high System graph security Trivy conf 1.00 CVE-2026-42570: devalue 5.7.1 — docs/package-lock.json

devalue: devalue: Excessive memory consumption via deserialization of sparse arrays Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some Ja…

VulnCve 2026 42570

high System graph security Trivy conf 1.00 CVE-2026-50146: astro 5.18.1 — docs/package-lock.json

Astro: Reflected XSS via unescaped slot name Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context an…

VulnCve 2026 50146

high System graph security Trivy conf 1.00 CVE-2026-53571: vite 6.4.2 — docs/package-lock.json

vite: `server.fs.deny` bypass on Windows alternate paths Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive…

VulnCve 2026 53571

high System graph security Trivy conf 1.00 CVE-2026-54299: astro 5.18.1 — docs/package-lock.json

Astro: Host header SSRF in prerendered error page fetch Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from reque…

VulnCve 2026 54299

high System graph security Trivy conf 1.00 CVE-2026-59869: js-yaml 4.1.1 — docs/package-lock.json

js-yaml: js-yaml: Denial of Service via crafted YAML documents js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where…

VulnCve 2026 59869

high System graph security Trivy conf 1.00 GHSA-2p49-hgcm-8545: svgo 4.0.1 — docs/package-lock.json

SVGO removeScripts plugin leaves some executable scripts intact ### Summary SVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, the…

VulnGhsa 2p49 hgcm 8545

high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.33.5 — docs/package-lock.json

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…

VulnGhsa f88m g3jw g9cj

high System graph security Trivy conf 1.00 GHSA-f88m-g3jw-g9cj: sharp 0.34.5 — docs/package-lock.json

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with v…

VulnGhsa f88m g3jw g9cj

high System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-2pvr-wf23-7pc7

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-2pvr-wf23-7pc7 (aka CVE-2026-54299). Astro: Host header SSRF in prerendered error page fetch Aliases: CVE-2026-54299 Advisory: https://osv.dev/vulnerability/GHSA-2pvr-wf23-7pc7 Fix: upgrade `ast…

docs/package.json ScaOsvGhsa 2pvr wf23 7pc7

high System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-8hv8-536x-4wqp

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-8hv8-536x-4wqp (aka CVE-2026-50146). Astro: Reflected XSS via unescaped slot name Aliases: CVE-2026-50146 Advisory: https://osv.dev/vulnerability/GHSA-8hv8-536x-4wqp Fix: upgrade `astro` past th…

docs/package.json ScaOsvGhsa 8hv8 536x 4wqp

high System graph dependencies dependencies conf 0.90 Vulnerable dependency devalue 5.7.1: GHSA-77vg-94rm-hx3p

OSV.dev reports `devalue` at version `5.7.1` (resolved in `docs/package-lock.json`) is affected by GHSA-77vg-94rm-hx3p (aka CVE-2026-42570). Note: `devalue` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Svelte devalue: DoS via sparse array deserial…

docs/package-lock.json ScaOsvGhsa 77vg 94rm hx3p

high System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m

OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `docs/package-lock.json`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869). Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. js-yaml: YAML merge-key chains can force quad…

docs/package-lock.json ScaOsvGhsa 52cp r559 cp3m

high System graph dependencies dependencies conf 1.00 Vulnerable dependency sharp 0.33.5: GHSA-f88m-g3jw-g9cj

OSV.dev reports `sharp` at version `0.33.5` (resolved in `docs/package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj. sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 Advisory: https://osv.dev/vulnerability/GHSA-f88m-g3jw-g9cj Fix: upgrad…

docs/package.json ScaOsvGhsa f88m g3jw g9cj

high System graph dependencies dependencies conf 0.90 Vulnerable dependency sharp 0.34.5: GHSA-f88m-g3jw-g9cj

OSV.dev reports `sharp` at version `0.34.5` (resolved in `docs/package-lock.json`) is affected by GHSA-f88m-g3jw-g9cj. Note: `sharp` is an optional dependency — installs may legitimately omit it. sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-3…

docs/package-lock.json ScaOsvGhsa f88m g3jw g9cj

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: AGENTS.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

AGENTS.md VerificationAgents md

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: docs/src/content/docs/guides/agents.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

docs/src/content/docs/guides/agents.md VerificationAgents md

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/no-mistakes/SKILL.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

skills/no-mistakes/SKILL.md VerificationSkill file

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data

A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.

