|
cve="GHSA-w9j2-pvgh-6h63"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.1"
recommendation=""
severity="moderate"
title="Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy"
url="https://github.com/advisories/GHSA-w9j2-pvgh-6h63"
|
0
|
|
cve="GHSA-pmwg-cvhr-8vh7"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.1"
recommendation=""
severity="high"
title="Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0"
url="https://github.com/advisories/GHSA-pmwg-cvhr-8vh7"
|
0
|
|
cve="GHSA-3w6x-2g7m-8v23"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.2"
recommendation=""
severity="moderate"
title="Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`"
url="https://github.com/advisories/GHSA-3w6x-2g7m-8v23"
|
0
|
|
cve="GHSA-xhjh-pmcv-23jw"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.1"
recommendation=""
severity="low"
title="Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams"
url="https://github.com/advisories/GHSA-xhjh-pmcv-23jw"
|
0
|
|
cve="GHSA-445q-vr5w-6q77"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.1"
recommendation=""
severity="moderate"
title="Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream"
url="https://github.com/advisories/GHSA-445q-vr5w-6q77"
|
0
|
|
cve="GHSA-m7pr-hjqh-92cm"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.1"
recommendation=""
severity="moderate"
title="Axios: no_proxy bypass via IP alias allows SSRF"
url="https://github.com/advisories/GHSA-m7pr-hjqh-92cm"
|
0
|
|
cve="GHSA-5c9x-8gcm-mpgx"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.1"
recommendation=""
severity="moderate"
title="Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0"
url="https://github.com/advisories/GHSA-5c9x-8gcm-mpgx"
|
0
|
|
cve="GHSA-vf2m-468p-8v99"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.1"
recommendation=""
severity="moderate"
title="Axios: HTTP adapter streamed responses bypass maxContentLength"
url="https://github.com/advisories/GHSA-vf2m-468p-8v99"
|
0
|
|
cve="GHSA-pf86-5x62-jrwf"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.1"
recommendation=""
severity="high"
title="Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking"
url="https://github.com/advisories/GHSA-pf86-5x62-jrwf"
|
0
|
|
cve="GHSA-6chq-wfr3-2hj9"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.1"
recommendation=""
severity="high"
title="Axios: Header Injection via Prototype Pollution"
url="https://github.com/advisories/GHSA-6chq-wfr3-2hj9"
|
0
|
|
cve="GHSA-xx6v-rp6x-q39c"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.1"
recommendation=""
severity="moderate"
title="Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion"
url="https://github.com/advisories/GHSA-xx6v-rp6x-q39c"
|
0
|
|
cve="GHSA-q8qp-cvcw-x6jj"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.2"
recommendation=""
severity="high"
title="Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking"
url="https://github.com/advisories/GHSA-q8qp-cvcw-x6jj"
|
0
|
|
cve="GHSA-w5hq-g745-h8pq"
instance="gaeko-ui"
job="npm_audit"
package="uuid"
patched_versions=">=11.1.1"
recommendation=""
severity="moderate"
title="uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided"
url="https://github.com/advisories/GHSA-w5hq-g745-h8pq"
|
0
|
|
cve="GHSA-49rj-9fvp-4h2h"
instance="gaeko-ui"
job="npm_audit"
package="react-router"
patched_versions=">=7.14.2"
recommendation=""
severity="high"
title="React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE"
url="https://github.com/advisories/GHSA-49rj-9fvp-4h2h"
|
0
|
|
cve="GHSA-8x6r-g9mw-2r78"
instance="gaeko-ui"
job="npm_audit"
package="react-router"
patched_versions=">=7.15.0"
