Skip to content

doc-site-0.0.0.tgz: 35 vulnerabilities (highest severity is: 9.8) #6560

Open
Open
doc-site-0.0.0.tgz: 35 vulnerabilities (highest severity is: 9.8)#6560
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by WhiteSource

Description

@mend-bolt-for-github
mend-bolt-for-github
bot
opened on May 27, 2022
Vulnerable Library - doc-site-0.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/webpack-dev-server-npm-5.2.2-4539d3b7aa-10c0.zip

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (doc-site version) Remediation Possible**
CVE-2026-41907 Critical 9.8 uuid-8.3.2.tgz Transitive N/A* ❌
CVE-2026-54466 High 8.6 websocket-driver-0.7.4.tgz Transitive N/A* ❌
CVE-2026-53632 High 8.3 launch-editor-2.12.0.tgz Transitive N/A* ❌
CVE-2026-44728 High 8.2 plugin-transform-modules-systemjs-7.25.9.tgz Transitive N/A* ❌
CVE-2026-9277 High 8.1 shell-quote-1.8.3.tgz Transitive N/A* ❌
CVE-2026-59869 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2026-48779 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2026-4867 High 7.5 path-to-regexp-0.1.12.tgz Transitive N/A* ❌
CVE-2026-14257 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2026-13311 High 7.5 shell-quote-1.8.3.tgz Transitive N/A* ❌
CVE-2026-13149 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2025-59343 High 7.5 tar-fs-3.0.4.tgz Transitive N/A* ❌
CVE-2025-48387 High 7.5 tar-fs-3.0.4.tgz Transitive N/A* ❌
CVE-2024-45296 High 7.5 path-to-regexp-1.8.0.tgz Transitive N/A* ❌
CVE-2024-12905 High 7.5 tar-fs-3.0.4.tgz Transitive N/A* ❌
CVE-2026-45149 Medium 6.5 brace-expansion-5.0.5.tgz Transitive N/A* ❌
CVE-2026-33750 Medium 6.5 brace-expansion-1.1.11.tgz Transitive N/A* ❌
CVE-2026-34043 Medium 5.9 serialize-javascript-6.0.2.tgz Transitive N/A* ❌
CVE-2026-54490 Medium 5.8 websocket-driver-0.7.4.tgz Transitive N/A* ❌
CVE-2026-9595 Medium 5.3 webpack-dev-server-5.2.2.tgz Transitive N/A* ❌
CVE-2026-8723 Medium 5.3 qs-6.13.0.tgz Transitive N/A* ❌
CVE-2026-6402 Medium 5.3 webpack-dev-server-5.2.2.tgz Transitive N/A* ❌
CVE-2026-55602 Medium 5.3 http-proxy-middleware-2.0.9.tgz Transitive N/A* ❌
CVE-2026-53550 Medium 5.3 detected in multiple dependencies Transitive N/A* ❌
CVE-2026-48038 Medium 5.3 joi-17.11.0.tgz Transitive N/A* ❌
CVE-2026-14631 Medium 5.3 webpack-dev-server-5.2.2.tgz Transitive N/A* ❌
CVE-2026-14620 Medium 4.7 webpack-dev-server-5.2.2.tgz Transitive N/A* ❌
CVE-2026-45736 Medium 4.4 ws-8.20.0.tgz Transitive N/A* ❌
CVE-2026-9358 Medium 4.3 detected in multiple dependencies Transitive N/A* ❌
CVE-2026-2391 Low 3.7 qs-6.13.0.tgz Transitive N/A* ❌
CVE-2026-12590 Low 3.7 body-parser-1.20.3.tgz Transitive N/A* ❌
CVE-2025-15284 Low 3.7 qs-6.13.0.tgz Transitive N/A* ❌
CVE-2025-7339 Low 3.4 on-headers-1.0.2.tgz Transitive N/A* ❌
CVE-2026-49356 Low 3.2 core-7.29.0.tgz Transitive N/A* ❌
CVE-2025-5889 Low 3.1 brace-expansion-1.1.11.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (19 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2026-41907

Vulnerable Library - uuid-8.3.2.tgz

RFC4122 (v1, v4, and v5) UUIDs

Library home page: https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/uuid-npm-8.3.2-eca0baba53-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • webpack-dev-server-5.2.2.tgz
        • sockjs-0.3.24.tgz
          • ❌ uuid-8.3.2.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

Publish Date: 2026-04-24

URL: CVE-2026-41907

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w5hq-g745-h8pq

Release Date: 2026-04-24

Fix Resolution: https://github.com/uuidjs/uuid.git - v11.1.1,https://github.com/uuidjs/uuid.git - v13.0.1,https://github.com/uuidjs/uuid.git - v12.0.1

Step up your Open Source Security Game with Mend here

CVE-2026-54466

Vulnerable Library - websocket-driver-0.7.4.tgz

WebSocket protocol handler with pluggable I/O

Library home page: https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/websocket-driver-npm-0.7.4-a72739da70-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • webpack-dev-server-5.2.2.tgz
        • sockjs-0.3.24.tgz
          • ❌ websocket-driver-0.7.4.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.

