Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

Automattic/harper

https://github.com/Automattic/harper · scanned 2026-07-23 19:40 UTC (4 days, 20 hours ago)

299 raw signals (0 security + 299 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 20 hours ago · v3 · last Δ +0.1 (diff) · 294 actionable findings from 1 signal source. 5 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
57.6
/100
Security checks
58
0 findings
System graph
58
90.0% cov · 294 findings
Critical
2
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 2 High 85 Medium 146 Low 59 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 294 Crowd 0 Layer: Frontend 8 Security 140 Quality 10 Hardware 3 Cicd 3 Dependencies 130
Scan summary Repository scanned at 57.6/100 with 90.0% coverage. It contains 2467 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 299 findings — concentrated in security (140), dependencies (130), quality (10). Risk profile is high: 2 critical, 85 high, 146 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 290 of 294 actionable findings. 299 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Trivy conf 1.00 CVE-2026-54466: websocket-driver 0.7.4 — pnpm-lock.yaml
websocket-driver is a WebSocket protocol handler with pluggable I/O. P ... websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encod…
VulnCve 2026 54466
critical System graph security Trivy conf 1.00 CVE-2026-9277: shell-quote 1.8.2 — pnpm-lock.yaml
shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`…
VulnCve 2026 9277
high System graph security Trivy conf 1.00 CVE-2025-12816: node-forge 1.3.1 — pnpm-lock.yaml
node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yi…
VulnCve 2025 12816
high System graph security Trivy conf 1.00 CVE-2025-66031: node-forge 1.3.1 — pnpm-lock.yaml
node-forge: node-forge ASN.1 Unbounded Recursion Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 struc…
VulnCve 2025 66031
high System graph security Trivy conf 1.00 CVE-2025-67647: @sveltejs/kit 2.48.5 — pnpm-lock.yaml
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) unde…
VulnCve 2025 67647
high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 1.1.11 — pnpm-lock.yaml
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 2.0.1 — pnpm-lock.yaml
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-13311: shell-quote 1.8.2 — pnpm-lock.yaml
shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result …
VulnCve 2026 13311
high System graph security Trivy conf 1.00 CVE-2026-13676: fast-uri 3.0.6 — pnpm-lock.yaml
fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, …
VulnCve 2026 13676
high System graph security Trivy conf 1.00 CVE-2026-16221: fast-uri 3.0.6 — pnpm-lock.yaml
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ... Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL pa…
VulnCve 2026 16221
high System graph security Trivy conf 1.00 CVE-2026-22774: devalue 5.4.1 — pnpm-lock.yaml
devalue: devalue: Denial of Service due to excessive resource consumption from untrusted input Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessi…
VulnCve 2026 22774
high System graph security Trivy conf 1.00 CVE-2026-22775: devalue 5.4.1 — pnpm-lock.yaml
devalue: devalue: Denial of Service due to improper input validation Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory,…
VulnCve 2026 22775
high System graph security Trivy conf 1.00 CVE-2026-25547: @isaacs/brace-expansion 5.0.0 — pnpm-lock.yaml
brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range e…
VulnCve 2026 25547
high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 10.0.3 — pnpm-lock.yaml
minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …
VulnCve 2026 26996
high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 3.1.2 — pnpm-lock.yaml
minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …
VulnCve 2026 26996
high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 5.1.6 — pnpm-lock.yaml
minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …
VulnCve 2026 26996
high System graph security Trivy conf 1.00 CVE-2026-27606: rollup 2.79.2 — pnpm-lock.yaml
rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal.…
VulnCve 2026 27606
high System graph security Trivy conf 1.00 CVE-2026-27606: rollup 4.35.0 — pnpm-lock.yaml
rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal.…
VulnCve 2026 27606
high System graph security Trivy conf 1.00 CVE-2026-27606: rollup 4.53.3 — pnpm-lock.yaml
rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal.…
VulnCve 2026 27606
high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 10.0.3 — pnpm-lock.yaml
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…
VulnCve 2026 27903
high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 3.1.2 — pnpm-lock.yaml
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…
VulnCve 2026 27903
high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 5.1.6 — pnpm-lock.yaml
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…
VulnCve 2026 27903
high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 10.0.3 — pnpm-lock.yaml
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…
VulnCve 2026 27904
high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 3.1.2 — pnpm-lock.yaml
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…
VulnCve 2026 27904
high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 5.1.6 — pnpm-lock.yaml
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…
VulnCve 2026 27904
high System graph security Trivy conf 1.00 CVE-2026-29063: immutable 5.0.3 — pnpm-lock.yaml
immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.t…
VulnCve 2026 29063
high System graph security Trivy conf 1.00 CVE-2026-31812: quinn-proto 0.11.13 — Cargo.lock
quinn-proto: quinn-proto: Denial of Service via crafted QUIC Initial packet Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn version…
VulnCve 2026 31812
high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 2.3.1 — pnpm-lock.yaml
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…
VulnCve 2026 33671
high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 4.0.2 — pnpm-lock.yaml
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…
VulnCve 2026 33671
high System graph security Trivy conf 1.00 CVE-2026-33671: picomatch 4.0.3 — pnpm-lock.yaml
picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain pattern…
VulnCve 2026 33671
high System graph security Trivy conf 1.00 CVE-2026-33891: node-forge 1.3.1 — pnpm-lock.yaml
node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an i…
VulnCve 2026 33891
high System graph security Trivy conf 1.00 CVE-2026-33894: node-forge 1.3.1 — pnpm-lock.yaml
node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent k…
VulnCve 2026 33894
high System graph security Trivy conf 1.00 CVE-2026-33895: node-forge 1.3.1 — pnpm-lock.yaml
node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scala…
VulnCve 2026 33895
high System graph security Trivy conf 1.00 CVE-2026-33896: node-forge 1.3.1 — pnpm-lock.yaml
node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstr…
VulnCve 2026 33896
high System graph security Trivy conf 1.00 CVE-2026-35209: defu 6.1.4 — pnpm-lock.yaml
defu: Prototype pollution via `__proto__` key in defaults argument defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted so…
VulnCve 2026 35209
high System graph security Trivy conf 1.00 CVE-2026-39356: drizzle-orm 0.44.6 — pnpm-lock.yaml
Drizzle ORM has SQL injection via improperly escaped SQL identifiers Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimite…
VulnCve 2026 39356
high System graph security Trivy conf 1.00 CVE-2026-39363: vite 6.3.5 — pnpm-lock.yaml
Vite: Vite: Information disclosure via WebSocket connection bypasses access control Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fe…
VulnCve 2026 39363
high System graph security Trivy conf 1.00 CVE-2026-40073: @sveltejs/kit 2.48.5 — pnpm-lock.yaml
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This by…
VulnCve 2026 40073
high System graph security Trivy conf 1.00 CVE-2026-44728: @babel/plugin-transform-modules-systemjs 7.25.9 — pnpm-lock.yaml
Babel is a compiler for writing next generation JavaScript. From 7.12. ... Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code t…
VulnCve 2026 44728
high System graph security Trivy conf 1.00 CVE-2026-4800: lodash 4.17.21 — pnpm-lock.yaml
lodash: lodash: Arbitrary code execution via untrusted input in template imports Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both p…
VulnCve 2026 4800
high System graph security Trivy conf 1.00 CVE-2026-4800: lodash-es 4.17.21 — pnpm-lock.yaml
lodash: lodash: Arbitrary code execution via untrusted input in template imports Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both p…
VulnCve 2026 4800
high System graph security Trivy conf 1.00 CVE-2026-4867: path-to-regexp 0.1.12 — pnpm-lock.yaml
path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c o…
VulnCve 2026 4867
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 7.5.10 — pnpm-lock.yaml
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.18.1 — pnpm-lock.yaml
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.18.3 — pnpm-lock.yaml
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-53571: vite 6.3.5 — pnpm-lock.yaml
vite: `server.fs.deny` bypass on Windows alternate paths Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive…
VulnCve 2026 53571
high System graph security Trivy conf 1.00 CVE-2026-59879: immutable 5.0.3 — pnpm-lock.yaml
Immutable.js provides many Persistent Immutable data structures. Prior ... Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the ran…
VulnCve 2026 59879
high System graph security Trivy conf 1.00 CVE-2026-59880: immutable 5.0.3 — pnpm-lock.yaml
Immutable.js provides many Persistent Immutable data structures. Prior ... Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned li…
VulnCve 2026 59880
high System graph security Trivy conf 1.00 CVE-2026-6321: fast-uri 3.0.6 — pnpm-lock.yaml
fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory r…
VulnCve 2026 6321
high System graph security Trivy conf 1.00 CVE-2026-6322: fast-uri 3.0.6 — pnpm-lock.yaml
fast-uri: fast-uri: URI authority bypass due to improper delimiter handling fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a…
VulnCve 2026 6322
high System graph security Trivy conf 1.00 DS-0002: Image user should not be 'root' — Dockerfile
Image user should not be 'root' Specify at least 1 USER command in Dockerfile with non-root user as argument Rule: DS-0002 Severity: HIGH Target: Dockerfile
Misconfig
high System graph security Trivy conf 1.00 DS-0029: 'apt-get' missing '--no-install-recommends' — Dockerfile
'apt-get' missing '--no-install-recommends' '--no-install-recommends' flag is missed: 'apt-get update && apt-get install git parallel -y' Rule: DS-0029 Severity: HIGH Target: Dockerfile
Misconfig
high System graph security Trivy conf 1.00 GHSA-5c6j-r48x-rmvq: serialize-javascript 6.0.2 — pnpm-lock.yaml
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() ### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` i…
VulnGhsa 5c6j r48x rmvq
high System graph security Trivy conf 1.00 GHSA-82j2-j2ch-gfr8: rustls-webpki 0.103.10 — Cargo.lock
rustls-webpki: Denial of service via panic on malformed CRL BIT STRING ### Summary `bit_string_flags()` in `src/der.rs` panics with an index-out-of-bounds when given a BIT STRING whose content is exactly `[0x00]` (one byte: zero padding bits, zero data bytes). This is reachable through the public…
VulnGhsa 82j2 j2ch gfr8
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in packages/chrome-plugin/vglrunWrapper.js:3
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/chrome-plugin/vglrunWrapper.js:3 Node child process
high System graph security Secrets conf 0.72 Possible secret in packages/web/src/lib/marketing/data.ts
Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.