Mock dataCritical flowGenerated repo pattern

medium System graph security Trivy conf 1.00 CVE-2026-41067: astro 5.18.1 — docs/package-lock.json

Astro: XSS in define:vars via incomplete </script> tag sanitization Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline <script> tags via the define:vars …

VulnCve 2026 41067

medium System graph security Trivy conf 1.00 CVE-2026-41148: mermaid 11.14.0 — docs/package-lock.json

mermaid: Mermaid: CSS injection vulnerability allows page defacement and information disclosure Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS inj…

VulnCve 2026 41148

medium System graph security Trivy conf 1.00 CVE-2026-41149: mermaid 11.14.0 — docs/package-lock.json

mermaid: Mermaid: HTML injection via classDef directive in state diagrams Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the defau…

VulnCve 2026 41149

medium System graph security Trivy conf 1.00 CVE-2026-41150: mermaid 11.14.0 — docs/package-lock.json

mermaid: Mermaid: Denial of Service via specially crafted gantt charts Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attr…

VulnCve 2026 41150

medium System graph security Trivy conf 1.00 CVE-2026-41159: mermaid 11.14.0 — docs/package-lock.json

mermaid: Mermaid: Information disclosure and page defacement via CSS injection Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, Mermaid's default configuration allows injecting CSS that applies outside of the Merm…

VulnCve 2026 41159

medium System graph security Trivy conf 1.00 CVE-2026-41305: postcss 8.5.9 — docs/package-lock.json

postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifyin…

VulnCve 2026 41305

medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 11.1.0 — docs/package-lock.json

uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…

VulnCve 2026 41907

medium System graph security Trivy conf 1.00 CVE-2026-49458: dompurify 3.4.0 — docs/package-lock.json

dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks us…

VulnCve 2026 49458

medium System graph security Trivy conf 1.00 CVE-2026-49459: dompurify 3.4.0 — docs/package-lock.json

dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form…

VulnCve 2026 49459

medium System graph security Trivy conf 1.00 CVE-2026-49978: dompurify 3.4.0 — docs/package-lock.json

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing att…

VulnCve 2026 49978

medium System graph security Trivy conf 1.00 CVE-2026-53550: js-yaml 4.1.1 — docs/package-lock.json

js-yaml: js-yaml: Denial of Service via crafted YAML merge keys js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence.…

VulnCve 2026 53550

medium System graph security Trivy conf 1.00 CVE-2026-53632: vite 6.4.2 — docs/package-lock.json

launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a U…

VulnCve 2026 53632

medium System graph security Trivy conf 1.00 CVE-2026-54298: astro 5.18.1 — docs/package-lock.json

Astro: XSS via Unescaped Attribute Names in Spread Props Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without esc…

VulnCve 2026 54298

medium System graph security Trivy conf 1.00 CVE-2026-59729: astro 5.18.1 — docs/package-lock.json

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) ## Summary The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()` so that spread-prop attribute names containing `"' >/=` or whitespace ar…

VulnCve 2026 59729

medium System graph dependencies dependencies conf 0.90 Dependency astro is two or more major versions behind

`astro` is pinned at `5.18.1` in `docs/package.json` while the latest release on the npm registry is `7.1.3` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `astro` to `7.1.3`.

docs/package.json FreshnessOutdated

medium System graph security Trivy conf 1.00 GHSA-4g3v-8h47-v7g6: astro 5.18.1 — docs/package-lock.json

Astro: Reflected XSS via unescaped View Transition animation properties ## Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline `<style>` element without escaping them for the CSS and HTML contexts. An attacker-controlled value passed to an a…

