nodegoat: Findings

Client: Demo client · Prepared by: Unvarnish demo · Generated: 2026-11-14 10:11 UTC
Source: repo https://github.com/OWASP/NodeGoat.git at c5cb68a7084e

Produced by Unvarnish's deterministic scanners. Every finding below is reproducible and traceable to a file and line. Model-assisted analysis was not run for this document.

Executive summary

No model-written text for this section: no model configured.

Summary

164 finding(s): 34 critical, 86 high, 37 medium, 7 low.

120 finding(s) are critical or high severity and need action before this tool is relied on further.

By the numbers

Largest source files

Remediation outlook

Findings by remediation effort: S up to half a day, M up to two days, L up to a week, XL weeks. Scanner findings carry a fixed band per rule; model findings carry the model's band, adjusted by the verifier where it checked the finding. The bands are an input to the consultant's judgment, not a quote.

Findings

Critical (34)

Private key material

security · source: scanner (secrets) · effort: S · id 7a8c5a682b3ae372

Private key material found in artifacts/cert/server.key. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. S: rotate one credential and move it to configuration (scanner rule secrets.credential)

Evidence.

• artifacts/cert/server.key:1 — …[redacted 31 chars] (fingerprint 71960cee9226; also appears in 1 commit(s) in git history)

Hardcoded credential assignment

security · source: scanner (secrets) · effort: S · id e962539144197d1e

Hardcoded credential assignment found in artifacts/db-reset.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. S: rotate one credential and move it to configuration (scanner rule secrets.credential)

Evidence.

• artifacts/db-reset.js:18 — "password": "…[redacted 9 chars]", (fingerprint d07e7c4cce2a; also appears in 2 commit(s) in git history)

Hardcoded credential assignment

security · source: scanner (secrets) · effort: S · id 3946d6a7836769cb

Hardcoded credential assignment found in artifacts/db-reset.js (1 more occurrence(s) with the same value). The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. S: rotate one credential and move it to configuration (scanner rule secrets.credential)

Evidence.

• artifacts/db-reset.js:27 — "password": "…[redacted 9 chars]" (fingerprint b4ea3116d868; also appears in 4 commit(s) in git history)

Hardcoded credential assignment

security · source: scanner (secrets) · effort: S · id 6fb3798154516a9f

Hardcoded credential assignment found in artifacts/db-reset.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. S: rotate one credential and move it to configuration (scanner rule secrets.credential)

Evidence.

• artifacts/db-reset.js:35 — "password": "…[redacted 9 chars]" (fingerprint 5238f6fe78d6; also appears in 2 commit(s) in git history)

Hardcoded credential assignment

security · source: scanner (secrets) · effort: S · id 45d4acc332770fb7

Hardcoded credential assignment found in config/env/all.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. S: rotate one credential and move it to configuration (scanner rule secrets.credential)

Evidence.

• config/env/all.js:8 — cookieSecret: "…[redacted 30 chars]", (fingerprint 6f983a53bf8b; also appears in 1 commit(s) in git history)

Hardcoded credential assignment

security · source: scanner (secrets) · effort: S · id f5a688cb1a6b4647

Hardcoded credential assignment found in config/env/development.js (1 more occurrence(s) with the same value). The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. S: rotate one credential and move it to configuration (scanner rule secrets.credential)

Evidence.

• config/env/development.js:6 — zapApiKey: "…[redacted 26 chars]", (fingerprint e0f1906c2cc8; also appears in 3 commit(s) in git history)

Known vulnerabilities in babel-traverse 6.11.4

dependency · source: scanner (dependencies) · effort: S · id b6c24dac5b455885

1 published advisory affects babel-traverse 6.11.4 (npm), declared in package-lock.json: GHSA-67hx-6x53-jw92: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade babel-traverse to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-67hx-6x53-jw92)