packages/web/src/lib/marketing/data.ts:259 Generic api key
high System graph security Secrets conf 0.72 Possible secret in packages/web/vite.config.ts
Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.
packages/web/vite.config.ts:57 Generic api key
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 10.0.1: GHSA-23c5-xmqv-rm74
OSV.dev reports `minimatch` at version `10.0.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904). minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions Aliases: CVE-2026-27904 Advisory: https://osv.dev/vulnerability/G…
pnpm-lock.yaml ScaOsvGhsa 23c5 xmqv rm74
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 10.0.1: GHSA-3ppc-4f35-3m26
OSV.dev reports `minimatch` at version `10.0.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996). minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern Aliases: CVE-2026-26996 Advisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-…
pnpm-lock.yaml ScaOsvGhsa 3ppc 4f35 3m26
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 10.0.1: GHSA-7r86-cg39-jmmj
OSV.dev reports `minimatch` at version `10.0.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903). minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments Aliases: CVE-2026-27903 Advisory: https://osv.dev/vulnerab…
pnpm-lock.yaml ScaOsvGhsa 7r86 cg39 jmmj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 10.0.3: GHSA-23c5-xmqv-rm74
OSV.dev reports `minimatch` at version `10.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904). minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions Aliases: CVE-2026-27904 Advisory: https://osv.dev/vulnerability/G…
packages/obsidian-plugin/package.json ScaOsvGhsa 23c5 xmqv rm74
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 10.0.3: GHSA-3ppc-4f35-3m26
OSV.dev reports `minimatch` at version `10.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996). minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern Aliases: CVE-2026-26996 Advisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-…
packages/obsidian-plugin/package.json ScaOsvGhsa 3ppc 4f35 3m26
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 10.0.3: GHSA-7r86-cg39-jmmj
OSV.dev reports `minimatch` at version `10.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903). minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments Aliases: CVE-2026-27903 Advisory: https://osv.dev/vulnerab…
packages/obsidian-plugin/package.json ScaOsvGhsa 7r86 cg39 jmmj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 3.0.8: GHSA-23c5-xmqv-rm74
OSV.dev reports `minimatch` at version `3.0.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904). minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions Aliases: CVE-2026-27904 Advisory: https://osv.dev/vulnerability/GH…
pnpm-lock.yaml ScaOsvGhsa 23c5 xmqv rm74
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 3.0.8: GHSA-3ppc-4f35-3m26
OSV.dev reports `minimatch` at version `3.0.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996). minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern Aliases: CVE-2026-26996 Advisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3…
pnpm-lock.yaml ScaOsvGhsa 3ppc 4f35 3m26
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 3.0.8: GHSA-7r86-cg39-jmmj
OSV.dev reports `minimatch` at version `3.0.8` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903). minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments Aliases: CVE-2026-27903 Advisory: https://osv.dev/vulnerabi…
pnpm-lock.yaml ScaOsvGhsa 7r86 cg39 jmmj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74
OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904). minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions Aliases: CVE-2026-27904 Advisory: https://osv.dev/vulnerability/GH…
pnpm-lock.yaml ScaOsvGhsa 23c5 xmqv rm74
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26
OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996). minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern Aliases: CVE-2026-26996 Advisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3…
pnpm-lock.yaml ScaOsvGhsa 3ppc 4f35 3m26
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj
OSV.dev reports `minimatch` at version `3.1.2` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903). minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments Aliases: CVE-2026-27903 Advisory: https://osv.dev/vulnerabi…
pnpm-lock.yaml ScaOsvGhsa 7r86 cg39 jmmj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 5.1.6: GHSA-23c5-xmqv-rm74
OSV.dev reports `minimatch` at version `5.1.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904). minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions Aliases: CVE-2026-27904 Advisory: https://osv.dev/vulnerability/GH…
pnpm-lock.yaml ScaOsvGhsa 23c5 xmqv rm74
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 5.1.6: GHSA-3ppc-4f35-3m26
OSV.dev reports `minimatch` at version `5.1.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996). minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern Aliases: CVE-2026-26996 Advisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3…
pnpm-lock.yaml ScaOsvGhsa 3ppc 4f35 3m26
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 5.1.6: GHSA-7r86-cg39-jmmj
OSV.dev reports `minimatch` at version `5.1.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903). minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments Aliases: CVE-2026-27903 Advisory: https://osv.dev/vulnerabi…
pnpm-lock.yaml ScaOsvGhsa 7r86 cg39 jmmj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 9.0.3: GHSA-23c5-xmqv-rm74
OSV.dev reports `minimatch` at version `9.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904). minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions Aliases: CVE-2026-27904 Advisory: https://osv.dev/vulnerability/GH…
pnpm-lock.yaml ScaOsvGhsa 23c5 xmqv rm74
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 9.0.3: GHSA-3ppc-4f35-3m26
OSV.dev reports `minimatch` at version `9.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996). minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern Aliases: CVE-2026-26996 Advisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3…
pnpm-lock.yaml ScaOsvGhsa 3ppc 4f35 3m26
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 9.0.3: GHSA-7r86-cg39-jmmj
OSV.dev reports `minimatch` at version `9.0.3` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903). minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments Aliases: CVE-2026-27903 Advisory: https://osv.dev/vulnerabi…
pnpm-lock.yaml ScaOsvGhsa 7r86 cg39 jmmj
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 9.0.5: GHSA-23c5-xmqv-rm74
OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904). minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions Aliases: CVE-2026-27904 Advisory: https://osv.dev/vulnerability/GH…
pnpm-lock.yaml ScaOsvGhsa 23c5 xmqv rm74
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 9.0.5: GHSA-3ppc-4f35-3m26
OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996). minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern Aliases: CVE-2026-26996 Advisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3…
pnpm-lock.yaml ScaOsvGhsa 3ppc 4f35 3m26
high System graph dependencies dependencies conf 1.00 Vulnerable dependency minimatch 9.0.5: GHSA-7r86-cg39-jmmj
OSV.dev reports `minimatch` at version `9.0.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903). minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments Aliases: CVE-2026-27903 Advisory: https://osv.dev/vulnerabi…
pnpm-lock.yaml ScaOsvGhsa 7r86 cg39 jmmj
high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-fx2h-pf6j-xcff
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571). Note: `5.4.10` is the declared floor of a range — the installed version may be newer. vite: `server.fs.deny` bypass on Windows alternate paths Al…
packages/chrome-plugin/package.json ScaOsvGhsa fx2h pf6j xcff
high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-fx2h-pf6j-xcff
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571). Note: `6.0.3` is the declared floor of a range — the installed version may be newer. vite: `server.fs.deny` bypass on Windows alternate paths Aliases: CVE…
harper-desktop/package.json ScaOsvGhsa fx2h pf6j xcff
high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-p9ff-h696-f583
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363). Note: `6.0.3` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket …
harper-desktop/package.json ScaOsvGhsa p9ff h696 f583
high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-fx2h-pf6j-xcff
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571). Note: `6.1.0` is the declared floor of a range — the installed version may be newer. vite: `server.fs.deny` bypass on Windows alternate paths Aliases:…
packages/harper.js/package.json ScaOsvGhsa fx2h pf6j xcff
high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-p9ff-h696-f583
