package-lock.json

axios: exposure of confidential data stored in cookies An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information. Packag…

VulnCve 2023 45857

medium System graph security Trivy conf 1.00 CVE-2024-28849: follow-redirects 1.14.1 — package-lock.json

follow-redirects: Possible credential leak follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-aut…

VulnCve 2024 28849

medium System graph security Trivy conf 1.00 CVE-2025-13465: lodash 4.17.19 — package-lock.json

lodash: prototype pollution in _.unset and _.omit functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion o…

VulnCve 2025 13465

medium System graph security Trivy conf 1.00 CVE-2025-27789: @babel/runtime 7.2.0 — package-lock.json

Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel w…

VulnCve 2025 27789

medium System graph security Trivy conf 1.00 CVE-2025-62718: axios 0.21.1 — package-lock.json

axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback …

VulnCve 2025 62718

medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash 4.17.19 — package-lock.json

lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…

VulnCve 2026 2950

medium System graph security Trivy conf 1.00 CVE-2026-40175: axios 0.21.1 — package-lock.json

axios: Axios: Remote Code Execution via Prototype Pollution escalation Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leverag…

VulnCve 2026 40175

medium System graph security Trivy conf 1.00 CVE-2026-42034: axios 0.21.1 — package-lock.json

axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). …

VulnCve 2026 42034

medium System graph security Trivy conf 1.00 CVE-2026-42036: axios 0.21.1 — package-lock.json

axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLe…

VulnCve 2026 42036

medium System graph security Trivy conf 1.00 CVE-2026-42038: axios 0.21.1 — package-lock.json

axios: Axios: Information disclosure due to `no_proxy` bypass Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route t…

VulnCve 2026 42038

medium System graph security Trivy conf 1.00 CVE-2026-42039: axios 0.21.1 — package-lock.json

axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value pas…

VulnCve 2026 42039

medium System graph security Trivy conf 1.00 CVE-2026-42041: axios 0.21.1 — package-lock.json

axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to…

VulnCve 2026 42041

medium System graph security Trivy conf 1.00 CVE-2026-42042: axios 0.21.1 — package-lock.json

axios: Axios: XSRF token bypass leading to information disclosure Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXS…

VulnCve 2026 42042

medium System graph security Trivy conf 1.00 CVE-2026-44490: axios 0.21.1 — package-lock.json

axios: Axios: Information disclosure and denial of service due to prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency i…

VulnCve 2026 44490

medium System graph dependencies dependencies conf 0.90 Dependency fetch-ponyfill is two or more major versions behind

`fetch-ponyfill` is pinned at `4.1.0` in `package.json` while the latest release on the npm registry is `7.1.0` — 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `fetch-ponyfill` to `7.1.0…

package.json FreshnessOutdated

medium System graph dependencies dependencies conf 0.90 Dependency node-localstorage is two or more major versions behind

`node-localstorage` is pinned at `1.3.0` in `package.json` while the latest release on the npm registry is `3.0.5` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `node-localstorage` to …

package.json FreshnessOutdated

medium System graph dependencies dependencies conf 0.90 Dependency react is two or more major versions behind

`react` is pinned at `16.0.0` in `package.json` while the latest release on the npm registry is `19.2.8` — 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react` to `19.2.8`.

package.json FreshnessOutdated

medium System graph dependencies dependencies conf 0.90 Dependency react-bootstrap is two or more major versions behind

`react-bootstrap` is pinned at `0.31.5` in `package.json` while the latest release on the npm registry is `2.10.10` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-bootstrap` to `…

package.json FreshnessOutdated

medium System graph dependencies dependencies conf 0.90 Dependency react-dom is two or more major versions behind

`react-dom` is pinned at `16.0.0` in `package.json` while the latest release on the npm registry is `19.2.8` — 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-dom` to `19.2.8`.

package.json FreshnessOutdated

medium System graph dependencies dependencies conf 0.90 Dependency react-intl is two or more major versions behind

`react-intl` is pinned at `2.4.0` in `package.json` while the latest release on the npm registry is `10.1.22` — 8 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-intl` to `10.1.22`.

package.json FreshnessOutdated

medium System graph dependencies dependencies conf 0.90 Dependency react-router is two or more major versions behind