Known vulnerabilities in bson 1.0.9

dependency · source: scanner (dependencies) · effort: S · id afc17a71947119f5

2 published advisories affect bson 1.0.9 (npm), declared in package-lock.json: GHSA-4jwp-vfvf-657p: Deserialization of Untrusted Data in bson; GHSA-v8w9-2789-6hhr: Deserialization of Untrusted Data in bson.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade bson to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-4jwp-vfvf-657p, GHSA-v8w9-2789-6hhr)

Known vulnerabilities in form-data 0.1.4

dependency · source: scanner (dependencies) · effort: S · id fc4e3bf311868841

2 published advisories affect form-data 0.1.4 (npm), declared in package-lock.json: GHSA-fjxv-7rqg-78g4: form-data uses unsafe random function in form-data for choosing boundary; GHSA-hmw2-7cc7-3qxx: form-data: CRLF injection in form-data via unescaped multipart field names and filenames.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade form-data to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx)

Known vulnerabilities in form-data 1.0.1

dependency · source: scanner (dependencies) · effort: S · id 43a89b1479b45f2e

2 published advisories affect form-data 1.0.1 (npm), declared in package-lock.json: GHSA-fjxv-7rqg-78g4: form-data uses unsafe random function in form-data for choosing boundary; GHSA-hmw2-7cc7-3qxx: form-data: CRLF injection in form-data via unescaped multipart field names and filenames.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade form-data to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx)

Known vulnerabilities in form-data 2.0.0

dependency · source: scanner (dependencies) · effort: S · id 26234cf19a4c0382

2 published advisories affect form-data 2.0.0 (npm), declared in package-lock.json: GHSA-fjxv-7rqg-78g4: form-data uses unsafe random function in form-data for choosing boundary; GHSA-hmw2-7cc7-3qxx: form-data: CRLF injection in form-data via unescaped multipart field names and filenames.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade form-data to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx)

Known vulnerabilities in form-data 2.1.4

dependency · source: scanner (dependencies) · effort: S · id 539cf36b66b4d6ed

2 published advisories affect form-data 2.1.4 (npm), declared in package-lock.json: GHSA-fjxv-7rqg-78g4: form-data uses unsafe random function in form-data for choosing boundary; GHSA-hmw2-7cc7-3qxx: form-data: CRLF injection in form-data via unescaped multipart field names and filenames.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade form-data to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx)

Known vulnerabilities in form-data 2.3.3

dependency · source: scanner (dependencies) · effort: S · id ad345d6814cb3fe8

2 published advisories affect form-data 2.3.3 (npm), declared in package-lock.json: GHSA-fjxv-7rqg-78g4: form-data uses unsafe random function in form-data for choosing boundary; GHSA-hmw2-7cc7-3qxx: form-data: CRLF injection in form-data via unescaped multipart field names and filenames.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade form-data to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx)

Known vulnerabilities in fsevents 1.2.9

dependency · source: scanner (dependencies) · effort: S · id f967f58c918b082c

2 published advisories affect fsevents 1.2.9 (npm), declared in package-lock.json: MAL-2023-462: Malicious code in fsevents (npm); GHSA-8r6j-v8pm-fqw3: Code injection in fsevents.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade fsevents to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: MAL-2023-462, GHSA-8r6j-v8pm-fqw3)

Known vulnerabilities in getobject 0.1.0

dependency · source: scanner (dependencies) · effort: S · id d1a35feef651fdd7

1 published advisory affects getobject 0.1.0 (npm), declared in package-lock.json: GHSA-957j-59c2-j692: Prototype pollution in getobject.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade getobject to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-957j-59c2-j692)

Known vulnerabilities in growl 1.9.2

dependency · source: scanner (dependencies) · effort: S · id 5fde59f3fa1ae98b

1 published advisory affects growl 1.9.2 (npm), declared in package-lock.json: GHSA-qh2h-chj9-jffq: Growl before 1.10.0 vulnerable to Command Injection.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade growl to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-qh2h-chj9-jffq)