recommendation=""
severity="high"
title="React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint"
url="https://github.com/advisories/GHSA-8x6r-g9mw-2r78"
|
0
|
|
cve="GHSA-62hf-57xw-28j9"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.1"
recommendation=""
severity="moderate"
title="Axios: unbounded recursion in toFormData causes DoS via deeply nested request data"
url="https://github.com/advisories/GHSA-62hf-57xw-28j9"
|
0
|
|
cve="GHSA-hfxv-24rg-xrqf"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.16.0"
recommendation=""
severity="high"
title="Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection"
url="https://github.com/advisories/GHSA-hfxv-24rg-xrqf"
|
0
|
|
cve="GHSA-777c-7fjr-54vf"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.16.0"
recommendation=""
severity="high"
title="Allocation of Resources Without Limits or Throttling in Axios"
url="https://github.com/advisories/GHSA-777c-7fjr-54vf"
|
0
|
|
cve="GHSA-p92q-9vqr-4j8v"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.16.0"
recommendation=""
severity="high"
title="Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter"
url="https://github.com/advisories/GHSA-p92q-9vqr-4j8v"
|
0
|
|
cve="GHSA-j5f8-grm9-p9fc"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.16.0"
recommendation=""
severity="high"
title="Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection"
url="https://github.com/advisories/GHSA-j5f8-grm9-p9fc"
|
0
|
|
cve="GHSA-3g43-6gmg-66jw"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.15.2"
recommendation=""
severity="high"
title="axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge"
url="https://github.com/advisories/GHSA-3g43-6gmg-66jw"
|
0
|
|
cve="GHSA-35jp-ww65-95wh"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.16.0"
recommendation=""
severity="high"
title="axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`"
url="https://github.com/advisories/GHSA-35jp-ww65-95wh"
|
0
|
|
cve="GHSA-898c-q2cr-xwhg"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.16.0"
recommendation=""
severity="moderate"
title="axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions"
url="https://github.com/advisories/GHSA-898c-q2cr-xwhg"
|
0
|
|
cve="GHSA-v6wh-96g9-6wx3"
instance="gaeko-ui"
job="npm_audit"
package="vite"
patched_versions=">=8.0.16"
recommendation=""
severity="moderate"
title="launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows"
url="https://github.com/advisories/GHSA-v6wh-96g9-6wx3"
|
0
|
|
cve="GHSA-84g9-w2xq-vcv6"
instance="gaeko-ui"
job="npm_audit"
package="react-router"
patched_versions=">=7.15.1"
recommendation=""
severity="low"
title="React Router: Potential CSRF via PUT/PATCH/DELETE document requests"
url="https://github.com/advisories/GHSA-84g9-w2xq-vcv6"
|
0
|
|
cve="GHSA-fx2h-pf6j-xcff"
instance="gaeko-ui"
job="npm_audit"
package="vite"
patched_versions=">=8.0.16"
recommendation=""
severity="high"
title="vite: `server.fs.deny` bypass on Windows alternate paths"
url="https://github.com/advisories/GHSA-fx2h-pf6j-xcff"
|
0
|
|
cve="GHSA-xcpc-8h2w-3j85"
instance="gaeko-ui"
job="npm_audit"
package="adm-zip"
patched_versions=">=0.6.0"
recommendation=""
severity="high"
title="adm-zip: Crafted ZIP file triggers 4GB memory allocation"
url="https://github.com/advisories/GHSA-xcpc-8h2w-3j85"
|
0
|
|
cve="GHSA-pjwm-pj3p-43mv"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.16.0"
recommendation=""
severity="high"
title="axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)"
url="https://github.com/advisories/GHSA-pjwm-pj3p-43mv"
|
0
|
|
cve="GHSA-wrjc-x8rr-h8h6"
instance="gaeko-ui"
job="npm_audit"
package="react-router"