`react-router` is pinned at `4.2.0` in `package.json` while the latest release on the npm registry is `8.3.0` — 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-router` to `8.3.0`.

package.json FreshnessOutdated

medium System graph dependencies dependencies conf 0.90 Dependency react-router-dom is two or more major versions behind

`react-router-dom` is pinned at `4.2.2` in `package.json` while the latest release on the npm registry is `7.18.2` — 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-router-dom` to `…

package.json FreshnessOutdated

medium System graph dependencies dependencies conf 0.90 Dependency stellar-sdk is two or more major versions behind

`stellar-sdk` is pinned at `8.2.3` in `package.json` while the latest release on the npm registry is `13.3.0` — 5 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `stellar-sdk` to `13.3.0`.

package.json FreshnessOutdated

medium System graph hardware Security conf 1.00 Dockerfile runs as root: Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph quality Integrity conf 1.00 10 occurrences Frontend route `/accounts` has no Link/navigate to it — src/App.js

The route is registered but no `<Link to=…>` or `navigate(…)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor.

10 occurrences

repo-level (10 hits)

Orphan pageWiring

medium System graph security Trivy conf 1.00 GHSA-7q8q-rj6j-mhjq: axios 0.21.1 — package-lock.json

Axios: Nested axios option objects can consume polluted prototype values ## Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`. The top-level merged config is protected with a null prototype, but…

VulnGhsa 7q8q rj6j mhjq

medium System graph security Trivy conf 1.00 GHSA-mmx7-hfxf-jppx: axios 0.21.1 — package-lock.json

Axios: Prototype pollution gadgets can alter axios request construction ## Summary axios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method alia…

VulnGhsa mmx7 hfxf jppx

medium System graph security Trivy conf 1.00 GHSA-r4q5-vmmm-2653: follow-redirects 1.14.1 — package-lock.json

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets ## Summary When an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-47…

VulnGhsa r4q5 vmmm 2653

medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in src/components/shared/InfoBanner.js:23

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

src/components/shared/InfoBanner.js:23 Dangerous innerhtml

medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in public/index.html:47

Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.

public/index.html:47 Direct innerhtml assignment

medium System graph security Trivy conf 1.00 KSV-0001: Can elevate its own privileges — kubernetes/config/app.yaml

Can elevate its own privileges Container 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'securityContext.allowPrivilegeEscalation' to false Rule: KSV-0001 Severity: MEDIUM Target: kubernetes/config/app.yaml

Misconfig

medium System graph security Trivy conf 1.00 KSV-0012: Runs as root user — kubernetes/config/app.yaml

Runs as root user Container 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'securityContext.runAsNonRoot' to true Rule: KSV-0012 Severity: MEDIUM Target: kubernetes/config/app.yaml

Misconfig

medium System graph security Trivy conf 1.00 KSV-0013: Image tag ":latest" used — kubernetes/config/app.yaml

Image tag ":latest" used Container 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should specify an image tag Rule: KSV-0013 Severity: MEDIUM Target: kubernetes/config/app.yaml

Misconfig

medium System graph security Trivy conf 1.00 KSV-0104: Seccomp policies disabled — kubernetes/config/app.yaml

Seccomp policies disabled container "blockexplorer-app" of deployment "blockexplorer-app-deployment" in "default" namespace should specify a seccomp profile Rule: KSV-0104 Severity: MEDIUM Target: kubernetes/config/app.yaml

Misconfig

medium System graph security Trivy conf 1.00 KSV-0117: Prevent binding to privileged ports — kubernetes/config/app.yaml

Prevent binding to privileged ports deployment blockexplorer-app-deployment in default namespace should not set spec.template.spec.containers.ports.containerPort to less than 1024 Rule: KSV-0117 Severity: MEDIUM Target: kubernetes/config/app.yaml

Misconfig

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.

auth

medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected

No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.