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363). Note: `6.1.0` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSock…
packages/harper.js/package.json ScaOsvGhsa p9ff h696 f583
high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.3.5: GHSA-fx2h-pf6j-xcff
OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571). Note: `6.3.5` is the declared floor of a range — the installed version may be newer. vite: `server.fs.deny` bypass on Windows alternate paths Al…
packages/obsidian-plugin/package.json ScaOsvGhsa fx2h pf6j xcff
high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.3.5: GHSA-p9ff-h696-f583
OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363). Note: `6.3.5` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Arbitrary File Read via Vite Dev Server W…
packages/obsidian-plugin/package.json ScaOsvGhsa p9ff h696 f583
high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 7.1.10: GHSA-fx2h-pf6j-xcff
OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-fx2h-pf6j-xcff (aka CVE-2026-53571). Note: `7.1.10` is the declared floor of a range — the installed version may be newer. vite: `server.fs.deny` bypass on Windows alternate paths Alias…
packages/components/package.json ScaOsvGhsa fx2h pf6j xcff
high System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 7.1.10: GHSA-p9ff-h696-f583
OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-p9ff-h696-f583 (aka CVE-2026-39363). Note: `7.1.10` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebS…
packages/components/package.json ScaOsvGhsa p9ff h696 f583
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: AGENTS.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
AGENTS.md VerificationAgents md
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2024-1899: showdown 1.9.1 — pnpm-lock.yaml
Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions. Package: showdown Installed: 1.9.1 Fixed in: — Severity: MEDIUM Fix: No…
VulnCve 2024 1899
medium System graph security Trivy conf 1.00 CVE-2025-13465: lodash 4.17.21 — pnpm-lock.yaml
lodash: prototype pollution in _.unset and _.omit functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion o…
VulnCve 2025 13465
medium System graph security Trivy conf 1.00 CVE-2025-13465: lodash-es 4.17.21 — pnpm-lock.yaml
lodash: prototype pollution in _.unset and _.omit functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion o…
VulnCve 2025 13465
medium System graph security Trivy conf 1.00 CVE-2025-15284: qs 6.13.0 — pnpm-lock.yaml
qs: qs: Denial of Service via improper input validation in array parsing Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed…
VulnCve 2025 15284
medium System graph security Trivy conf 1.00 CVE-2025-27789: @babel/runtime 7.25.7 — pnpm-lock.yaml
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel w…
VulnCve 2025 27789
medium System graph security Trivy conf 1.00 CVE-2025-30359: webpack-dev-server 4.15.2 — pnpm-lock.yaml
webpack-dev-server: webpack-dev-server information exposure webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request …
VulnCve 2025 30359
medium System graph security Trivy conf 1.00 CVE-2025-30360: webpack-dev-server 4.15.2 — pnpm-lock.yaml
webpack-dev-server: webpack-dev-server information exposure webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium base…
VulnCve 2025 30360
medium System graph security Trivy conf 1.00 CVE-2025-32996: http-proxy-middleware 2.0.7 — pnpm-lock.yaml
http-proxy-middleware: Always-Incorrect Control Flow Implementation in http-proxy-middleware In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used. Package: http-proxy-middleware Installed: 2.0.7 Fixed in: 2.0.8, 3.0.4 Severity: ME…
VulnCve 2025 32996
medium System graph security Trivy conf 1.00 CVE-2025-32997: http-proxy-middleware 2.0.7 — pnpm-lock.yaml
http-proxy-middleware: Improper Check for Unusual or Exceptional Conditions in http-proxy-middleware In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. Package: http-proxy-middleware Installed: 2.0.7 Fixed in: 2.0.9, 3.0.5 Severity: …
VulnCve 2025 32997
medium System graph security Trivy conf 1.00 CVE-2025-62522: vite 6.3.5 — pnpm-lock.yaml
vite: vite allows server.fs.deny bypass via backslash on Windows Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1…
VulnCve 2025 62522
medium System graph security Trivy conf 1.00 CVE-2025-66030: node-forge 1.3.1 — pnpm-lock.yaml
node-forge: node-forge: Integer Overflow allows OID-based security bypass Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to cra…
VulnCve 2025 66030
medium System graph security Trivy conf 1.00 CVE-2025-66400: mdast-util-to-hast 13.2.0 — pnpm-lock.yaml
mdast-util-to-hast: mdast-util-to-hast: Markdown code elements can appear as regular page content mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could …
VulnCve 2025 66400
medium System graph security Trivy conf 1.00 CVE-2025-69873: ajv 8.17.1 — pnpm-lock.yaml
ajv: ReDoS via $data reference ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaS…
VulnCve 2025 69873
medium System graph security Trivy conf 1.00 CVE-2026-14620: webpack-dev-server 4.15.2 — pnpm-lock.yaml
webpack-dev-server: webpack-dev-server: Arbitrary file opening and denial of service via exposed developer endpoints webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changin…
VulnCve 2026 14620
medium System graph security Trivy conf 1.00 CVE-2026-14631: webpack-dev-server 4.15.2 — pnpm-lock.yaml
webpack-dev-server: webpack-dev-server: Denial of Service via malformed headers webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws e…
VulnCve 2026 14631
medium System graph security Trivy conf 1.00 CVE-2026-27119: svelte 5.43.12 — pnpm-lock.yaml
svelte: Svelte affected by XSS in SSR `<option>` element svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. …
VulnCve 2026 27119
medium System graph security Trivy conf 1.00 CVE-2026-27121: svelte 5.43.12 — pnpm-lock.yaml
svelte: Svelte affected by cross-site scripting via spread attributes in Svelte SSR svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted …
VulnCve 2026 27121
medium System graph security Trivy conf 1.00 CVE-2026-27122: svelte 5.43.12 — pnpm-lock.yaml
svelte: Svelte SSR does not validate dynamic element tag names in `<svelte:element>` svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML o…
VulnCve 2026 27122
medium System graph security Trivy conf 1.00 CVE-2026-27125: svelte 5.43.12 — pnpm-lock.yaml
svelte: Svelte SSR attribute spreading includes inherited properties from prototype chain svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain …
VulnCve 2026 27125
medium System graph security Trivy conf 1.00 CVE-2026-27901: svelte 5.43.12 — pnpm-lock.yaml
svelte: Svelte: Cross-Site Scripting and HTML injection via improper escaping of bind:innerText and bind:textContent Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. …
VulnCve 2026 27901
medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash 4.17.21 — pnpm-lock.yaml
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…
VulnCve 2026 2950
medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash-es 4.17.21 — pnpm-lock.yaml
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…
VulnCve 2026 2950
medium System graph security Trivy conf 1.00 CVE-2026-30226: devalue 5.4.1 — pnpm-lock.yaml
devalue: Devalue: Denial of Service or type confusion via prototype pollution Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototyp…
VulnCve 2026 30226
medium System graph security Trivy conf 1.00 CVE-2026-33532: yaml 1.10.2 — pnpm-lock.yaml
yaml: yaml: Denial of Service via deeply nested YAML document parsing `yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The no…
VulnCve 2026 33532
medium System graph security Trivy conf 1.00 CVE-2026-33532: yaml 2.7.0 — pnpm-lock.yaml
yaml: yaml: Denial of Service via deeply nested YAML document parsing `yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The no…
VulnCve 2026 33532
medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 2.3.1 — pnpm-lock.yaml
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…
VulnCve 2026 33672
medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 4.0.2 — pnpm-lock.yaml
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…
VulnCve 2026 33672
medium System graph security Trivy conf 1.00 CVE-2026-33672: picomatch 4.0.3 — pnpm-lock.yaml
picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Becau…
VulnCve 2026 33672
medium System graph security Trivy conf 1.00 CVE-2026-33750: brace-expansion 1.1.11 — pnpm-lock.yaml
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) caus…
VulnCve 2026 33750
medium System graph security Trivy conf 1.00 CVE-2026-33750: brace-expansion 2.0.1 — pnpm-lock.yaml
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) caus…
VulnCve 2026 33750
medium System graph security Trivy conf 1.00 CVE-2026-34043: serialize-javascript 6.0.2 — pnpm-lock.yaml
serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exh…
VulnCve 2026 34043