Known vulnerabilities in handlebars 4.0.5

dependency · source: scanner (dependencies) · effort: S · id 7a3976a6c82cfef4

20 published advisories affect handlebars 4.0.5 (npm), declared in package-lock.json: GHSA-2cf5-4w76-r9qv: Arbitrary Code Execution in handlebars; GHSA-2qvq-rjwj-gvw9: Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection; GHSA-2w6w-674q-4c4q: Handlebars.js has JavaScript Injection via AST Type Confusion; GHSA-3cqr-58rm-57f8: Arbitrary Code Execution in Handlebars; GHSA-3mfm-83xf-c92r: Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block; GHSA-442j-39wm-28r2: Handlebars.js has a Property Access Validation Bypass in container.lookup; GHSA-62gr-4qp9-h98f: Regular Expression Denial of Service in Handlebars; GHSA-765h-qjxv-5f44: Prototype Pollution in handlebars; GHSA-8r5x-fm3f-whwj: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937); GHSA-9cx6-37pm-9jff: Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation; and 10 more.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade handlebars to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-2cf5-4w76-r9qv, GHSA-2qvq-rjwj-gvw9, GHSA-2w6w-674q-4c4q, GHSA-3cqr-58rm-57f8, GHSA-3mfm-83xf-c92r, GHSA-442j-39wm-28r2, GHSA-62gr-4qp9-h98f, GHSA-765h-qjxv-5f44, GHSA-8r5x-fm3f-whwj, GHSA-9cx6-37pm-9jff, GHSA-f2jv-r9rf-7988, GHSA-f52g-6jhx-586p, GHSA-g9r4-xpmj-mj65, GHSA-p8wg-vrv2-v86f, GHSA-q2c6-c6pm-g3gh, GHSA-q42p-pg8m-cqh6, GHSA-w457-6q6x-cgp9, GHSA-xhpv-hc6g-r9c6, GHSA-xjpj-3mr7-gcpf, GHSA-xw65-4hp5-5hc7)

Known vulnerabilities in json-schema 0.2.3

dependency · source: scanner (dependencies) · effort: S · id 8f5f29e64a44e2f3

1 published advisory affects json-schema 0.2.3 (npm), declared in package-lock.json: GHSA-896r-f27r-55mw: json-schema is vulnerable to Prototype Pollution.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade json-schema to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-896r-f27r-55mw)

Known vulnerabilities in lodash 2.4.2

dependency · source: scanner (dependencies) · effort: S · id 6ba969185e8e5c1e

4 published advisories affect lodash 2.4.2 (npm), declared in package-lock.json: GHSA-35jh-r3h4-6jhm: Command Injection in lodash; GHSA-4xc9-xhrj-v574: Prototype Pollution in lodash; GHSA-fvqr-27wr-82fm: Prototype Pollution in lodash; GHSA-jf85-cpcp-j695: Prototype Pollution in lodash.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade lodash to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-35jh-r3h4-6jhm, GHSA-4xc9-xhrj-v574, GHSA-fvqr-27wr-82fm, GHSA-jf85-cpcp-j695)