CI/CD securityCoverage

medium System graph dependencies dependencies conf 0.70 Vulnerable dependency bootstrap 3.4.1: GHSA-q58r-hwc8-rm9j

OSV.dev reports `bootstrap` at version `3.4.1` (declared in `package.json`) is affected by GHSA-q58r-hwc8-rm9j (aka CVE-2025-1647). Note: `3.4.1` is the declared floor of a range — the installed version may be newer. Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Component…

package.json ScaOsvGhsa q58r hwc8 rm9j

medium System graph dependencies dependencies conf 0.70 Vulnerable dependency bootstrap 3.4.1: GHSA-vxmc-5x29-h64v

OSV.dev reports `bootstrap` at version `3.4.1` (declared in `package.json`) is affected by GHSA-vxmc-5x29-h64v (aka CVE-2024-6485). Note: `3.4.1` is the declared floor of a range — the installed version may be newer. Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes Aliases…

package.json ScaOsvGhsa vxmc 5x29 h64v

medium System graph dependencies dependencies conf 0.70 Vulnerable dependency react-dev-utils 4.1.0: GHSA-5q6m-3h65-w53x

OSV.dev reports `react-dev-utils` at version `4.1.0` (declared in `package.json`) is affected by GHSA-5q6m-3h65-w53x (aka CVE-2021-24033). Note: `4.1.0` is the declared floor of a range — the installed version may be newer. react-dev-utils OS Command Injection in function `getProcessForPort` Alia…

package.json ScaOsvGhsa 5q6m 3h65 w53x

medium System graph dependencies dependencies conf 0.70 Vulnerable dependency react-dom 16.0.0: GHSA-mvjj-gqq2-p4hw

OSV.dev reports `react-dom` at version `16.0.0` (declared in `package.json`) is affected by GHSA-mvjj-gqq2-p4hw (aka CVE-2018-6341). Note: `16.0.0` is the declared floor of a range — the installed version may be newer. Cross-Site Scripting in react-dom Aliases: CVE-2018-6341 Advisory: https://osv…

package.json ScaOsvGhsa mvjj gqq2 p4hw

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency webpack-dev-server 2.8.2: GHSA-4v9v-hfq4-rm2v

OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-4v9v-hfq4-rm2v (aka CVE-2025-30359). webpack-dev-server users' source code may be stolen when they access a malicious web site Aliases: CVE-2025-30359 Advisory: https://osv.dev/vulnerability/G…

package.json ScaOsvGhsa 4v9v hfq4 rm2v

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency webpack-dev-server 2.8.2: GHSA-79cf-xcqc-c78w

OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-79cf-xcqc-c78w (aka CVE-2026-6402). webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins Aliases: CVE-2026-6402 Advisory: https://osv.dev/vulnerability/GHSA-…

package.json ScaOsvGhsa 79cf xcqc c78w

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency webpack-dev-server 2.8.2: GHSA-9jgg-88mc-972h

OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-9jgg-88mc-972h (aka CVE-2025-30360). webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser Aliases: CVE-2025-30360 Advisory:…

package.json ScaOsvGhsa 9jgg 88mc 972h

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency webpack-dev-server 2.8.2: GHSA-f5vj-f2hx-8m93

OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-f5vj-f2hx-8m93 (aka CVE-2026-14620). webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints Aliases: CVE-2026-14620 Advisory: https://osv.dev/vulnerabilit…

package.json ScaOsvGhsa f5vj f2hx 8m93

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency webpack-dev-server 2.8.2: GHSA-m28w-2pqf-7qgj

OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-m28w-2pqf-7qgj (aka CVE-2026-14631). webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header Aliases: CVE-2026-14631 Advisory: https://osv.dev/vulnerability/GH…

package.json ScaOsvGhsa m28w 2pqf 7qgj

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency webpack-dev-server 2.8.2: GHSA-mx8g-39q3-5c79

OSV.dev reports `webpack-dev-server` at version `2.8.2` (declared in `package.json`) is affected by GHSA-mx8g-39q3-5c79 (aka CVE-2026-9595). webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies Aliases: CVE-2026-9595 Advisory: https://osv.dev/vulnerability/GHSA-…

package.json ScaOsvGhsa mx8g 39q3 5c79

low System graph security Trivy conf 1.00 CVE-2026-42040: axios 0.21.1 — package-lock.json

axios: Axios: Incorrect null byte handling can lead to data integrity issues Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses th…

VulnCve 2026 42040

low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/App.js:173

Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

src/App.js:173 Fq console leak

low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — src/registerServiceWorker.js:59

Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

src/registerServiceWorker.js:59 Fq console leak

low System graph quality Debug conf 1.00 Debug logging residue appears in source files

Found 18 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.