patched_versions=">=7.18.0"
recommendation=""
severity="moderate"
title="React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)"
url="https://github.com/advisories/GHSA-wrjc-x8rr-h8h6"
|
0
|
|
cve="GHSA-h8fp-f39c-q6mh"
instance="gaeko-ui"
job="npm_audit"
package="react-router"
patched_versions=">=7.18.0"
recommendation=""
severity="moderate"
title="React Router: RSCErrorHandler Missing Protocol Validation (XSS)"
url="https://github.com/advisories/GHSA-h8fp-f39c-q6mh"
|
0
|
|
cve="GHSA-337j-9hxr-rhxg"
instance="gaeko-ui"
job="npm_audit"
package="react-router"
patched_versions=">=7.18.0"
recommendation=""
severity="moderate"
title="React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration"
url="https://github.com/advisories/GHSA-337j-9hxr-rhxg"
|
0
|
|
cve="GHSA-chx6-hx7r-mcp5"
instance="gaeko-ui"
job="npm_audit"
package="react-router"
patched_versions=">=7.18.0"
recommendation=""
severity="high"
title="React Router: Unauthenticated Denial of Service via Inefficient Route Matching"
url="https://github.com/advisories/GHSA-chx6-hx7r-mcp5"
|
0
|
|
cve="GHSA-mh99-v99m-4gvg"
instance="gaeko-ui"
job="npm_audit"
package="brace-expansion"
patched_versions=">=1.1.17"
recommendation=""
severity="high"
title="brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash"
url="https://github.com/advisories/GHSA-mh99-v99m-4gvg"
|
0
|
|
cve="GHSA-7p8r-x3mc-p8w7"
instance="gaeko-ui"
job="npm_audit"
package="fast-uri"
patched_versions=">=3.1.5"
recommendation=""
severity="high"
title="fast-uri vulnerable to host confusion via backslash authority introducer"
url="https://github.com/advisories/GHSA-7p8r-x3mc-p8w7"
|
0
|
|
cve="GHSA-rgw5-rvv9-x895"
instance="gaeko-ui"
job="npm_audit"
package="brace-expansion"
patched_versions=">=5.0.9"
recommendation=""
severity="high"
title="brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
url="https://github.com/advisories/GHSA-rgw5-rvv9-x895"
|
0
|
|
cve="GHSA-rgw5-rvv9-x895"
instance="gaeko-ui"
job="npm_audit"
package="brace-expansion"
patched_versions=">=1.1.18"
recommendation=""
severity="high"
title="brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
url="https://github.com/advisories/GHSA-rgw5-rvv9-x895"
|
0
|
|
cve="GHSA-5p4m-2wfm-xmqj"
instance="gaeko-ui"
job="npm_audit"
package="js-yaml"
patched_versions=">=4.3.1"
recommendation=""
severity="high"
title="JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported"
url="https://github.com/advisories/GHSA-5p4m-2wfm-xmqj"
|
0
|
|
cve="GHSA-qwww-vcr4-c8h2"
instance="gaeko-ui"
job="npm_audit"
package="react-router"
patched_versions=">=7.18.2"
recommendation=""
severity="high"
title="React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response"
url="https://github.com/advisories/GHSA-qwww-vcr4-c8h2"
|
0
|
|
cve="GHSA-2v37-7h3g-55p8"
instance="gaeko-ui"
job="npm_audit"
package="nanoid"
patched_versions=">=3.3.18"
recommendation=""
severity="high"
title="nanoid: custom generators can loop indefinitely when size is zero"
url="https://github.com/advisories/GHSA-2v37-7h3g-55p8"
|
0
|
|
cve="GHSA-mmx7-hfxf-jppx"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.18.0"
recommendation=""
severity="moderate"
title="Axios: Prototype pollution gadgets can alter axios request construction"
url="https://github.com/advisories/GHSA-mmx7-hfxf-jppx"
|
0
|
|
cve="GHSA-pmv8-rq9r-6j72"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.18.0"
recommendation=""
severity="moderate"
title="Axios: Deep formToJSON Key Recursion Can Cause Denial of Service"
url="https://github.com/advisories/GHSA-pmv8-rq9r-6j72"
|
0
|
|
cve="GHSA-mwf2-3pr3-8698"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.18.0"
recommendation=""
severity="moderate"
title="Axios: HTTP/2 streamed uploads bypass `maxBodyLength`"
url="https://github.com/advisories/GHSA-mwf2-3pr3-8698"
|
0
|
|
cve="GHSA-7q8q-rj6j-mhjq"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.18.0"
recommendation=""
severity="moderate"
title="Axios: Nested axios option objects can consume polluted prototype values"
url="https://github.com/advisories/GHSA-7q8q-rj6j-mhjq"
|
0
|
|
cve="GHSA-jqh4-m9w3-8hp9"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.18.0"
recommendation=""
severity="moderate"
title="Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`"
url="https://github.com/advisories/GHSA-jqh4-m9w3-8hp9"
|
0
|
|
cve="GHSA-f4gw-2p7v-4548"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.18.0"
recommendation=""
severity="moderate"
title="Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios"
url="https://github.com/advisories/GHSA-f4gw-2p7v-4548"
|
0
|
|
cve="GHSA-42h9-826w-cgv3"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.18.0"
recommendation=""
severity="moderate"
title="Axios: Excessive recursion in formDataToJSON can cause denial of service"
url="https://github.com/advisories/GHSA-42h9-826w-cgv3"
|
0
|
|
cve="GHSA-5jgf-p345-68v8"
instance="gaeko-ui"
job="npm_audit"
package="fast-uri"
patched_versions=">=3.1.6"
recommendation=""
severity="high"
title="fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references"
url="https://github.com/advisories/GHSA-5jgf-p345-68v8"
|
0
|
|
cve="GHSA-f65p-4m7j-42xc"
instance="gaeko-ui"
job="npm_audit"
package="fast-uri"
patched_versions=">=3.1.6"
recommendation=""
severity="high"
title="fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization"
url="https://github.com/advisories/GHSA-f65p-4m7j-42xc"
|
0
|
|
cve="GHSA-fph4-wmhf-6fwf"
instance="gaeko-ui"
job="npm_audit"
package="fast-uri"
patched_versions=">=3.1.6"
recommendation=""
severity="high"
title="fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding"
url="https://github.com/advisories/GHSA-fph4-wmhf-6fwf"
|
0
|
|
cve="GHSA-jqff-g426-hqxp"
instance="gaeko-ui"
job="npm_audit"
package="fast-uri"
patched_versions=">=3.1.6"
recommendation=""
severity="high"
title="fast-uri vulnerable to host confusion via percent-encoded scheme normalization"
url="https://github.com/advisories/GHSA-jqff-g426-hqxp"
|
0
|
|
cve="GHSA-2wm5-q62r-hmrv"
instance="gaeko-ui"
job="npm_audit"
package="colord"
patched_versions=">=2.9.4"
recommendation=""
severity="moderate"
title="Colord: Slow rejection of oversized malformed color strings"
url="https://github.com/advisories/GHSA-2wm5-q62r-hmrv"
|
0
|
|
cve="GHSA-82fw-gwwq-j7x9"
instance="gaeko-ui"
job="npm_audit"
package="vitest"
patched_versions=">=4.1.11"
recommendation=""
severity="moderate"
title="Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock"
url="https://github.com/advisories/GHSA-82fw-gwwq-j7x9"
|
0
|
|
cve="GHSA-82fw-gwwq-j7x9"
instance="gaeko-ui"
job="npm_audit"
package="@vitest/mocker"
patched_versions=">=4.1.11"
recommendation=""
severity="moderate"
title="Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock"
url="https://github.com/advisories/GHSA-82fw-gwwq-j7x9"
|
0
|
|
cve="GHSA-w5vr-8v7q-w6rv"
instance="gaeko-ui"
job="npm_audit"
package="baseline-browser-mapping"
patched_versions=">=2.11.0"
recommendation=""
severity="moderate"
title="baseline-browser-mapping process termination on invalid input causes denial of service"
url="https://github.com/advisories/GHSA-w5vr-8v7q-w6rv"
|
0
|
|
cve="GHSA-2883-xcg3-v3hh"
instance="gaeko-ui"
job="npm_audit"
package="js-yaml"
patched_versions=">=4.3.2"
recommendation=""