Known vulnerabilities in lodash 4.13.1

dependency · source: scanner (dependencies) · effort: S · id 606d74f135e303f2

9 published advisories affect lodash 4.13.1 (npm), declared in package-lock.json: GHSA-29mw-wpgm-hmr9: Regular Expression Denial of Service (ReDoS) in lodash; GHSA-35jh-r3h4-6jhm: Command Injection in lodash; GHSA-4xc9-xhrj-v574: Prototype Pollution in lodash; GHSA-fvqr-27wr-82fm: Prototype Pollution in lodash; GHSA-jf85-cpcp-j695: Prototype Pollution in lodash; GHSA-p6mc-m468-83gw: Prototype Pollution in lodash; GHSA-r5fr-rjxr-66jc: lodash vulnerable to Code Injection via _.template imports key names; GHSA-x5rq-j2xg-h7qm: Regular Expression Denial of Service (ReDoS) in lodash; GHSA-xxjr-mmjv-4gpg: Lodash has Prototype Pollution Vulnerability in _.unset, _.omit, and _.pullAt functions.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade lodash to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-29mw-wpgm-hmr9, GHSA-35jh-r3h4-6jhm, GHSA-4xc9-xhrj-v574, GHSA-fvqr-27wr-82fm, GHSA-jf85-cpcp-j695, GHSA-p6mc-m468-83gw, GHSA-r5fr-rjxr-66jc, GHSA-x5rq-j2xg-h7qm, GHSA-xxjr-mmjv-4gpg)

Known vulnerabilities in lodash 4.17.11

dependency · source: scanner (dependencies) · effort: S · id 3f06bf820dc28010

6 published advisories affect lodash 4.17.11 (npm), declared in package-lock.json: GHSA-29mw-wpgm-hmr9: Regular Expression Denial of Service (ReDoS) in lodash; GHSA-35jh-r3h4-6jhm: Command Injection in lodash; GHSA-jf85-cpcp-j695: Prototype Pollution in lodash; GHSA-p6mc-m468-83gw: Prototype Pollution in lodash; GHSA-r5fr-rjxr-66jc: lodash vulnerable to Code Injection via _.template imports key names; GHSA-xxjr-mmjv-4gpg: Lodash has Prototype Pollution Vulnerability in _.unset, _.omit, and _.pullAt functions.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade lodash to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-29mw-wpgm-hmr9, GHSA-35jh-r3h4-6jhm, GHSA-jf85-cpcp-j695, GHSA-p6mc-m468-83gw, GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg)

Known vulnerabilities in minimist 0.0.10

dependency · source: scanner (dependencies) · effort: S · id fd868e83e7290e02

2 published advisories affect minimist 0.0.10 (npm), declared in package-lock.json: GHSA-vh95-rmgr-6w4m: Prototype Pollution in minimist; GHSA-xvch-5gv4-984h: Prototype Pollution in minimist.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade minimist to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-vh95-rmgr-6w4m, GHSA-xvch-5gv4-984h)

Known vulnerabilities in minimist 0.0.8

dependency · source: scanner (dependencies) · effort: S · id cb39b8dc834eb586

2 published advisories affect minimist 0.0.8 (npm), declared in package-lock.json: GHSA-vh95-rmgr-6w4m: Prototype Pollution in minimist; GHSA-xvch-5gv4-984h: Prototype Pollution in minimist.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade minimist to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-vh95-rmgr-6w4m, GHSA-xvch-5gv4-984h)

Known vulnerabilities in minimist 1.2.0

dependency · source: scanner (dependencies) · effort: S · id bf09d326abae8672

2 published advisories affect minimist 1.2.0 (npm), declared in package-lock.json: GHSA-vh95-rmgr-6w4m: Prototype Pollution in minimist; GHSA-xvch-5gv4-984h: Prototype Pollution in minimist.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade minimist to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-vh95-rmgr-6w4m, GHSA-xvch-5gv4-984h)

Known vulnerabilities in minimist 1.2.5

dependency · source: scanner (dependencies) · effort: S · id 8e86189ec470bb22

1 published advisory affects minimist 1.2.5 (npm), declared in package-lock.json: GHSA-xvch-5gv4-984h: Prototype Pollution in minimist.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade minimist to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-xvch-5gv4-984h)

Known vulnerabilities in mixin-deep 1.3.1

dependency · source: scanner (dependencies) · effort: S · id 71e1f797b1f8d742

1 published advisory affects mixin-deep 1.3.1 (npm), declared in package-lock.json: GHSA-fhjf-83wg-r2j9: Prototype Pollution in mixin-deep.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade mixin-deep to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-fhjf-83wg-r2j9)