CleanupRepo hardeningGenerated repo pattern

low System graph dependencies dependencies conf 0.90 Dependency react-json-pretty is a major version behind

`react-json-pretty` is pinned at `1.7.4` in `package.json` while the latest release on the npm registry is `2.2.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-json-pretty` to …

package.json FreshnessOutdated

low System graph dependencies dependencies conf 0.90 Dependency react-md-spinner is a major version behind

`react-md-spinner` is pinned at `0.2.4` in `package.json` while the latest release on the npm registry is `1.0.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-md-spinner` to `1…

package.json FreshnessOutdated

low System graph dependencies dependencies conf 0.90 Dependency whatwg-fetch is a major version behind

`whatwg-fetch` is pinned at `2.0.3` in `package.json` while the latest release on the npm registry is `3.6.20` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `whatwg-fetch` to `3.6.20`.

package.json FreshnessOutdated

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: nginx:alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:25 containersPinned dependencies

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:13-alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:5 containersPinned dependencies

low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile

No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile

Misconfig

low System graph security Trivy conf 1.00 KSV-0003: Default capabilities: some containers do not drop all — kubernetes/config/app.yaml

Default capabilities: some containers do not drop all Container 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should add 'ALL' to 'securityContext.capabilities.drop' Rule: KSV-0003 Severity: LOW Target: kubernetes/config/app.yaml

Misconfig

low System graph security Trivy conf 1.00 KSV-0004: Default capabilities: some containers do not drop any — kubernetes/config/app.yaml

Default capabilities: some containers do not drop any Container 'blockexplorer-app' of 'deployment' 'blockexplorer-app-deployment' in 'default' namespace should set securityContext.capabilities.drop Rule: KSV-0004 Severity: LOW Target: kubernetes/config/app.yaml

Misconfig

low System graph security Trivy conf 1.00 KSV-0011: CPU not limited — kubernetes/config/app.yaml

CPU not limited Container 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'resources.limits.cpu' Rule: KSV-0011 Severity: LOW Target: kubernetes/config/app.yaml

Misconfig

low System graph security Trivy conf 1.00 KSV-0018: Memory not limited — kubernetes/config/app.yaml

Memory not limited Container 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'resources.limits.memory' Rule: KSV-0018 Severity: LOW Target: kubernetes/config/app.yaml

Misconfig

low System graph security Trivy conf 1.00 KSV-0020: Runs with UID <= 10000 — kubernetes/config/app.yaml

Runs with UID <= 10000 Container 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'securityContext.runAsUser' > 10000 Rule: KSV-0020 Severity: LOW Target: kubernetes/config/app.yaml

Misconfig

low System graph security Trivy conf 1.00 KSV-0021: Runs with GID <= 10000 — kubernetes/config/app.yaml

Runs with GID <= 10000 Container 'blockexplorer-app' of Deployment 'blockexplorer-app-deployment' should set 'securityContext.runAsGroup' > 10000 Rule: KSV-0021 Severity: LOW Target: kubernetes/config/app.yaml

Misconfig

low System graph security Trivy conf 1.00 KSV-0030: Runtime/Default Seccomp profile not set — kubernetes/config/app.yaml

Runtime/Default Seccomp profile not set Either Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault' Rule: KSV-0030 Severity: LOW Target: kubernetes/config/app.yaml

Misconfig

low System graph security Trivy conf 1.00 KSV-0106: Container capabilities must only include NET_BIND_SERVICE — kubernetes/config/app.yaml

Container capabilities must only include NET_BIND_SERVICE container should drop all Rule: KSV-0106 Severity: LOW Target: kubernetes/config/app.yaml

Misconfig

low System graph security Trivy conf 1.00 KSV-0110: Workloads in the default namespace — kubernetes/config/app.yaml

Workloads in the default namespace deployment blockexplorer-app-deployment in default namespace should set metadata.namespace to a non-default namespace Rule: KSV-0110 Severity: LOW Target: kubernetes/config/app.yaml

Misconfig

low System graph quality Tests conf 1.00 Low test-to-source ratio

14 tests / 98 src (ratio 0.14).

pi-apps/pi-explorer

Complete repo analysis