severity="high"
title="js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources"
url="https://github.com/advisories/GHSA-2883-xcg3-v3hh"
|
0
|
|
cve="GHSA-vwc7-r8mq-g2x9"
instance="gaeko-ui"
job="npm_audit"
package="adm-zip"
patched_versions=">=0.6.1"
recommendation=""
severity="moderate"
title="adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite"
url="https://github.com/advisories/GHSA-vwc7-r8mq-g2x9"
|
0
|
|
cve="GHSA-7q85-xj36-vmfc"
instance="gaeko-ui"
job="npm_audit"
package="adm-zip"
patched_versions=">=0.6.1"
recommendation=""
severity="high"
title="adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)"
url="https://github.com/advisories/GHSA-7q85-xj36-vmfc"
|
0
|
|
cve="GHSA-3wwx-pv8p-q78v"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.29.1"
recommendation=""
severity="moderate"
title="undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression"
url="https://github.com/advisories/GHSA-3wwx-pv8p-q78v"
|
0
|
|
cve="GHSA-qw65-cvwx-89v3"
instance="gaeko-ui"
job="npm_audit"
package="fast-uri"
patched_versions=">=3.1.7"
recommendation=""
severity="high"
title="fast-uri vulnerable to authority injection via an unvalidated port in serialize"
url="https://github.com/advisories/GHSA-qw65-cvwx-89v3"
|
0
|
|
cve="GHSA-rcw4-f5rp-g42v"
instance="gaeko-ui"
job="npm_audit"
package="adm-zip"
patched_versions=">=0.6.1"
recommendation=""
severity="high"
title="adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0"
url="https://github.com/advisories/GHSA-rcw4-f5rp-g42v"
|
0
|
|
cve="GHSA-j5f4-cc29-5x44"
instance="gaeko-ui"
job="npm_audit"
package="adm-zip"
patched_versions=">=0.6.1"
recommendation=""
severity="high"
title="adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation"
url="https://github.com/advisories/GHSA-j5f4-cc29-5x44"
|
0
|
|
cve="GHSA-pmjh-fq2x-6v4x"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.29.1"
recommendation=""
severity="moderate"
title="undici vulnerable to Denial of Service via orphaned RetryHandler response body"
url="https://github.com/advisories/GHSA-pmjh-fq2x-6v4x"
|
0
|
|
cve="GHSA-r53p-7pc4-xj5r"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.29.1"
recommendation=""
severity="low"
title="undici vulnerable to downstream response splitting via retry interceptor"
url="https://github.com/advisories/GHSA-r53p-7pc4-xj5r"
|
0
|
|
cve="GHSA-rfgv-xxqx-mfg5"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.29.1"
recommendation=""
severity="high"
title="undici vulnerable to Denial of Service via unrequested WebSocket subprotocol"
url="https://github.com/advisories/GHSA-rfgv-xxqx-mfg5"
|
0
|
|
cve="GHSA-3xpg-4rpp-hhhm"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.29.1"
recommendation=""
severity="moderate"
title="undici vulnerable to Denial of Service via unbounded decompression of compressed responses"
url="https://github.com/advisories/GHSA-3xpg-4rpp-hhhm"
|
0
|
|
cve="GHSA-2jfj-6hjv-fm6j"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.29.1"
recommendation=""
severity="moderate"
title="undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches"
url="https://github.com/advisories/GHSA-2jfj-6hjv-fm6j"
|
0
|
|
cve="GHSA-2gqq-gqf2-x968"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.29.1"
recommendation=""
severity="low"
title="undici vulnerable to response truncation via oversized chunked responses in the dump interceptor"
url="https://github.com/advisories/GHSA-2gqq-gqf2-x968"
|
0
|
|
cve="GHSA-w293-vg96-wgc3"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.29.1"
recommendation=""
severity="high"
title="undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool"