Known vulnerabilities in proxy-addr 2.0.4

dependency · source: scanner (dependencies) · effort: S · id 1b7e2fbb1a03ea95

1 published advisory affects proxy-addr 2.0.4 (npm), declared in package-lock.json: GHSA-jqcg-44mw-7w3h: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade proxy-addr to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-jqcg-44mw-7w3h)

Known vulnerabilities in set-value 0.4.3

dependency · source: scanner (dependencies) · effort: S · id 7f4aa7dd858a9ca9

2 published advisories affect set-value 0.4.3 (npm), declared in package-lock.json: GHSA-4g88-fppr-53pp: Prototype Pollution in set-value; GHSA-4jqc-8m5r-9rpr: Prototype Pollution in set-value.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade set-value to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-4g88-fppr-53pp, GHSA-4jqc-8m5r-9rpr)

Known vulnerabilities in set-value 2.0.0

dependency · source: scanner (dependencies) · effort: S · id 9585f6fc3fbfb5a3

2 published advisories affect set-value 2.0.0 (npm), declared in package-lock.json: GHSA-4g88-fppr-53pp: Prototype Pollution in set-value; GHSA-4jqc-8m5r-9rpr: Prototype Pollution in set-value.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade set-value to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-4g88-fppr-53pp, GHSA-4jqc-8m5r-9rpr)

Known vulnerabilities in tar 2.2.1

dependency · source: scanner (dependencies) · effort: S · id a70252fc6085fc3f

16 published advisories affect tar 2.2.1 (npm), declared in package-lock.json: GHSA-23hp-3jrh-7fpw: node-tar: Decompression/parse DoS via unlimited input; GHSA-34x7-hfp2-rc4v: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal; GHSA-3jfq-g458-7qm9: Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization; GHSA-5955-9wpr-37jh: Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization; GHSA-83g3-92jg-28cx: Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction; GHSA-8qq5-rm4j-mr97: node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization; GHSA-8x88-c5mf-7j5w: node-tar: Negative tar entry size causes infinite loop in archive replace; GHSA-9ppj-qmqm-q256: node-tar Symlink Path Traversal via Drive-Relative Linkpath; GHSA-f5x3-32g6-xq36: Denial of service while parsing a tar file due to lack of folders count validation; GHSA-gvwx-54wh-qm9j: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records; and 6 more.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade tar to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-23hp-3jrh-7fpw, GHSA-34x7-hfp2-rc4v, GHSA-3jfq-g458-7qm9, GHSA-5955-9wpr-37jh, GHSA-83g3-92jg-28cx, GHSA-8qq5-rm4j-mr97, GHSA-8x88-c5mf-7j5w, GHSA-9ppj-qmqm-q256, GHSA-f5x3-32g6-xq36, GHSA-gvwx-54wh-qm9j, GHSA-j44m-qm6p-hp7m, GHSA-qffp-2rhf-9h96, GHSA-r292-9mhp-454m, GHSA-r6q2-hw4h-h46w, GHSA-vmf3-w455-68vh, GHSA-w8wr-v893-vjvp)