VulnGhsa 4g3v 8h47 v7g6

medium System graph security Trivy conf 1.00 GHSA-76mc-f452-cxcm: dompurify 3.4.0 — docs/package-lock.json

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` # Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` **CWE**: CWE-501 (Tr…

VulnGhsa 76mc f452 cxcm

medium System graph security Trivy conf 1.00 GHSA-cmwh-pvxp-8882: dompurify 3.4.0 — docs/package-lock.json

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) ## Summary DOMPurify 3.4.7 shipped a security fix ("permanent hook pollution") that makes a registered `uponSanitizeAttribute` hook's mutation of `data…

VulnGhsa cmwh pvxp 8882

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/docs.yml CI/CD securitySupply chainGithub actions

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/release.yml CI/CD securitySupply chainGithub actions

medium System graph security Semgrep conf 0.70 math random used — internal/agent/retry.go:6

Do not use `math/rand`. Use `crypto/rand` instead. Rule: go.lang.security.audit.crypto.math_random.math-random-used Severity: WARNING OWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures CWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Catego…

internal/agent/retry.go:6 SecurityGo

medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected

Found 225 placeholder/mock markers across 60 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.

Mock dataIncompleteGenerated repo pattern

medium System graph security Skillspector conf 0.75 SkillSpector EA2 (excessive-agency) in skills/no-mistakes/SKILL.md

without checking Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation. Skill: no-mistakes Rule: EA2 Category: excessive-agency Severity: M…

skills/no-mistakes/SKILL.md:243 Mcp skillExcessive agencyEa2

medium System graph security Semgrep conf 0.55 use of unsafe block — internal/e2edaemon/process_windows.go:37

Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'…

internal/e2edaemon/process_windows.go:37 SecurityGo

medium System graph security Semgrep conf 0.55 use of unsafe block — internal/shellenv/shell_command_windows.go:165

Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'…

internal/shellenv/shell_command_windows.go:165 SecurityGo

medium System graph security Semgrep conf 0.55 use of unsafe block — internal/update/process_path_windows.go:27

Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'…

internal/update/process_path_windows.go:27 SecurityGo

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-4g3v-8h47-v7g6

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-4g3v-8h47-v7g6. Astro: Reflected XSS via unescaped View Transition animation properties Advisory: https://osv.dev/vulnerability/GHSA-4g3v-8h47-v7g6 Fix: upgrade `astro` past the affected range p…

docs/package.json ScaOsvGhsa 4g3v 8h47 v7g6

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-f48w-9m4c-m7f5

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-f48w-9m4c-m7f5 (aka CVE-2026-59729). Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) Aliases: CVE-2026-59729 Advisory: https://osv.dev/vu…

docs/package.json ScaOsvGhsa f48w 9m4c m7f5

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-j687-52p2-xcff

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-j687-52p2-xcff (aka CVE-2026-41067). Astro: XSS in define:vars via incomplete </script> tag sanitization Aliases: CVE-2026-41067 Advisory: https://osv.dev/vulnerability/GHSA-j687-52p2-xcff Fix: …

docs/package.json ScaOsvGhsa j687 52p2 xcff

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-jrpj-wcv7-9fh9

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-jrpj-wcv7-9fh9 (aka CVE-2026-54298). Astro: XSS via Unescaped Attribute Names in Spread Props Aliases: CVE-2026-54298 Advisory: https://osv.dev/vulnerability/GHSA-jrpj-wcv7-9fh9 Fix: upgrade `as…

docs/package.json ScaOsvGhsa jrpj wcv7 9fh9

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-xr5h-phrj-8vxv

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-xr5h-phrj-8vxv (aka CVE-2026-45028). Astro: Server island encrypted parameters vulnerable to cross-component replay Aliases: CVE-2026-45028 Advisory: https://osv.dev/vulnerability/GHSA-xr5h-phrj…

docs/package.json ScaOsvGhsa xr5h phrj 8vxv

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-76mc-f452-cxcm

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-76mc-f452-cxcm (aka CVE-2026-65902). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: Hook mutation of `data.allowed…