medium System graph security Trivy conf 1.00 CVE-2026-39365: vite 6.3.5 — pnpm-lock.yaml
vite: Vite: Information disclosure via path traversal in dev server's .map request handling Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFil…
VulnCve 2026 39365
medium System graph security Trivy conf 1.00 CVE-2026-40074: @sveltejs/kit 2.48.5 — pnpm-lock.yaml
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters th…
VulnCve 2026 40074
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.5.3 — pnpm-lock.yaml
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.5.6 — pnpm-lock.yaml
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…
VulnCve 2026 41305
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — pnpm-lock.yaml
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 9.0.1 — pnpm-lock.yaml
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-42573: svelte 5.43.12 — pnpm-lock.yaml
svelte: Svelte: Cross-Site Scripting via DOM Clobbering Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7. …
VulnCve 2026 42573
medium System graph security Trivy conf 1.00 CVE-2026-42599: svelte 5.43.12 — pnpm-lock.yaml
svelte: Svelte: Cross-Site Scripting via untrusted data in spread attributes Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an applicat…
VulnCve 2026 42599
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.18.1 — pnpm-lock.yaml
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.18.3 — pnpm-lock.yaml
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Trivy conf 1.00 CVE-2026-53632: launch-editor 2.10.0 — pnpm-lock.yaml
launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a U…
VulnCve 2026 53632
medium System graph security Trivy conf 1.00 CVE-2026-53632: vite 6.3.5 — pnpm-lock.yaml
launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a U…
VulnCve 2026 53632
medium System graph security Trivy conf 1.00 CVE-2026-54171: excon 0.112.0 — Gemfile.lock
Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon ... Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to stri…
VulnCve 2026 54171
medium System graph security Trivy conf 1.00 CVE-2026-54490: websocket-driver 0.7.4 — pnpm-lock.yaml
websocket-driver is a WebSocket protocol handler with pluggable I/O. P ... websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger…
VulnCve 2026 54490
medium System graph security Trivy conf 1.00 CVE-2026-55602: http-proxy-middleware 2.0.7 — pnpm-lock.yaml
http-proxy-middleware: http-proxy-middleware: Unintended backend routing due to crafted Host header http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, …
VulnCve 2026 55602
medium System graph security Trivy conf 1.00 CVE-2026-6402: webpack-dev-server 4.15.2 — pnpm-lock.yaml
webpack-dev-server: webpack-dev-server: Information disclosure due to cross-origin source code exposure webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous …
VulnCve 2026 6402
medium System graph security Trivy conf 1.00 CVE-2026-8723: qs 6.13.0 — pnpm-lock.yaml
### Summary `qs.stringify` throws `TypeError` when called with `arr ... ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's nul…
VulnCve 2026 8723
medium System graph security Trivy conf 1.00 CVE-2026-9595: webpack-dev-server 4.15.2 — pnpm-lock.yaml
webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the p…
VulnCve 2026 9595
medium System graph dependencies dependencies conf 0.90 Dependency cached is two or more major versions behind
`cached` is pinned at `0.59.0` in `harper-core/Cargo.toml` while the latest release on the cargo registry is `2.0.2` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `cached` to `2.0.2`.
harper-core/Cargo.toml FreshnessOutdated
medium System graph security Semgrep conf 0.55 detect child process — packages/chrome-plugin/vglrunWrapper.js:10
Detected calls to child_process from a function argument `program`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-child-…
packages/chrome-plugin/vglrunWrapper.js:10 SecurityJavascript
medium System graph hardware Supply chain conf 1.00 Docker base image uses a mutable or implicit tag: rust:latest
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:5 containersPinned dependencies
medium System graph hardware Security conf 1.00 Dockerfile runs as root: Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph security Trivy conf 1.00 DS-0001: ':latest' tag used — Dockerfile
':latest' tag used Specify a tag in the 'FROM' statement for image 'rust' Rule: DS-0001 Severity: MEDIUM Target: Dockerfile
Misconfig
medium System graph security Trivy conf 1.00 GHSA-67mh-4wv8-2f99: esbuild 0.23.1 — pnpm-lock.yaml
esbuild enables any website to send any requests to the development server and read the response ### Summary esbuild allows any websites to send any request to the development server and read the response due to default CORS settings. ### Details esbuild sets `Access-Control-Allow-Origin: *` he…
VulnGhsa 67mh 4wv8 2f99
medium System graph security Trivy conf 1.00 GHSA-7gcf-g7xr-8hxj: serde_with 3.20.0 — Cargo.lock
serde_with: KeyValueMap serialization panics on empty sequence or map entries ### Summary The public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumptio…
VulnGhsa 7gcf g7xr 8hxj
medium System graph security Trivy conf 1.00 GHSA-hgv7-v322-mmgr: @sveltejs/kit 2.48.5 — pnpm-lock.yaml
@sveltejs/kit: `query.batch` cross-talk `query.batch()` could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure. Package: @sveltejs/kit Installed: 2.48.5 Fixed in: 2.60.1 Sev…
VulnGhsa hgv7 v322 mmgr
medium System graph security Trivy conf 1.00 GHSA-r4q5-vmmm-2653: follow-redirects 1.15.9 — pnpm-lock.yaml
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets ## Summary When an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-47…
VulnGhsa r4q5 vmmm 2653
medium System graph security Trivy conf 1.00 GHSA-wrw7-89jp-8q8g: glib 0.18.5 — Cargo.lock
Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter` The `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour. An immutable referenc…
VulnGhsa wrw7 89jp 8q8g
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in packages/obsidian-plugin/src/index.ts:99
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
packages/obsidian-plugin/src/index.ts:99 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in packages/obsidian-plugin/src/State.ts:225
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
packages/obsidian-plugin/src/State.ts:225 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_outerhtml_assignment' in packages/lint-framework/src/lint/RenderBox.ts:45
Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible.
packages/lint-framework/src/lint/RenderBox.ts:45 Direct outerhtml assignment
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency @babel/runtime 7.25.7: GHSA-968p-4wvh-cqc8
OSV.dev reports `@babel/runtime` at version `7.25.7` (resolved in `pnpm-lock.yaml`) is affected by GHSA-968p-4wvh-cqc8. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-968p-4wvh-cqc8 Fix: upgrade `@babel/runtime` past the affected range per the advisory.
pnpm-lock.yaml ScaOsvGhsa 968p 4wvh cqc8
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-2crg-3p73-43xp
OSV.dev reports `@sveltejs/kit` at version `2.48.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-2crg-3p73-43xp. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-2crg-3p73-43xp Fix: upgrade `@sveltejs/kit` past the affected range per the advisory.
harper-desktop/package.json ScaOsvGhsa 2crg 3p73 43xp
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-3f6h-2hrp-w5wx
OSV.dev reports `@sveltejs/kit` at version `2.48.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-3f6h-2hrp-w5wx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3f6h-2hrp-w5wx Fix: upgrade `@sveltejs/kit` past the affected range per the advisory.
harper-desktop/package.json ScaOsvGhsa 3f6h 2hrp w5wx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-hgv7-v322-mmgr
OSV.dev reports `@sveltejs/kit` at version `2.48.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-hgv7-v322-mmgr. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hgv7-v322-mmgr Fix: upgrade `@sveltejs/kit` past the affected range per the advisory.
harper-desktop/package.json ScaOsvGhsa hgv7 v322 mmgr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @sveltejs/kit 2.48.5: GHSA-j62c-4x62-9r35
OSV.dev reports `@sveltejs/kit` at version `2.48.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-j62c-4x62-9r35. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-j62c-4x62-9r35 Fix: upgrade `@sveltejs/kit` past the affected range per the advisory.
harper-desktop/package.json ScaOsvGhsa j62c 4x62 9r35
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @vitest/browser 4.0.16: GHSA-g8mr-85jm-7xhm
OSV.dev reports `@vitest/browser` at version `4.0.16` (resolved in `pnpm-lock.yaml`) is affected by GHSA-g8mr-85jm-7xhm. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-g8mr-85jm-7xhm Fix: upgrade `@vitest/browser` past the affected range per the advisory.