Publish Date: 2026-07-17

URL: CVE-2026-54466

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xv26-6w52-cph6

Release Date: 2026-07-15

Fix Resolution: websocket-driver - 0.7.5

Step up your Open Source Security Game with Mend here

CVE-2026-53632

Vulnerable Library - launch-editor-2.12.0.tgz

launch editor from node.js

Library home page: https://registry.npmjs.org/launch-editor/-/launch-editor-2.12.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/launch-editor-npm-2.12.0-7298d11419-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • webpack-dev-server-5.2.2.tgz
        • ❌ launch-editor-2.12.0.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

Publish Date: 2026-06-22

URL: CVE-2026-53632

CVSS 3 Score Details (8.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-15

Fix Resolution: https://github.com/vitejs/vite.git - v8.0.16,https://github.com/vitejs/vite.git - v6.4.3,https://github.com/vitejs/launch-editor.git - v2.14.1,https://github.com/vitejs/vite.git - v7.3.5

Step up your Open Source Security Game with Mend here

CVE-2026-44728

Vulnerable Library - plugin-transform-modules-systemjs-7.25.9.tgz

This plugin transforms ES2015 modules to SystemJS

Library home page: https://registry.npmjs.org/@⁠babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.25.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/@⁠babel-plugin-transform-modules-systemjs-npm-7.25.9-977795f4fd-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • webpack-8.1.0.tgz
      • preset-env-7.26.0.tgz
        • ❌ plugin-transform-modules-systemjs-7.25.9.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.

Publish Date: 2026-05-26

URL: CVE-2026-44728

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fv7c-fp4j-7gwp

Release Date: 2026-05-09

Fix Resolution: @⁠babel/plugin-transform-modules-systemjs - 8.0.0-alpha.13,@⁠babel/plugin-transform-modules-systemjs - 7.29.4

Step up your Open Source Security Game with Mend here

CVE-2026-9277

Vulnerable Library - shell-quote-1.8.3.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/shell-quote-npm-1.8.3-b29f851134-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • webpack-dev-server-5.2.2.tgz
        • launch-editor-2.12.0.tgz
          • ❌ shell-quote-1.8.3.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

shell-quote's "quote()" function did not validate object-token inputs against the operator model used by "parse()". The ".op" field was backslash-escaped character by character using "/(.)/g", which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in ".op" therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of "{ op: '...\n...' }" from external input, and (2) via "parse(cmd, envFn)" when "envFn" returns object tokens whose ".op" is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: ".op" must match the parser's control-operator allowlist; "{ op: 'glob', pattern }" validates "pattern" and forbids line terminators; "{ comment }" validates "comment" and forbids line terminators; any other object shape throws "TypeError".

Publish Date: 2026-05-22

URL: CVE-2026-9277

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-22

Fix Resolution: https://github.com/ljharb/shell-quote.git - v1.8.4,shell-quote - 1.8.4

Step up your Open Source Security Game with Mend here

CVE-2026-59869

Vulnerable Libraries - js-yaml-4.1.1.tgz, js-yaml-3.14.2.tgz

js-yaml-4.1.1.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/js-yaml-npm-4.1.1-86ec786790-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • docusaurus-1.34.0.tgz
      • utils-3.10.1.tgz
        • ❌ js-yaml-4.1.1.tgz (Vulnerable Library)

js-yaml-3.14.2.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/js-yaml-npm-3.14.2-debd9d20c3-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • utils-3.10.1.tgz
        • gray-matter-4.0.3.tgz
          • ❌ js-yaml-3.14.2.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Publish Date: 2026-07-08

URL: CVE-2026-59869

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-07-08

Fix Resolution: https://github.com/nodeca/js-yaml.git - 3.15.0,https://github.com/nodeca/js-yaml.git - 4.3.0,js-yaml - 4.3.0,js-yaml - 3.15.0,js-yaml - 4.3.0,js-yaml - 3.15.0

Step up your Open Source Security Game with Mend here

CVE-2026-48779

Vulnerable Libraries - ws-7.5.10.tgz, ws-8.20.0.tgz

ws-7.5.10.tgz

Library home page: https://registry.npmjs.org/ws/-/ws-7.5.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/ws-npm-7.5.10-878ccb886b-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • webpack-bundle-analyzer-4.10.2.tgz
        • ❌ ws-7.5.10.tgz (Vulnerable Library)

ws-8.20.0.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-8.20.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/ws-npm-8.20.0-b8684d1fe3-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • graphql-config-5.1.6.tgz
      • url-loader-9.1.2.tgz
        • ❌ ws-8.20.0.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.