docs/package-lock.json ScaOsvGhsa 76mc f452 cxcm

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-cmwh-pvxp-8882

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-cmwh-pvxp-8882 (aka CVE-2026-65898). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: Permanent `ALLOWED_ATTR` pollu…

docs/package-lock.json ScaOsvGhsa cmwh pvxp 8882

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-hpcv-96wg-7vj8

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-hpcv-96wg-7vj8 (aka CVE-2026-49458). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: Cross-realm IN_PLACE sanitizat…

docs/package-lock.json ScaOsvGhsa hpcv 96wg 7vj8

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-r47g-fvhr-h676

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-r47g-fvhr-h676 (aka CVE-2026-49459). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: IN_PLACE mode preserves attrib…

docs/package-lock.json ScaOsvGhsa r47g fvhr h676

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-rp9w-3fw7-7cwq

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-rp9w-3fw7-7cwq (aka CVE-2026-49978). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify IN_PLACE Sanitization Bypass vi…

docs/package-lock.json ScaOsvGhsa rp9w 3fw7 7cwq

medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68

OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `docs/package-lock.json`) is affected by GHSA-h67p-54hq-rp68 (aka CVE-2026-53550). Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. JS-YAML: Quadratic-complexity DoS in merge ke…

docs/package-lock.json ScaOsvGhsa h67p 54hq rp68

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-6m6c-36f7-fhxh

OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-6m6c-36f7-fhxh (aka CVE-2026-41150). Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS Aliases: CVE-2026-41150 Advisory: https://osv.dev/vulnerability/GHSA-6m6c-36f7-fhxh Fix: upgra…

docs/package.json ScaOsvGhsa 6m6c 36f7 fhxh

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-87f9-hvmw-gh4p

OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-87f9-hvmw-gh4p (aka CVE-2026-41159). Mermaid: Improper sanitization of configuration leads to CSS injection Aliases: CVE-2026-41159 Advisory: https://osv.dev/vulnerability/GHSA-87f9-hvmw-gh4p…

docs/package.json ScaOsvGhsa 87f9 hvmw gh4p

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-ghcm-xqfw-q4vr

OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-ghcm-xqfw-q4vr (aka CVE-2026-41149). Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection Aliases: CVE-2026-41149 Advisory: https://osv.dev/vulnerability/GHS…

docs/package.json ScaOsvGhsa ghcm xqfw q4vr

medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mermaid 11.14.0: GHSA-xcj9-5m2h-648r

OSV.dev reports `mermaid` at version `11.14.0` (resolved in `docs/package-lock.json`) is affected by GHSA-xcj9-5m2h-648r (aka CVE-2026-41148). Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection Aliases: CVE-2026-41148 Advisory: https://osv.dev/vulnerability/GHSA-xcj9…

docs/package.json ScaOsvGhsa xcj9 5m2h 648r

low System graph security Trivy conf 1.00 CVE-2026-45028: astro 5.18.1 — docs/package-lock.json

Astro: Server island encrypted parameters vulnerable to cross-component replay Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended …

VulnCve 2026 45028

low System graph security Trivy conf 1.00 CVE-2026-59727: astro 5.18.1 — docs/package-lock.json

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands ### Summary When a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a client-hydrated (`client:*`) component, Astro copied the directive value onto the render…

VulnCve 2026 59727

low System graph security Trivy conf 1.00 GHSA-c2j3-45gr-mqc4: dompurify 3.4.0 — docs/package-lock.json

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. ## Summary There is a possible hook-policy inconsistency in DOMPurify 3.4.11 involving `CUSTOM_ELEMENT_HANDLING`. When a custom element is allowed via `CUSTOM_ELEMENT_HANDLING.tagNameCheck`, it app…

VulnGhsa c2j3 45gr mqc4

low System graph security Trivy conf 1.00 GHSA-g7r4-m6w7-qqqr: esbuild 0.27.7 — docs/package-lock.json

esbuild allows arbitrary file read when running the development server on Windows ### Summary The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instea…