packages/harper.js/package.json ScaOsvGhsa g8mr 85jm 7xhm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @vitest/browser 4.0.16: GHSA-p63j-vcc4-9vmv
OSV.dev reports `@vitest/browser` at version `4.0.16` (resolved in `pnpm-lock.yaml`) is affected by GHSA-p63j-vcc4-9vmv. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p63j-vcc4-9vmv Fix: upgrade `@vitest/browser` past the affected range per the advisory.
packages/harper.js/package.json ScaOsvGhsa p63j vcc4 9vmv
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency ammonia 4.1.2: RUSTSEC-2026-0193
OSV.dev reports `ammonia` at version `4.1.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0193. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0193 Fix: upgrade `ammonia` past the affected range per the advisory.
harper-core/Cargo.toml ScaOsvRustsec 2026 0193
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency ammonia 4.1.2: RUSTSEC-2026-0213
OSV.dev reports `ammonia` at version `4.1.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0213. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0213 Fix: upgrade `ammonia` past the affected range per the advisory.
harper-core/Cargo.toml ScaOsvRustsec 2026 0213
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190
OSV.dev reports `anyhow` at version `1.0.102` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0190. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190 Fix: upgrade `anyhow` past the affected range per the advisory.
harper-cli/Cargo.toml ScaOsvRustsec 2026 0190
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413
OSV.dev reports `atk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0413. Note: `atk` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0413 Fi…
Cargo.lock ScaOsvRustsec 2024 0413
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416
OSV.dev reports `atk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0416. Note: `atk-sys` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024…
Cargo.lock ScaOsvRustsec 2024 0416
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency bincode 2.0.1: RUSTSEC-2025-0141
OSV.dev reports `bincode` at version `2.0.1` (resolved in `Cargo.lock`) is affected by RUSTSEC-2025-0141. Note: `bincode` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2025-…
Cargo.lock ScaOsvRustsec 2025 0141
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204
OSV.dev reports `crossbeam-epoch` at version `0.9.18` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0204. Note: `crossbeam-epoch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabil…
Cargo.lock ScaOsvRustsec 2026 0204
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency drizzle-orm 0.44.6: GHSA-gpj5-g38j-94v9
OSV.dev reports `drizzle-orm` at version `0.44.6` (resolved in `pnpm-lock.yaml`) is affected by GHSA-gpj5-g38j-94v9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gpj5-g38j-94v9 Fix: upgrade `drizzle-orm` past the affected range per the advisory.
packages/web/package.json ScaOsvGhsa gpj5 g38j 94v9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency esbuild 0.18.20: GHSA-67mh-4wv8-2f99
OSV.dev reports `esbuild` at version `0.18.20` (resolved in `pnpm-lock.yaml`) is affected by GHSA-67mh-4wv8-2f99. esbuild enables any website to send any requests to the development server and read the response Advisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99 Fix: upgrade `esbuild` pas…
pnpm-lock.yaml ScaOsvGhsa 67mh 4wv8 2f99
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency esbuild 0.21.5: GHSA-67mh-4wv8-2f99
OSV.dev reports `esbuild` at version `0.21.5` (resolved in `pnpm-lock.yaml`) is affected by GHSA-67mh-4wv8-2f99. esbuild enables any website to send any requests to the development server and read the response Advisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99 Fix: upgrade `esbuild` past…
pnpm-lock.yaml ScaOsvGhsa 67mh 4wv8 2f99
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency esbuild 0.23.1: GHSA-67mh-4wv8-2f99
OSV.dev reports `esbuild` at version `0.23.1` (resolved in `pnpm-lock.yaml`) is affected by GHSA-67mh-4wv8-2f99. esbuild enables any website to send any requests to the development server and read the response Advisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99 Fix: upgrade `esbuild` past…
pnpm-lock.yaml ScaOsvGhsa 67mh 4wv8 2f99
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency lodash-es 4.17.21: GHSA-f23m-r3pf-42rh
OSV.dev reports `lodash-es` at version `4.17.21` (resolved in `pnpm-lock.yaml`) is affected by GHSA-f23m-r3pf-42rh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh Fix: upgrade `lodash-es` past the affected range per the advisory.
packages/chrome-plugin/package.json ScaOsvGhsa f23m r3pf 42rh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency lodash-es 4.17.21: GHSA-r5fr-rjxr-66jc
OSV.dev reports `lodash-es` at version `4.17.21` (resolved in `pnpm-lock.yaml`) is affected by GHSA-r5fr-rjxr-66jc. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc Fix: upgrade `lodash-es` past the affected range per the advisory.
packages/chrome-plugin/package.json ScaOsvGhsa r5fr rjxr 66jc
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency lodash-es 4.17.21: GHSA-xxjr-mmjv-4gpg
OSV.dev reports `lodash-es` at version `4.17.21` (resolved in `pnpm-lock.yaml`) is affected by GHSA-xxjr-mmjv-4gpg. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xxjr-mmjv-4gpg Fix: upgrade `lodash-es` past the affected range per the advisory.
packages/chrome-plugin/package.json ScaOsvGhsa xxjr mmjv 4gpg
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency paste 1.0.15: RUSTSEC-2024-0436
OSV.dev reports `paste` at version `1.0.15` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0436. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2024-0436 Fix: upgrade `paste` past the affected range per the advisory.
harper-asciidoc/Cargo.toml ScaOsvRustsec 2024 0436
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency quill 2.0.3: GHSA-v3m3-f69x-jf25
OSV.dev reports `quill` at version `2.0.3` (declared in `packages/harper-editor/package.json`) is affected by GHSA-v3m3-f69x-jf25. Note: `2.0.3` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v3m3-f69x-…
packages/harper-editor/package.json ScaOsvGhsa v3m3 f69x jf25
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency rand 0.8.5: GHSA-cq8v-f236-94qc
OSV.dev reports `rand` at version `0.8.5` (resolved in `Cargo.lock`) is affected by GHSA-cq8v-f236-94qc. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-cq8v-f236-94qc Fix: upgrade `rand` past the affected range per the advisory.
Cargo.lock ScaOsvGhsa cq8v f236 94qc
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency rand 0.8.5: RUSTSEC-2026-0097
OSV.dev reports `rand` at version `0.8.5` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0097. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0097 Fix: upgrade `rand` past the affected range per the advisory.
Cargo.lock ScaOsvRustsec 2026 0097
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency rand 0.9.2: GHSA-cq8v-f236-94qc
OSV.dev reports `rand` at version `0.9.2` (resolved in `Cargo.lock`) is affected by GHSA-cq8v-f236-94qc. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-cq8v-f236-94qc Fix: upgrade `rand` past the affected range per the advisory.
Cargo.lock ScaOsvGhsa cq8v f236 94qc
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency rand 0.9.2: RUSTSEC-2026-0097
OSV.dev reports `rand` at version `0.9.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0097. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2026-0097 Fix: upgrade `rand` past the affected range per the advisory.