Publish Date: 2026-06-16

URL: CVE-2026-48779

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-16

Fix Resolution: https://github.com/websockets/ws.git - 7.5.11,https://github.com/websockets/ws.git - 8.21.0,https://github.com/websockets/ws.git - 6.2.4,https://github.com/websockets/ws.git - 5.2.5

Step up your Open Source Security Game with Mend here

CVE-2026-4867

Vulnerable Library - path-to-regexp-0.1.12.tgz

Express style path to RegExp utility

Library home page: https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/path-to-regexp-npm-0.1.12-a9bf1de212-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • webpack-dev-server-5.2.2.tgz
        • express-4.21.2.tgz
          • ❌ path-to-regexp-0.1.12.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

Impact:
A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.
Patches:
Upgrade to path-to-regexp@0.1.13
Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.
Workarounds:
All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).
If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.

Publish Date: 2026-03-26

URL: CVE-2026-4867

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-37ch-88jc-xwx2

Release Date: 2026-03-26

Fix Resolution: path-to-regexp - 0.1.13

Step up your Open Source Security Game with Mend here

CVE-2026-14257

Vulnerable Libraries - brace-expansion-5.0.5.tgz, brace-expansion-1.1.11.tgz

brace-expansion-5.0.5.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/brace-expansion-npm-5.0.5-b81f6c30d6-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • graphql-config-5.1.6.tgz
      • minimatch-10.2.5.tgz
        • ❌ brace-expansion-5.0.5.tgz (Vulnerable Library)

brace-expansion-1.1.11.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/brace-expansion-npm-1.1.11-fb95eb05ad-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • serve-handler-6.1.7.tgz
        • minimatch-3.1.5.tgz
          • ❌ brace-expansion-1.1.11.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Publish Date: 2026-07-23

URL: CVE-2026-14257

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-07-23

Fix Resolution: brace-expansion - 5.0.8,https://github.com/juliangruber/brace-expansion.git - v5.0.8

Step up your Open Source Security Game with Mend here

CVE-2026-13311

Vulnerable Library - shell-quote-1.8.3.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/shell-quote-npm-1.8.3-b29f851134-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • webpack-dev-server-5.2.2.tgz
        • launch-editor-2.12.0.tgz
          • ❌ shell-quote-1.8.3.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.

Publish Date: 2026-06-25

URL: CVE-2026-13311

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-395f-4hp3-45gv

Release Date: 2026-06-25

Fix Resolution: shell-quote - 1.9.0

Step up your Open Source Security Game with Mend here

CVE-2026-13149

Vulnerable Libraries - brace-expansion-5.0.5.tgz, brace-expansion-1.1.11.tgz

brace-expansion-5.0.5.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/brace-expansion-npm-5.0.5-b81f6c30d6-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • graphql-config-5.1.6.tgz
      • minimatch-10.2.5.tgz
        • ❌ brace-expansion-5.0.5.tgz (Vulnerable Library)

brace-expansion-1.1.11.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/brace-expansion-npm-1.1.11-fb95eb05ad-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • serve-handler-6.1.7.tgz
        • minimatch-3.1.5.tgz
          • ❌ brace-expansion-1.1.11.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

Publish Date: 2026-06-30

URL: CVE-2026-13149

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-30

Fix Resolution: https://github.com/juliangruber/brace-expansion.git - v5.0.7

Step up your Open Source Security Game with Mend here

CVE-2025-59343

Vulnerable Library - tar-fs-3.0.4.tgz

Library home page: https://registry.npmjs.org/tar-fs/-/tar-fs-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/tar-fs-npm-3.0.4-fa3da2e321-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • plugin-ideal-image-3.10.1.tgz
      • sharp-0.32.6.tgz
        • ❌ tar-fs-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.

Publish Date: 2025-09-24

URL: CVE-2025-59343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vj76-c3g6-qr5v

Release Date: 2025-09-24

Fix Resolution: tar-fs - 3.1.1,tar-fs - 2.1.4,tar-fs - 1.16.6

Step up your Open Source Security Game with Mend here

CVE-2025-48387

Vulnerable Library - tar-fs-3.0.4.tgz

Library home page: https://registry.npmjs.org/tar-fs/-/tar-fs-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/tar-fs-npm-3.0.4-fa3da2e321-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • plugin-ideal-image-3.10.1.tgz
      • sharp-0.32.6.tgz
        • ❌ tar-fs-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.

