Security vulnerabilities and automated fixes for trivy issues
2 posts found
CVE-2026-25639 is a high-severity prototype pollution vulnerability in axios versions ≤1.13.2 that allowed attackers to cause denial of service by injecting a `__proto__` key into configuration objects. The fix upgrades axios to 1.18.0 in `client/package.json`, eliminating the unsafe object merge behavior that made the application vulnerable.
CVE-2026-9277 is a critical command injection vulnerability in shell-quote 1.8.3 that allows attackers to execute arbitrary code through unescaped line terminators. The fix upgrades to version 1.9.0, which properly escapes these characters and prevents shell command manipulation.