url="https://github.com/advisories/GHSA-w293-vg96-wgc3"
|
0
|
|
cve="GHSA-8436-99hf-9mmv"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.29.1"
recommendation=""
severity="low"
title="undici vulnerable to caching and replay of unsafe HTTP method responses"
url="https://github.com/advisories/GHSA-8436-99hf-9mmv"
|
0
|
|
cve="GHSA-rx4f-c7p8-82vq"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.29.1"
recommendation=""
severity="moderate"
title="undici vulnerable to Denial of Service via WebSocketStream unclean close"
url="https://github.com/advisories/GHSA-rx4f-c7p8-82vq"
|
0
|
|
cve="GHSA-p634-w6r4-rjp2"
instance="gaeko-ui"
job="npm_audit"
package="adm-zip"
patched_versions=">=0.6.1"
recommendation=""
severity="moderate"
title="adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content"
url="https://github.com/advisories/GHSA-p634-w6r4-rjp2"
|
0
|
|
cve="GHSA-c6fg-446q-cg94"
instance="gaeko-ui"
job="npm_audit"
package="adm-zip"
patched_versions=">=0.6.1"
recommendation=""
severity="moderate"
title="adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path"
url="https://github.com/advisories/GHSA-c6fg-446q-cg94"
|
0
|
|
cve="GHSA-8238-w5pm-2374"
instance="gaeko-ui"
job="npm_audit"
package="adm-zip"
patched_versions=">=0.6.1"
recommendation=""
severity="high"
title="adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)"
url="https://github.com/advisories/GHSA-8238-w5pm-2374"
|
0
|
|
cve="GHSA-hrr3-gc8f-f4qj"
instance="gaeko-ui"
job="npm_audit"
package="fast-uri"
patched_versions=">=3.1.8"
recommendation=""
severity="moderate"
title="fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets"
url="https://github.com/advisories/GHSA-hrr3-gc8f-f4qj"
|
0
|
|
cve="GHSA-q2hr-2g5m-vwhr"
instance="gaeko-ui"
job="npm_audit"
package="brace-expansion"
patched_versions=">=1.1.21"
recommendation=""
severity="moderate"
title="brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service"
url="https://github.com/advisories/GHSA-q2hr-2g5m-vwhr"
|
0
|
|
cve="GHSA-q2hr-2g5m-vwhr"
instance="gaeko-ui"
job="npm_audit"
package="brace-expansion"
patched_versions=">=5.0.12"
recommendation=""
severity="moderate"
title="brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service"
url="https://github.com/advisories/GHSA-q2hr-2g5m-vwhr"
|
0
|
|
cve="GHSA-qhr7-859c-m2p7"
instance="gaeko-ui"
job="npm_audit"
package="brace-expansion"
patched_versions=">=1.1.20"
recommendation=""
severity="high"
title="brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion"
url="https://github.com/advisories/GHSA-qhr7-859c-m2p7"
|
0
|
|
cve="GHSA-qhr7-859c-m2p7"
instance="gaeko-ui"
job="npm_audit"
package="brace-expansion"
patched_versions=">=5.0.11"
recommendation=""
severity="high"
title="brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion"
url="https://github.com/advisories/GHSA-qhr7-859c-m2p7"
|
0
|
|
cve="GHSA-6j4f-fj2g-mc7p"
instance="gaeko-ui"
job="npm_audit"
package="brace-expansion"
patched_versions=">=1.1.19"
recommendation=""
severity="high"
title="brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion"
url="https://github.com/advisories/GHSA-6j4f-fj2g-mc7p"
|
0
|
|
cve="GHSA-6j4f-fj2g-mc7p"
instance="gaeko-ui"
job="npm_audit"
package="brace-expansion"
patched_versions=">=5.0.10"
recommendation=""
severity="high"
title="brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion"
url="https://github.com/advisories/GHSA-6j4f-fj2g-mc7p"
|
0
|
|
cve="GHSA-vh66-26gq-q6x8"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.20.0"
recommendation=""
severity="moderate"
title="Axios: Prototype pollution gadget in fetch adapter can alter outbound requests"
url="https://github.com/advisories/GHSA-vh66-26gq-q6x8"
|
0
|
|
cve="GHSA-9fr6-4gfg-395g"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.20.0"
recommendation=""
severity="moderate"
title="Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method"
url="https://github.com/advisories/GHSA-9fr6-4gfg-395g"
|
0
|
|
cve="GHSA-mghh-pgcx-3jjj"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.20.0"
recommendation=""
severity="high"
title="Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location"
url="https://github.com/advisories/GHSA-mghh-pgcx-3jjj"
|
0
|
|
cve="GHSA-3pq3-5fj3-cg6v"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.20.0"
recommendation=""
severity="high"
title="Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls"
url="https://github.com/advisories/GHSA-3pq3-5fj3-cg6v"
|
0
|
|
cve="GHSA-542g-h47m-68v8"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.20.0"
recommendation=""
severity="high"
title="Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization"
url="https://github.com/advisories/GHSA-542g-h47m-68v8"
|
0
|
|
cve="GHSA-j8rh-479h-cp32"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.20.0"
recommendation=""
severity="moderate"
title="Axios: Header Injection via Inherited headers After Minimal Interceptor"
url="https://github.com/advisories/GHSA-j8rh-479h-cp32"
|
0
|
|
cve="GHSA-4hqw-qxg8-jxx2"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.20.0"
recommendation=""
severity="moderate"
title="Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders"
url="https://github.com/advisories/GHSA-4hqw-qxg8-jxx2"
|
0
|
|
cve="GHSA-44g4-m2mj-wpvx"
instance="gaeko-ui"
job="npm_audit"
package="axios"
patched_versions=">=1.20.0"
recommendation=""
severity="moderate"
title="Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges"
url="https://github.com/advisories/GHSA-44g4-m2mj-wpvx"
|
0
|
|
cve="GHSA-86w9-cpqp-85rv"
instance="gaeko-ui"
job="npm_audit"
package="node-forge"
patched_versions=">=1.4.1"
recommendation=""
severity="high"
title="node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements"
url="https://github.com/advisories/GHSA-86w9-cpqp-85rv"
|
0
|
|
cve="GHSA-68fv-2mgg-jv7q"
instance="gaeko-ui"
job="npm_audit"
package="source-map-js"
patched_versions=">=1.2.2"
recommendation=""
severity="high"
title="source-map-js allows event-loop denial of service through indexed source-map section offsets"
url="https://github.com/advisories/GHSA-68fv-2mgg-jv7q"
|
0
|
|
cve="GHSA-q3jh-wrc6-jgq8"
instance="gaeko-ui"
job="npm_audit"
package="follow-redirects"
patched_versions=">=1.16.1"
recommendation=""
severity="high"
title="follow-redirects array-form headers bypass cross-origin credential stripping"
url="https://github.com/advisories/GHSA-q3jh-wrc6-jgq8"
|
0
|
|
cve="GHSA-8r9p-f939-6h3c"
instance="gaeko-ui"
job="npm_audit"
package="follow-redirects"
patched_versions=">=1.16.1"
recommendation=""
severity="high"
title="follow-redirects sensitiveHeaders regex escaping can expose credential headers"
url="https://github.com/advisories/GHSA-8r9p-f939-6h3c"
|
0
|
|
cve="GHSA-698v-4r3x-3vcv"
instance="gaeko-ui"
job="npm_audit"
package="vite"
patched_versions=">=8.1.6"
recommendation=""
severity="moderate"
title="launch-editor: escapeCmdArgs() omits % escaping on Windows"
url="https://github.com/advisories/GHSA-698v-4r3x-3vcv"
|
0
|
|
cve="GHSA-r825-w8mm-5pxw"
instance="gaeko-ui"
job="npm_audit"
package="vite"
patched_versions=">=8.1.6"
recommendation=""
severity="moderate"
title="launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors"
url="https://github.com/advisories/GHSA-r825-w8mm-5pxw"
|
0
|
|
cve="GHSA-587h-7wmj-h5pm"
instance="gaeko-ui"