Publish Date: 2025-06-02

URL: CVE-2025-48387

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cj5-5rvv-wf4v

Release Date: 2025-06-02

Fix Resolution: tar-fs - 1.16.5,https://github.com/mafintosh/tar-fs.git - v3.0.9,https://github.com/mafintosh/tar-fs.git - v1.16.5,tar-fs - 3.0.9,tar-fs - 2.1.3,https://github.com/mafintosh/tar-fs.git - v2.1.3

Step up your Open Source Security Game with Mend here

CVE-2024-45296

Vulnerable Library - path-to-regexp-1.8.0.tgz

Express style path to RegExp utility

Library home page: https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.8.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/path-to-regexp-npm-1.8.0-a1904f5c44-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • react-router-5.3.4.tgz
        • ❌ path-to-regexp-1.8.0.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

Publish Date: 2024-09-09

URL: CVE-2024-45296

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9wv6-86v2-598j

Release Date: 2024-09-09

Fix Resolution: path-to-regexp - 0.1.10,1.9.0,3.3.0,6.3.0,8.0.0

Step up your Open Source Security Game with Mend here

CVE-2024-12905

Vulnerable Library - tar-fs-3.0.4.tgz

Library home page: https://registry.npmjs.org/tar-fs/-/tar-fs-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/tar-fs-npm-3.0.4-fa3da2e321-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • plugin-ideal-image-3.10.1.tgz
      • sharp-0.32.6.tgz
        • ❌ tar-fs-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.
This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.

Publish Date: 2025-03-27

URL: CVE-2024-12905

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-03-27

Fix Resolution: https://github.com/mafintosh/tar-fs.git - v2.1.2,tar-fs - 3.0.8,tar-fs - 1.16.4,https://github.com/mafintosh/tar-fs.git - v1.16.4,tar-fs - 2.1.2,https://github.com/mafintosh/tar-fs.git - v3.0.8

Step up your Open Source Security Game with Mend here

CVE-2026-45149

Vulnerable Library - brace-expansion-5.0.5.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/brace-expansion-npm-5.0.5-b81f6c30d6-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • graphql-config-5.1.6.tgz
      • minimatch-10.2.5.tgz
        • ❌ brace-expansion-5.0.5.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.

Publish Date: 2026-05-29

URL: CVE-2026-45149

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-18

Fix Resolution: https://github.com/juliangruber/brace-expansion.git - v5.0.6

Step up your Open Source Security Game with Mend here

CVE-2026-33750

Vulnerable Library - brace-expansion-1.1.11.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/brace-expansion-npm-1.1.11-fb95eb05ad-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • serve-handler-6.1.7.tgz
        • minimatch-3.1.5.tgz
          • ❌ brace-expansion-1.1.11.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., "{1..2..0}") causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to "expand()" to ensure a step value of "0" is not used.

Publish Date: 2026-03-27

URL: CVE-2026-33750

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-27

Fix Resolution: https://github.com/juliangruber/brace-expansion.git - v5.0.5,https://github.com/juliangruber/brace-expansion.git - v1.1.13,https://github.com/juliangruber/brace-expansion.git - v3.0.2,https://github.com/juliangruber/brace-expansion.git - v2.0.3

Step up your Open Source Security Game with Mend here

CVE-2026-34043

Vulnerable Library - serialize-javascript-6.0.2.tgz

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/serialize-javascript-npm-6.0.2-cc09461d45-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • plugin-ideal-image-3.10.1.tgz
      • webpack-5.105.0.tgz
        • terser-webpack-plugin-5.3.16.tgz
          • ❌ serialize-javascript-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.

Publish Date: 2026-03-31

URL: CVE-2026-34043

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-03-28

Fix Resolution: https://github.com/yahoo/serialize-javascript.git - v7.0.5

Step up your Open Source Security Game with Mend here

CVE-2026-54490

Vulnerable Library - websocket-driver-0.7.4.tgz

WebSocket protocol handler with pluggable I/O

Library home page: https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/websocket-driver-npm-0.7.4-a72739da70-10c0.zip

Dependency Hierarchy:

  • doc-site-0.0.0.tgz (Root Library)
    • core-3.10.1.tgz
      • webpack-dev-server-5.2.2.tgz
        • sockjs-0.3.24.tgz
          • ❌ websocket-driver-0.7.4.tgz (Vulnerable Library)

Found in HEAD commit: da0c9c84fdbc82b3b8e2221482a86225136e26be

Found in base branch: main

Vulnerability Details

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.

Publish Date: 2026-07-17

URL: CVE-2026-54490

CVSS 3 Score Details (5.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-mp7j-qc5w-4988

Release Date: 2026-07-15

Fix Resolution: websocket-driver - 0.7.5

Step up your Open Source Security Game with Mend here

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by WhiteSource

    Type

    No type

    Projects

    Intercode
    Status
    Inbox

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions