Security vulnerabilities and automated fixes for dependency security issues
47 posts found
CVE-2026-53486 is a critical path traversal vulnerability in the Decompress library, where crafted archive entries can write files and symbolic links outside the intended extraction directory. This vulnerability was transitively introduced through `@vitest/browser` and related packages pinned at version 4.1.5, and was resolved by upgrading to 4.1.6 and 5.0.0-beta.3. Left unpatched, an attacker who controls an archive file processed by any downstream consumer of this dependency chain could overwr
CVE-2026-15074 is a high-severity path traversal vulnerability in `@fastify/static` versions prior to 10.1.1 that allowed remote attackers to bypass route guards by manipulating URL paths. The fix upgrades the package from 9.3.0 to 10.1.1, closing the path traversal vector that could expose protected routes and sensitive files. Because this plugin runs in a production web service handling real user requests, the risk of exploitation was assessed as likely.
A critical command injection vulnerability (CVE-2026-9277) in shell-quote 1.8.3 allowed attackers to achieve arbitrary code execution by injecting unescaped line terminators into shell-parsed strings. The fix upgrades shell-quote to 1.8.4, which properly escapes these characters before they reach shell interpretation. Because this dependency appeared in production code—not just dev tooling—any user-influenced input flowing through shell-quote was a live attack surface.
CVE-2026-47429 is a critical path traversal vulnerability in Vitest's UI server that allows unauthenticated attackers to read and execute arbitrary files on the host system when the UI server is active. The vulnerability was fixed by upgrading Vitest from the vulnerable `^4.0.0` range to the pinned safe release `4.1.0`. Any project running Vitest's UI mode during development or CI is potentially exposed until this upgrade is applied.
A critical command injection vulnerability (CVE-2026-9277) was discovered in shell-quote 1.8.3, where unescaped line terminators could allow arbitrary code execution by bypassing the library's shell argument quoting logic. The fix upgrades shell-quote to version 1.8.4 and pins the dependency via a package.json override to ensure the patched version is consistently resolved across the dependency tree. This matters because shell-quote is widely used in Node.js tooling to safely construct shell com
A path traversal vulnerability in PostCSS versions before 8.5.18 allowed malicious `sourceMappingURL` comments in CSS files to trick PostCSS into loading arbitrary `.map` files from the filesystem. The fix upgrades PostCSS from 8.5.15 to 8.5.18 in `frontend/package-lock.json` and pins the version via an override in `frontend/package.json`, closing the file disclosure vector before it could be chained with other weaknesses.
CVE-2026-44705 is a high-severity path traversal vulnerability in the Node.js `tmp` package where unsanitized `prefix` and `postfix` options allow attackers to escape the intended temporary directory. Three separate nested copies of `tmp` — versions `0.0.28` and `0.2.7` pinned under `can-symlink`, `broccoli`, and `ember-template-recast` — were removed from `package-lock.json` and replaced by a single patched `0.2.6` resolution. The fix eliminates the directory-escape attack surface while leaving
A path traversal vulnerability in PostCSS versions prior to 8.5.x allowed attackers to craft malicious CSS with attacker-controlled `sourceMappingURL` comments, causing PostCSS to read arbitrary `.map` files from the filesystem and potentially disclose sensitive information. The fix upgrades PostCSS from `8.4.47` to `8.5.23` in `packages/devtools/package-lock.json`, closing the auto-loading attack surface entirely. This change is scoped to the devtools build toolchain but is critical for any env
CVE-2025-7783 is a critical vulnerability in the `form-data` npm package caused by its use of an unsafe random function to generate multipart form boundaries. Versions 2.3.3 and 4.0.5 were affected, and the fix upgrades the package to 4.0.6 (consolidating previously split nested versions) while eliminating the predictable boundary generation. Attackers who could predict or influence multipart boundaries could craft malicious payloads that escape intended field boundaries.
A high-severity prototype pollution vulnerability (CVE-2021-43138) was discovered in the `async` npm package versions prior to 3.2.2, affecting the `node-red-contrib-opcua` project. By exploiting crafted input passed through async's utility functions, an attacker could corrupt JavaScript's `Object.prototype`, potentially enabling privilege escalation or remote code execution. Upgrading `async` from `3.2.1` to `^3.2.2` in both `package.json` and `package-lock.json` eliminates the attack surface e
CVE-2025-7783 exposes a critical vulnerability in the form-data library where unsafe random number generation was used for generating multipart form boundaries, potentially allowing attackers to predict boundary values and manipulate form data. The fix upgrades form-data to versions 4.0.6, 3.0.4, and 2.5.4, which implement proper cryptographic randomness and update security-critical dependencies like hasown and mime-types.
CVE-2026-25896 is a critical Cross-Site Scripting vulnerability in the `fast-xml-parser` npm package caused by improper handling of DOCTYPE entity declarations. The flaw was discovered in the `mail-worker` service's dependency tree and patched by upgrading to version 5.3.5/4.5.4 and enforcing the fix via a pnpm override to `5.7.0`. Left unpatched, this vulnerability could allow attackers to inject malicious scripts through crafted XML payloads processed by the mail pipeline.