VulnGhsa g7r4 m6w7 qqqr

low System graph security Trivy conf 1.00 GHSA-gvmj-g25r-r7wr: dompurify 3.4.0 — docs/package-lock.json

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes ## Summary When DOMPurify is configured with both `SAFE_FOR_TEMPLATES: true` and `RETURN_DOM: true` (or `IN_PLACE: true`), an attacker can inject template express…

VulnGhsa gvmj g25r r7wr

low System graph security Trivy conf 1.00 GHSA-vxr8-fq34-vvx9: dompurify 3.4.0 — docs/package-lock.json

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output ## Impact A DOMPurify instance that is reused across trust boundaries can stay bound to a previously supplied `TRUSTED_TYPES_POLICY` even after `clearConfig()` is called. A later caller that…

VulnGhsa vxr8 fq34 vvx9

low System graph security Trivy conf 1.00 GHSA-x4vx-rjvf-j5p4: dompurify 3.4.0 — docs/package-lock.json

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects ## Summary When `DOMPurify.sanitize(root, { IN_PLACE: true })` is called on an attacker-supplied live DOM node, `DOMPurify` still trusts `cu…

VulnGhsa x4vx rjvf j5p4

low System graph cicd CI/CD security conf 1.00 GitHub Action is tag-pinned rather than SHA-pinned

actions/configure-pages@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

.github/workflows/docs.yml:30 CI/CD securitySupply chainGithub actions

low System graph quality Complexity conf 1.00 Very large file: internal/daemon/service_test.go (1637 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

low System graph quality Complexity conf 1.00 Very large file: internal/e2e/journey_test.go (2916 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

low System graph quality Complexity conf 1.00 Very large file: internal/pipeline/steps/pr_test.go (1914 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

low System graph dependencies dependencies conf 1.00 Vulnerable dependency astro 5.18.1: GHSA-7pw4-f3q4-r2p2

OSV.dev reports `astro` at version `5.18.1` (resolved in `docs/package-lock.json`) is affected by GHSA-7pw4-f3q4-r2p2 (aka CVE-2026-59727). Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands Aliases: CVE-2026-59727 Advisory: https://osv.dev/vulnerability/G…

docs/package.json ScaOsvGhsa 7pw4 f3q4 r2p2

low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-c2j3-45gr-mqc4

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-c2j3-45gr-mqc4. Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeEl…

docs/package-lock.json ScaOsvGhsa c2j3 45gr mqc4

low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-gvmj-g25r-r7wr

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-gvmj-g25r-r7wr (aka CVE-2026-65900). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: SAFE_FOR_TEMPLATES bypass - te…

docs/package-lock.json ScaOsvGhsa gvmj g25r r7wr

low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-vxr8-fq34-vvx9

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-vxr8-fq34-vvx9 (aka CVE-2026-65899). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: Trusted Types policy survives …

docs/package-lock.json ScaOsvGhsa vxr8 fq34 vvx9

low System graph dependencies dependencies conf 0.90 Vulnerable dependency dompurify 3.4.0: GHSA-x4vx-rjvf-j5p4

OSV.dev reports `dompurify` at version `3.4.0` (resolved in `docs/package-lock.json`) is affected by GHSA-x4vx-rjvf-j5p4 (aka CVE-2026-65901). Note: `dompurify` is a transitive dependency — pulled in by another package, not declared directly in a manifest. DOMPurify: `IN_PLACE` mode trusts attacke…

docs/package-lock.json ScaOsvGhsa x4vx rjvf j5p4

low System graph dependencies dependencies conf 0.90 Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr

OSV.dev reports `esbuild` at version `0.27.7` (resolved in `docs/package-lock.json`) is affected by GHSA-g7r4-m6w7-qqqr. Note: `esbuild` is a transitive dependency — pulled in by another package, not declared directly in a manifest. esbuild allows arbitrary file read when running the development s…

docs/package-lock.json ScaOsvGhsa g7r4 m6w7 qqqr

kunchenguid/no-mistakes

Complete repo analysis