Known vulnerabilities in tar 4.4.8

dependency · source: scanner (dependencies) · effort: S · id 0879c74681cb1c9c

18 published advisories affect tar 4.4.8 (npm), declared in package-lock.json: GHSA-23hp-3jrh-7fpw: node-tar: Decompression/parse DoS via unlimited input; GHSA-34x7-hfp2-rc4v: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal; GHSA-3jfq-g458-7qm9: Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization; GHSA-5955-9wpr-37jh: Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization; GHSA-83g3-92jg-28cx: Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction; GHSA-8qq5-rm4j-mr97: node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization; GHSA-8x88-c5mf-7j5w: node-tar: Negative tar entry size causes infinite loop in archive replace; GHSA-9ppj-qmqm-q256: node-tar Symlink Path Traversal via Drive-Relative Linkpath; GHSA-9r2w-394v-53qc: Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links; GHSA-f5x3-32g6-xq36: Denial of service while parsing a tar file due to lack of folders count validation; and 8 more.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade tar to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-23hp-3jrh-7fpw, GHSA-34x7-hfp2-rc4v, GHSA-3jfq-g458-7qm9, GHSA-5955-9wpr-37jh, GHSA-83g3-92jg-28cx, GHSA-8qq5-rm4j-mr97, GHSA-8x88-c5mf-7j5w, GHSA-9ppj-qmqm-q256, GHSA-9r2w-394v-53qc, GHSA-f5x3-32g6-xq36, GHSA-gvwx-54wh-qm9j, GHSA-qffp-2rhf-9h96, GHSA-qq89-hq3f-393p, GHSA-r292-9mhp-454m, GHSA-r628-mhmh-qjhw, GHSA-r6q2-hw4h-h46w, GHSA-vmf3-w455-68vh, GHSA-w8wr-v893-vjvp)

Known vulnerabilities in underscore 1.8.3

dependency · source: scanner (dependencies) · effort: S · id e8b9de56dc109a15

2 published advisories affect underscore 1.8.3 (npm), declared in package-lock.json: GHSA-cf4h-3jhx-xvhq: Arbitrary Code Execution in underscore; GHSA-qpx9-hpmf-5gmw: Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade underscore to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-cf4h-3jhx-xvhq, GHSA-qpx9-hpmf-5gmw)

Known vulnerabilities in underscore 1.9.1

dependency · source: scanner (dependencies) · effort: S · id c358505f77d59702

2 published advisories affect underscore 1.9.1 (npm), declared in package-lock.json: GHSA-cf4h-3jhx-xvhq: Arbitrary Code Execution in underscore; GHSA-qpx9-hpmf-5gmw: Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade underscore to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-cf4h-3jhx-xvhq, GHSA-qpx9-hpmf-5gmw)

Known vulnerabilities in websocket-driver 0.7.0

dependency · source: scanner (dependencies) · effort: S · id b0155bffd9b3fe46

2 published advisories affect websocket-driver 0.7.0 (npm), declared in package-lock.json: GHSA-mp7j-qc5w-4988: websocket-driver: Resource limit bypass via message compression; GHSA-xv26-6w52-cph6: websocket-driver: Message corruption via abuse of protocol length headers.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade websocket-driver to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-mp7j-qc5w-4988, GHSA-xv26-6w52-cph6)

High (86)

Node.js 12 is past end of life

dependency · source: scanner (end_of_life) · effort: L · id ad1e243c348a1c96

Node.js 12 reached end of life on 2022-04-30: its maintainers no longer fix bugs or security issues in it. It is declared in Dockerfile. Dates are from endoflife.date data dated 2026-11-14.

Impact. Security flaws found from now on in this release are not fixed upstream, so the tool accumulates known vulnerabilities, and libraries drop support for it, which blocks routine upgrades.

Remediation. Move to a release its maintainers still support, test the tool on it, and update every place listed below. Supported releases include Node.js 26.

Effort. L: move to a supported release, retest and update every place it is pinned (scanner rule end_of_life.past)

Evidence.

• Dockerfile:1 (FROM node:12-alpine; end of life 2022-04-30; endoflife.date data dated 2026-11-14)
• Dockerfile:7 (FROM node:12-alpine; end of life 2022-04-30; endoflife.date data dated 2026-11-14)

Private key material in git history

security · source: scanner (secrets) · effort: M · id d769b326f2760eec

Private key material found in app/cert/key.pem. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• app/cert/key.pem — …[redacted 31 chars] (fingerprint e21ad48d54bf; added in commit e0045e653a53; removed from the working tree but recoverable by anyone with repository access)