Cargo.lock ScaOsvRustsec 2026 0097
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.0.0: GHSA-crpf-4hrx-3jrp
OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-crpf-4hrx-3jrp (aka CVE-2026-27125). Note: `5.0.0` is the declared floor of a range — the installed version may be newer. Svelte SSR attribute spreading includes inherited properties from pr…
harper-desktop/package.json ScaOsvGhsa crpf 4hrx 3jrp
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.0.0: GHSA-f7gr-6p89-r883
OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-f7gr-6p89-r883. Note: `5.0.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-f7gr-6p89-r883 Fi…
harper-desktop/package.json ScaOsvGhsa f7gr 6p89 r883
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.0.0: GHSA-m56q-vw4c-c2cp
OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-m56q-vw4c-c2cp. Note: `5.0.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m56q-vw4c-c2cp Fi…
harper-desktop/package.json ScaOsvGhsa m56q vw4c c2cp
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.0.0: GHSA-phwv-c562-gvmh
OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-phwv-c562-gvmh. Note: `5.0.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-phwv-c562-gvmh Fi…
harper-desktop/package.json ScaOsvGhsa phwv c562 gvmh
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.0.0: GHSA-pr6f-5x2q-rwfp
OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-pr6f-5x2q-rwfp. Note: `5.0.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pr6f-5x2q-rwfp Fi…
harper-desktop/package.json ScaOsvGhsa pr6f 5x2q rwfp
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.0.0: GHSA-rcqx-6q8c-2c42
OSV.dev reports `svelte` at version `5.0.0` (declared in `harper-desktop/package.json`) is affected by GHSA-rcqx-6q8c-2c42. Note: `5.0.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rcqx-6q8c-2c42 Fi…
harper-desktop/package.json ScaOsvGhsa rcqx 6q8c 2c42
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.15.0: GHSA-crpf-4hrx-3jrp
OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-crpf-4hrx-3jrp (aka CVE-2026-27125). Note: `5.15.0` is the declared floor of a range — the installed version may be newer. Svelte SSR attribute spreading includes inherited properties from pr…
packages/web/package.json ScaOsvGhsa crpf 4hrx 3jrp
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.15.0: GHSA-f7gr-6p89-r883
OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-f7gr-6p89-r883. Note: `5.15.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-f7gr-6p89-r883 Fi…
packages/web/package.json ScaOsvGhsa f7gr 6p89 r883
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.15.0: GHSA-m56q-vw4c-c2cp
OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-m56q-vw4c-c2cp. Note: `5.15.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m56q-vw4c-c2cp Fi…
packages/web/package.json ScaOsvGhsa m56q vw4c c2cp
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.15.0: GHSA-phwv-c562-gvmh
OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-phwv-c562-gvmh. Note: `5.15.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-phwv-c562-gvmh Fi…
packages/web/package.json ScaOsvGhsa phwv c562 gvmh
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.15.0: GHSA-pr6f-5x2q-rwfp
OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-pr6f-5x2q-rwfp. Note: `5.15.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pr6f-5x2q-rwfp Fi…
packages/web/package.json ScaOsvGhsa pr6f 5x2q rwfp
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.15.0: GHSA-rcqx-6q8c-2c42
OSV.dev reports `svelte` at version `5.15.0` (declared in `packages/web/package.json`) is affected by GHSA-rcqx-6q8c-2c42. Note: `5.15.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rcqx-6q8c-2c42 Fi…
packages/web/package.json ScaOsvGhsa rcqx 6q8c 2c42
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.41.0: GHSA-crpf-4hrx-3jrp
OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-crpf-4hrx-3jrp (aka CVE-2026-27125). Note: `5.41.0` is the declared floor of a range — the installed version may be newer. Svelte SSR attribute spreading includes inherited properties …
packages/components/package.json ScaOsvGhsa crpf 4hrx 3jrp
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.41.0: GHSA-f7gr-6p89-r883
OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-f7gr-6p89-r883. Note: `5.41.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-f7gr-6p89-…
packages/components/package.json ScaOsvGhsa f7gr 6p89 r883
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.41.0: GHSA-h7h7-mm68-gmrc
OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-h7h7-mm68-gmrc. Note: `5.41.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h7h7-mm68-…
packages/components/package.json ScaOsvGhsa h7h7 mm68 gmrc
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.41.0: GHSA-m56q-vw4c-c2cp
OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-m56q-vw4c-c2cp. Note: `5.41.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m56q-vw4c-…
packages/components/package.json ScaOsvGhsa m56q vw4c c2cp
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.41.0: GHSA-phwv-c562-gvmh
OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-phwv-c562-gvmh. Note: `5.41.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-phwv-c562-…
packages/components/package.json ScaOsvGhsa phwv c562 gvmh
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.41.0: GHSA-pr6f-5x2q-rwfp
OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-pr6f-5x2q-rwfp. Note: `5.41.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pr6f-5x2q-…
packages/components/package.json ScaOsvGhsa pr6f 5x2q rwfp
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency svelte 5.41.0: GHSA-rcqx-6q8c-2c42
OSV.dev reports `svelte` at version `5.41.0` (declared in `packages/components/package.json`) is affected by GHSA-rcqx-6q8c-2c42. Note: `5.41.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rcqx-6q8c-…
packages/components/package.json ScaOsvGhsa rcqx 6q8c 2c42
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-356w-63v5-8wf4
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-356w-63v5-8wf4 (aka CVE-2025-32395). Note: `5.4.10` is the declared floor of a range — the installed version may be newer. Vite has an `server.fs.deny` bypass with an invalid `request…
packages/chrome-plugin/package.json ScaOsvGhsa 356w 63v5 8wf4
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-4r4m-qw57-chr8
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-4r4m-qw57-chr8 (aka CVE-2025-31125). Note: `5.4.10` is the declared floor of a range — the installed version may be newer. Vite has a `server.fs.deny` bypassed for `inline` and `raw` …
packages/chrome-plugin/package.json ScaOsvGhsa 4r4m qw57 chr8
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-4w7w-66w2-5vf9
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365). Note: `5.4.10` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Path Traversal in Optimized Deps `.map` H…
packages/chrome-plugin/package.json ScaOsvGhsa 4w7w 66w2 5vf9
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-859w-5945-r5v3
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-859w-5945-r5v3 (aka CVE-2025-46565). Note: `5.4.10` is the declared floor of a range — the installed version may be newer. Vite's server.fs.deny bypassed with /. for files under proje…
packages/chrome-plugin/package.json ScaOsvGhsa 859w 5945 r5v3
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-93m4-6634-74q7
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-93m4-6634-74q7 (aka CVE-2025-62522). Note: `5.4.10` is the declared floor of a range — the installed version may be newer. vite allows server.fs.deny bypass via backslash on Windows …
packages/chrome-plugin/package.json ScaOsvGhsa 93m4 6634 74q7
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-v6wh-96g9-6wx3
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632). Note: `5.4.10` is the declared floor of a range — the installed version may be newer. launch-editor: NTLMv2 hash disclosure via UNC path handling …
packages/chrome-plugin/package.json ScaOsvGhsa v6wh 96g9 6wx3
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-vg6x-rcgg-rjx6
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-vg6x-rcgg-rjx6. Note: `5.4.10` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vg6x-rcgg…
packages/chrome-plugin/package.json ScaOsvGhsa vg6x rcgg rjx6
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-x574-m823-4x7w
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-x574-m823-4x7w. Note: `5.4.10` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-x574-m823…
packages/chrome-plugin/package.json ScaOsvGhsa x574 m823 4x7w
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-xcj6-pq6g-qj4x
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-xcj6-pq6g-qj4x. Note: `5.4.10` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xcj6-pq6g…
packages/chrome-plugin/package.json ScaOsvGhsa xcj6 pq6g qj4x
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-356w-63v5-8wf4
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-356w-63v5-8wf4 (aka CVE-2025-32395). Note: `6.0.3` is the declared floor of a range — the installed version may be newer. Vite has an `server.fs.deny` bypass with an invalid `request-target` …
harper-desktop/package.json ScaOsvGhsa 356w 63v5 8wf4
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-4r4m-qw57-chr8
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-4r4m-qw57-chr8 (aka CVE-2025-31125). Note: `6.0.3` is the declared floor of a range — the installed version may be newer. Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?imp…
harper-desktop/package.json ScaOsvGhsa 4r4m qw57 chr8
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-4w7w-66w2-5vf9
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365). Note: `6.0.3` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling A…
harper-desktop/package.json ScaOsvGhsa 4w7w 66w2 5vf9
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-859w-5945-r5v3
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-859w-5945-r5v3 (aka CVE-2025-46565). Note: `6.0.3` is the declared floor of a range — the installed version may be newer. Vite's server.fs.deny bypassed with /. for files under project root A…
harper-desktop/package.json ScaOsvGhsa 859w 5945 r5v3
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-93m4-6634-74q7