job="npm_audit"
package="vite"
patched_versions=">=8.1.6"
recommendation=""
severity="high"
title="launch-editor: `fs.existsSync()` existence check can be bypassed on Windows"
url="https://github.com/advisories/GHSA-587h-7wmj-h5pm"
|
0
|
|
cve="GHSA-9jrq-w75r-8gcw"
instance="gaeko-ui"
job="npm_audit"
package="vite"
patched_versions=">=8.1.6"
recommendation=""
severity="low"
title="Vite: Cross origin script execution through Vite custom middleware"
url="https://github.com/advisories/GHSA-9jrq-w75r-8gcw"
|
0
|
|
cve="GHSA-rq7h-c2jc-7f22"
instance="gaeko-ui"
job="npm_audit"
package="vite"
patched_versions=">=8.1.6"
recommendation=""
severity="moderate"
title="Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine"
url="https://github.com/advisories/GHSA-rq7h-c2jc-7f22"
|
0
|
|
cve="GHSA-qxg6-89mg-rqv8"
instance="gaeko-ui"
job="npm_audit"
package="@vitest/mocker"
patched_versions=">=4.1.12"
recommendation=""
severity="moderate"
title="Vitest: Code injection via unauthenticated manual mock registration"
url="https://github.com/advisories/GHSA-qxg6-89mg-rqv8"
|
0
|
|
cve="GHSA-mrhx-c7xc-m3w5"
instance="gaeko-ui"
job="npm_audit"
package="zod"
patched_versions=">=4.6.6"
recommendation=""
severity="high"
title="Zod can exhaust memory while validating oversized constrained collections"
url="https://github.com/advisories/GHSA-mrhx-c7xc-m3w5"
|
0
|
|
cve="GHSA-4qv8-2p9j-2685"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.30.1"
recommendation=""
severity="moderate"
title="undici vulnerable to Denial of Service via unbounded memory in the EventSource parser"
url="https://github.com/advisories/GHSA-4qv8-2p9j-2685"
|
0
|
|
cve="GHSA-f72v-6w45-q472"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.30.1"
recommendation=""
severity="moderate"
title="undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens"
url="https://github.com/advisories/GHSA-f72v-6w45-q472"
|
0
|
|
cve="GHSA-w74x-v6f9-j3xg"
instance="gaeko-ui"
job="npm_audit"
package="fast-uri"
patched_versions=">=3.1.9"
recommendation=""
severity="moderate"
title="fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding"
url="https://github.com/advisories/GHSA-w74x-v6f9-j3xg"
|
0
|
|
cve="GHSA-xhq7-xmqj-769h"
instance="gaeko-ui"
job="npm_audit"
package="fast-uri"
patched_versions=">=3.1.9"
recommendation=""
severity="low"
title="fast-uri vulnerable to improper path equivalence in relative reference normalization"
url="https://github.com/advisories/GHSA-xhq7-xmqj-769h"
|
0
|
|
cve="GHSA-wjr9-j795-jxcr"
instance="gaeko-ui"
job="npm_audit"
package="fast-uri"
patched_versions=">=3.1.9"
recommendation=""
severity="moderate"
title="fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization"
url="https://github.com/advisories/GHSA-wjr9-j795-jxcr"
|
0
|
|
cve="GHSA-333x-w4r6-6crp"
instance="gaeko-ui"
job="npm_audit"
package="fast-uri"
patched_versions=">=3.1.9"
recommendation=""
severity="low"
title="fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references"
url="https://github.com/advisories/GHSA-333x-w4r6-6crp"
|
0
|
|
cve="GHSA-xjj6-f33q-929c"
instance="gaeko-ui"
job="npm_audit"
package="undici"
patched_versions=">=7.30.1"
recommendation=""
severity="high"
title="undici vulnerable to Denial of Service via unhandled error on excessive content-encodings"
url="https://github.com/advisories/GHSA-xjj6-f33q-929c"
|
0
|
|
cve="GHSA-rj75-hqrm-r3gf"
instance="gaeko-ui"
job="npm_audit"
package="postcss-selector-parser"
patched_versions=">=7.1.6"
recommendation=""
severity="moderate"
title="PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion"
url="https://github.com/advisories/GHSA-rj75-hqrm-r3gf"
|
0
|