Database connection string with embedded password in git history

security · source: scanner (secrets) · effort: M · id 0c31573952184c10

Database connection string with embedded password found in config/env/all.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• config/env/all.js — db = process.env.NODE_ENV === 'test' ? 'mongodb://localhost:27017/nodegoat' : 'mongodb://nodegoat:…[redacted 5 chars]@nodegoat-cluster-shard-00-00.zkkl5.mongodb.net:27017,nodegoat-cluster-shard-00-01. (fingerprint 1ec32ca39b42; added in commit 5ab008832d7e; removed from the working tree but recoverable by anyone with repository access)

Private key material in git history

security · source: scanner (secrets) · effort: M · id 4078eebdcde2c323

Private key material found in node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/ssl/ca/ca.key. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/ssl/ca/ca.key — …[redacted 31 chars] (fingerprint de6c258eed0a; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Private key material in git history

security · source: scanner (secrets) · effort: M · id 0767acc3b195dc75

Private key material found in node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/ssl/ca/server.key. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/ssl/ca/server.key — …[redacted 31 chars] (fingerprint e5ad552764bc; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Private key material in git history

security · source: scanner (secrets) · effort: M · id 03e773dbd1cd310c

Private key material found in node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/ssl/test.key. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/ssl/test.key — …[redacted 31 chars] (fingerprint adbcb67e3a6c; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Hardcoded credential assignment in git history

security · source: scanner (secrets) · effort: M · id 9601ed3b9a94f745

Hardcoded credential assignment found in node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-oauth.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-oauth.js — , oauth_token: '…[redacted 41 chars]' (fingerprint 46804ea1cd86; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Hardcoded credential assignment in git history

security · source: scanner (secrets) · effort: M · id b7db9ce0b7219c54

Hardcoded credential assignment found in node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-oauth.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-oauth.js — , oauth_token: "…[redacted 49 chars]" (fingerprint b67188b03721; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Hardcoded credential assignment in git history

security · source: scanner (secrets) · effort: M · id 0b2613d12ff487ae

Hardcoded credential assignment found in node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-oauth.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-oauth.js — , consumer_secret: "…[redacted 43 chars]" (fingerprint c70776c1ab86; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Hardcoded credential assignment in git history

security · source: scanner (secrets) · effort: M · id b4638dcca84b078f

Hardcoded credential assignment found in node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-oauth.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-oauth.js — , token_secret: "…[redacted 41 chars]" (fingerprint f6eca49d1a5a; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Hardcoded credential assignment in git history

security · source: scanner (secrets) · effort: M · id c6facae95fb4e39a

Hardcoded credential assignment found in node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-oauth.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-oauth.js — , token_secret: "…[redacted 40 chars]" (fingerprint 760e778aa414; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

AWS access key ID in git history

security · source: scanner (secrets) · effort: M · id 87a94a8d62ec0bf6

AWS access key ID found in node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-s3.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-s3.js — { key: 'AKIA…[redacted 20 chars]' (fingerprint 4c114c2771d9; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Hardcoded credential assignment in git history

security · source: scanner (secrets) · effort: M · id a6601bcd8c8741bd

Hardcoded credential assignment found in node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-s3.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/node_modules/request/tests/test-s3.js — , secret: '…[redacted 40 chars]' (fingerprint 6f273c6c53d8; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Private key material in git history

security · source: scanner (secrets) · effort: M · id 33f4705eb2119d04

Private key material found in node_modules/forever/node_modules/cliff/node_modules/winston/test/fixtures/keys/agent2-key.pem. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/test/fixtures/keys/agent2-key.pem — …[redacted 31 chars] (fingerprint 72d6cea4370e; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Hardcoded credential assignment in git history

security · source: scanner (secrets) · effort: M · id faf846bea2f53656

Hardcoded credential assignment found in node_modules/forever/node_modules/cliff/node_modules/winston/test/transports/webhook-test.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/cliff/node_modules/winston/test/transports/webhook-test.js — "password": "…[redacted 9 chars]" (fingerprint f1af8d890750; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Hardcoded credential assignment in git history