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-93m4-6634-74q7 (aka CVE-2025-62522). Note: `6.0.3` is the declared floor of a range — the installed version may be newer. vite allows server.fs.deny bypass via backslash on Windows Aliases: C…
harper-desktop/package.json ScaOsvGhsa 93m4 6634 74q7
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-v6wh-96g9-6wx3
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632). Note: `6.0.3` is the declared floor of a range — the installed version may be newer. launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows…
harper-desktop/package.json ScaOsvGhsa v6wh 96g9 6wx3
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-vg6x-rcgg-rjx6
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-vg6x-rcgg-rjx6. Note: `6.0.3` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vg6x-rcgg-rjx6 Fix:…
harper-desktop/package.json ScaOsvGhsa vg6x rcgg rjx6
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-x574-m823-4x7w
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-x574-m823-4x7w. Note: `6.0.3` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-x574-m823-4x7w Fix:…
harper-desktop/package.json ScaOsvGhsa x574 m823 4x7w
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-xcj6-pq6g-qj4x
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-xcj6-pq6g-qj4x. Note: `6.0.3` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xcj6-pq6g-qj4x Fix:…
harper-desktop/package.json ScaOsvGhsa xcj6 pq6g qj4x
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-356w-63v5-8wf4
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-356w-63v5-8wf4 (aka CVE-2025-32395). Note: `6.1.0` is the declared floor of a range — the installed version may be newer. Vite has an `server.fs.deny` bypass with an invalid `request-targe…
packages/harper.js/package.json ScaOsvGhsa 356w 63v5 8wf4
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-4r4m-qw57-chr8
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-4r4m-qw57-chr8 (aka CVE-2025-31125). Note: `6.1.0` is the declared floor of a range — the installed version may be newer. Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `…
packages/harper.js/package.json ScaOsvGhsa 4r4m qw57 chr8
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-4w7w-66w2-5vf9
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365). Note: `6.1.0` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handlin…
packages/harper.js/package.json ScaOsvGhsa 4w7w 66w2 5vf9
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-859w-5945-r5v3
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-859w-5945-r5v3 (aka CVE-2025-46565). Note: `6.1.0` is the declared floor of a range — the installed version may be newer. Vite's server.fs.deny bypassed with /. for files under project roo…
packages/harper.js/package.json ScaOsvGhsa 859w 5945 r5v3
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-93m4-6634-74q7
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-93m4-6634-74q7 (aka CVE-2025-62522). Note: `6.1.0` is the declared floor of a range — the installed version may be newer. vite allows server.fs.deny bypass via backslash on Windows Aliase…
packages/harper.js/package.json ScaOsvGhsa 93m4 6634 74q7
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-v6wh-96g9-6wx3
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632). Note: `6.1.0` is the declared floor of a range — the installed version may be newer. launch-editor: NTLMv2 hash disclosure via UNC path handling on Win…
packages/harper.js/package.json ScaOsvGhsa v6wh 96g9 6wx3
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-x574-m823-4x7w
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-x574-m823-4x7w. Note: `6.1.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-x574-m823-4x7w …
packages/harper.js/package.json ScaOsvGhsa x574 m823 4x7w
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-xcj6-pq6g-qj4x
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-xcj6-pq6g-qj4x. Note: `6.1.0` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xcj6-pq6g-qj4x …
packages/harper.js/package.json ScaOsvGhsa xcj6 pq6g qj4x
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.3.5: GHSA-4w7w-66w2-5vf9
OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365). Note: `6.3.5` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Path Traversal in Optimized Deps `.map` H…
packages/obsidian-plugin/package.json ScaOsvGhsa 4w7w 66w2 5vf9
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.3.5: GHSA-93m4-6634-74q7
OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-93m4-6634-74q7 (aka CVE-2025-62522). Note: `6.3.5` is the declared floor of a range — the installed version may be newer. vite allows server.fs.deny bypass via backslash on Windows …
packages/obsidian-plugin/package.json ScaOsvGhsa 93m4 6634 74q7
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.3.5: GHSA-v6wh-96g9-6wx3
OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632). Note: `6.3.5` is the declared floor of a range — the installed version may be newer. launch-editor: NTLMv2 hash disclosure via UNC path handling …
packages/obsidian-plugin/package.json ScaOsvGhsa v6wh 96g9 6wx3
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 7.1.10: GHSA-4w7w-66w2-5vf9
OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-4w7w-66w2-5vf9 (aka CVE-2026-39365). Note: `7.1.10` is the declared floor of a range — the installed version may be newer. Vite Vulnerable to Path Traversal in Optimized Deps `.map` Hand…
packages/components/package.json ScaOsvGhsa 4w7w 66w2 5vf9
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 7.1.10: GHSA-93m4-6634-74q7
OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-93m4-6634-74q7 (aka CVE-2025-62522). Note: `7.1.10` is the declared floor of a range — the installed version may be newer. vite allows server.fs.deny bypass via backslash on Windows Ali…
packages/components/package.json ScaOsvGhsa 93m4 6634 74q7
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 7.1.10: GHSA-v2wj-q39q-566r
OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-v2wj-q39q-566r. Note: `7.1.10` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v2wj-q39q-56…
packages/components/package.json ScaOsvGhsa v2wj q39q 566r
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 7.1.10: GHSA-v6wh-96g9-6wx3
OSV.dev reports `vite` at version `7.1.10` (declared in `packages/components/package.json`) is affected by GHSA-v6wh-96g9-6wx3 (aka CVE-2026-53632). Note: `7.1.10` is the declared floor of a range — the installed version may be newer. launch-editor: NTLMv2 hash disclosure via UNC path handling on …
packages/components/package.json ScaOsvGhsa v6wh 96g9 6wx3
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency vitest 4.0.16: GHSA-5xrq-8626-4rwp
OSV.dev reports `vitest` at version `4.0.16` (declared in `packages/harper.js/package.json`) is affected by GHSA-5xrq-8626-4rwp. Note: `4.0.16` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-5xrq-8626-4…
packages/harper.js/package.json ScaOsvGhsa 5xrq 8626 4rwp
low System graph quality Maintenance conf 1.00 82 TODO/FIXME markers
High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.
low System graph security Trivy conf 1.00 CVE-2024-47764: cookie 0.6.0 — pnpm-lock.yaml
cookie: cookie accepts cookie name, path, and domain with out of bounds characters cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path a…
VulnCve 2024 47764
low System graph security Trivy conf 1.00 CVE-2025-57352: min-document 2.19.0 — pnpm-lock.yaml
min-document: min-document prototype pollution A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in the removeAttributeNS method. By processing malicious input involving the __proto__ property, an attacker can mani…
VulnCve 2025 57352
low System graph security Trivy conf 1.00 CVE-2025-58751: vite 6.3.5 — pnpm-lock.yaml
vitejs/vite: lukeed/sirv: Vite middleware may serve files starting with the same name with the public directory Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing …
VulnCve 2025 58751
low System graph security Trivy conf 1.00 CVE-2025-58752: vite 6.3.5 — pnpm-lock.yaml
vite: Vite's `server.fs` settings were not applied to HTML files Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev s…
VulnCve 2025 58752
low System graph security Trivy conf 1.00 CVE-2025-5889: brace-expansion 1.1.11 — pnpm-lock.yaml
brace-expansion: juliangruber brace-expansion index.js expand redos A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient …
VulnCve 2025 5889
low System graph security Trivy conf 1.00 CVE-2025-5889: brace-expansion 2.0.1 — pnpm-lock.yaml
brace-expansion: juliangruber brace-expansion index.js expand redos A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient …
VulnCve 2025 5889
low System graph security Trivy conf 1.00 CVE-2025-68157: webpack 5.98.0 — pnpm-lock.yaml
webpack: webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-valida…
VulnCve 2025 68157
low System graph security Trivy conf 1.00 CVE-2025-68458: webpack 5.98.0 — pnpm-lock.yaml
webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resource…
VulnCve 2025 68458
low System graph security Trivy conf 1.00 CVE-2025-7339: on-headers 1.0.2 — pnpm-lock.yaml
on-headers: on-headers vulnerable to http response header manipulation on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHea…
VulnCve 2025 7339
low System graph security Trivy conf 1.00 CVE-2026-12590: body-parser 1.20.3 — pnpm-lock.yaml
body-parser: body-parser: Denial of Service via invalid limit option Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body…
VulnCve 2026 12590
low System graph security Trivy conf 1.00 CVE-2026-2391: qs 6.13.0 — pnpm-lock.yaml
qs: qs's arrayLimit bypass in comma parsing allows denial of service ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit …
VulnCve 2026 2391
low System graph security Trivy conf 1.00 CVE-2026-24001: diff 4.0.2 — pnpm-lock.yaml
jsdiff: denial of service vulnerability in parsePatch and applyPatch jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\r`, `\u2028`, or `\u2029` can cause…
VulnCve 2026 24001
low System graph security Trivy conf 1.00 CVE-2026-49356: @babel/core 7.25.7 — pnpm-lock.yaml
@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted cod…
VulnCve 2026 49356
low System graph security Trivy conf 1.00 CVE-2026-49356: @babel/core 7.26.10 — pnpm-lock.yaml
@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted cod…
VulnCve 2026 49356
low System graph security Trivy conf 1.00 CVE-2026-54696: json 2.19.5 — Gemfile.lock
Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2. ... Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj,…
VulnCve 2026 54696
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — packages/chrome-plugin/src/popup/Main.svelte:59
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
packages/chrome-plugin/src/popup/Main.svelte:59 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — packages/harper-editor/src/lib/Editor.svelte:82
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
packages/harper-editor/src/lib/Editor.svelte:82 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — packages/obsidian-plugin/src/State.ts:364
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
packages/obsidian-plugin/src/State.ts:364 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — packages/vscode-plugin/src/extension.ts:206
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
packages/vscode-plugin/src/extension.ts:206 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — packages/web/src/hooks.server.ts:8
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
packages/web/src/hooks.server.ts:8 Fq console leak
low System graph frontend Frontend quality conf 0.85 Debug `console.log` remains in browser-facing code — packages/web/src/routes/download-harper-desktop/[target]/[arch]/[current_version]/+server.ts:118
Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak
packages/web/src/routes/download-harper-desktop/[target]/[arch]/[current_version]/+server.ts:118 Fq console leak
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 24 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
Dockerfile:21 containersPinned dependencies
low System graph security Trivy conf 1.00 DS-0026: No HEALTHCHECK defined — Dockerfile
No HEALTHCHECK defined Add HEALTHCHECK instruction in your Dockerfile Rule: DS-0026 Severity: LOW Target: Dockerfile
Misconfig
low System graph security Trivy conf 1.00 GHSA-33hq-fvwr-56pm: devalue 5.4.1 — pnpm-lock.yaml
devalue affected by CPU and memory amplification from sparse arrays Under certain circumstances, serializing sparse arrays using `uneval` or `stringify` could cause CPU and/or memory exhaustion. When this occurs on the server, it results in a DoS. This is extremely difficult to take advantage of i…
VulnGhsa 33hq fvwr 56pm
low System graph security Trivy conf 1.00 GHSA-8qm3-746x-r74r: devalue 5.4.1 — pnpm-lock.yaml
devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed Under certain circumstances, `uneval`ing untrusted data can produce output code that will create objects with polluted prototypes when later `eval`ed, meaning the output data can be a different shape from the input d…
VulnGhsa 8qm3 746x r74r
low System graph security Trivy conf 1.00 GHSA-965h-392x-2mh5: rustls-webpki 0.103.10 — Cargo.lock
webpki: Name constraints for URI names were incorrectly accepted Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected un…
VulnGhsa 965h 392x 2mh5
low System graph security Trivy conf 1.00 GHSA-cq8v-f236-94qc: rand 0.8.5 — Cargo.lock
Rand is unsound with a custom logger using rand::rng() It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour)…
VulnGhsa cq8v f236 94qc
low System graph security Trivy conf 1.00 GHSA-cq8v-f236-94qc: rand 0.9.2 — Cargo.lock
Rand is unsound with a custom logger using rand::rng() It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour)…
VulnGhsa cq8v f236 94qc
low System graph security Trivy conf 1.00 GHSA-mwv9-gp5h-frr4: devalue 5.4.1 — pnpm-lock.yaml
Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties In some circumstances, `devalue.parse` and `devalue.unflatten` could emit objects with `__proto__` own properties. This in and of itself is not a security vulnerability (and is possible with, fo…
VulnGhsa mwv9 gp5h frr4
low System graph security Trivy conf 1.00 GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.103.10 — Cargo.lock
webpki: Name constraints were accepted for certificates asserting a wildcard name Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly …
VulnGhsa xgp8 3hg3 c2mh
low System graph cicd CI/CD security conf 1.00 6 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/[email protected] can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
6 files, 6 locations
.github/workflows/binaries.yml:119
.github/workflows/build_web.yml:16
.github/workflows/chrome_plugin.yml:33
.github/workflows/just_checks.yml:40
.github/workflows/wp_plugin.yml:31
harper-desktop/.github/workflows/build_artifacts.yml:46
CI/CD securitySupply chainGithub actions
low System graph quality Tests conf 1.00 Low test-to-source ratio
77 tests / 711 src (ratio 0.11).
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: harper-desktop/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
harper-desktop/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/chrome-plugin/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/chrome-plugin/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/components/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/components/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/harper-editor/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/harper-editor/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/harper.js/examples/commonjs-simple/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/harper.js/examples/commonjs-simple/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/harper.js/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/harper.js/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/lint-framework/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/lint-framework/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/obsidian-plugin/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/obsidian-plugin/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/vscode-plugin/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/vscode-plugin/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/web/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/web/package.json LockfileReproducibilityGenerated repo pattern
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: packages/wordpress-plugin/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
packages/wordpress-plugin/package.json LockfileReproducibilityGenerated repo pattern
low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts
preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.
packages/harper-editor/package.json CI/CD securitySupply chainNpm
low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts
preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.
packages/components/package.json CI/CD securitySupply chainNpm
low System graph quality Complexity conf 1.00 Very large file: harper-core/src/dict_word_metadata.rs (2056 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: harper-core/src/linting/phrase_set_corrections/tests.rs (4010 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: harper-core/src/linting/there_is_agreement.rs (1482 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-g4jq-h2w9-997c
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-g4jq-h2w9-997c (aka CVE-2025-58751). Note: `5.4.10` is the declared floor of a range — the installed version may be newer. Vite middleware may serve files starting with the same name …
packages/chrome-plugin/package.json ScaOsvGhsa g4jq h2w9 997c
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 5.4.10: GHSA-jqfw-vq24-v9c3
OSV.dev reports `vite` at version `5.4.10` (declared in `packages/chrome-plugin/package.json`) is affected by GHSA-jqfw-vq24-v9c3 (aka CVE-2025-58752). Note: `5.4.10` is the declared floor of a range — the installed version may be newer. Vite's `server.fs` settings were not applied to HTML files …
packages/chrome-plugin/package.json ScaOsvGhsa jqfw vq24 v9c3
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-g4jq-h2w9-997c
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-g4jq-h2w9-997c (aka CVE-2025-58751). Note: `6.0.3` is the declared floor of a range — the installed version may be newer. Vite middleware may serve files starting with the same name with the p…
harper-desktop/package.json ScaOsvGhsa g4jq h2w9 997c
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.0.3: GHSA-jqfw-vq24-v9c3
OSV.dev reports `vite` at version `6.0.3` (declared in `harper-desktop/package.json`) is affected by GHSA-jqfw-vq24-v9c3 (aka CVE-2025-58752). Note: `6.0.3` is the declared floor of a range — the installed version may be newer. Vite's `server.fs` settings were not applied to HTML files Aliases: C…
harper-desktop/package.json ScaOsvGhsa jqfw vq24 v9c3
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-g4jq-h2w9-997c
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-g4jq-h2w9-997c (aka CVE-2025-58751). Note: `6.1.0` is the declared floor of a range — the installed version may be newer. Vite middleware may serve files starting with the same name with t…
packages/harper.js/package.json ScaOsvGhsa g4jq h2w9 997c
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.1.0: GHSA-jqfw-vq24-v9c3
OSV.dev reports `vite` at version `6.1.0` (declared in `packages/harper.js/package.json`) is affected by GHSA-jqfw-vq24-v9c3 (aka CVE-2025-58752). Note: `6.1.0` is the declared floor of a range — the installed version may be newer. Vite's `server.fs` settings were not applied to HTML files Aliase…
packages/harper.js/package.json ScaOsvGhsa jqfw vq24 v9c3
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.3.5: GHSA-g4jq-h2w9-997c
OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-g4jq-h2w9-997c (aka CVE-2025-58751). Note: `6.3.5` is the declared floor of a range — the installed version may be newer. Vite middleware may serve files starting with the same name …
packages/obsidian-plugin/package.json ScaOsvGhsa g4jq h2w9 997c
low System graph dependencies dependencies conf 0.70 Vulnerable dependency vite 6.3.5: GHSA-jqfw-vq24-v9c3
OSV.dev reports `vite` at version `6.3.5` (declared in `packages/obsidian-plugin/package.json`) is affected by GHSA-jqfw-vq24-v9c3 (aka CVE-2025-58752). Note: `6.3.5` is the declared floor of a range — the installed version may be newer. Vite's `server.fs` settings were not applied to HTML files …
packages/obsidian-plugin/package.json ScaOsvGhsa jqfw vq24 v9c3
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/de904308-f5d0-4c97-a312-04b939c14961/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/de904308-f5d0-4c97-a312-04b939c14961/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.