security · source: scanner (secrets) · effort: M · id fceff1660cd5f827

Hardcoded credential assignment found in node_modules/forever/node_modules/flatiron/node_modules/prompt/README.md. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/flatiron/node_modules/prompt/README.md — password: '…[redacted 12 chars]', (fingerprint 5e9dd8b43e30; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Private key material in git history

security · source: scanner (secrets) · effort: M · id e9d26d9f9235fa58

Private key material found in node_modules/forever/node_modules/nssocket/test/fixtures/ryans-key.pem. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/forever/node_modules/nssocket/test/fixtures/ryans-key.pem — …[redacted 31 chars] (fingerprint 0fbf77361b4c; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Private key material in git history

security · source: scanner (secrets) · effort: M · id 4469a99149e645df

Private key material found in node_modules/grunt-contrib-watch/node_modules/tiny-lr/node_modules/faye-websocket/spec/server.key. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/grunt-contrib-watch/node_modules/tiny-lr/node_modules/faye-websocket/spec/server.key — …[redacted 31 chars] (fingerprint f579e02fd998; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Hardcoded credential assignment in git history

security · source: scanner (secrets) · effort: M · id ba647a52c11a1dfd

Hardcoded credential assignment found in node_modules/grunt-jsbeautifier/node_modules/js-beautify/js/lib/beautify-html.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/grunt-jsbeautifier/node_modules/js-beautify/js/lib/beautify-html.js — single_token: '…[redacted 92 chars]'.split(','), //all the single tags for HTML (fingerprint bb793c3f0822; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Database connection string with embedded password in git history

security · source: scanner (secrets) · effort: M · id e89b87e0d5f017a6

Database connection string with embedded password found in node_modules/mongodb/lib/mongodb/connection/url_parser.js. The value is redacted here and identified by fingerprint.

Impact. Anyone who can read this code or its history holds a working credential. Rotation is required regardless of whether the file is still present.

Remediation. Rotate the credential now. Move it to a secret manager or environment variable. Purge it from git history (git filter-repo) before the repository moves anywhere.

Effort. M: rotate the credential, then rewrite history every clone must take (scanner rule secrets.credential_history)

Evidence.

• node_modules/mongodb/lib/mongodb/connection/url_parser.js — throw Error("URL must be in the format mongodb://user:…[redacted 4 chars]@host:port/dbname"); (fingerprint d74ff0ee8da3; added in commit a7b556da2a25; removed from the working tree but recoverable by anyone with repository access)

Known vulnerabilities in adm-zip 0.4.4

dependency · source: scanner (dependencies) · effort: S · id 1ad4f47ca5626665

8 published advisories affect adm-zip 0.4.4 (npm), declared in package-lock.json: GHSA-3v6h-hqm4-2rg6: Arbitrary File Write in adm-zip; GHSA-7q85-xj36-vmfc: adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS); GHSA-8238-w5pm-2374: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS); GHSA-c6fg-446q-cg94: adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path; GHSA-j5f4-cc29-5x44: adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation; GHSA-p634-w6r4-rjp2: adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content; GHSA-rcw4-f5rp-g42v: adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0; GHSA-xcpc-8h2w-3j85: adm-zip: Crafted ZIP file triggers 4GB memory allocation.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade adm-zip to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-3v6h-hqm4-2rg6, GHSA-7q85-xj36-vmfc, GHSA-8238-w5pm-2374, GHSA-c6fg-446q-cg94, GHSA-j5f4-cc29-5x44, GHSA-p634-w6r4-rjp2, GHSA-rcw4-f5rp-g42v, GHSA-xcpc-8h2w-3j85)

Known vulnerabilities in ansi-regex 3.0.0

dependency · source: scanner (dependencies) · effort: S · id 5afab38d62475c33

1 published advisory affects ansi-regex 3.0.0 (npm), declared in package-lock.json: GHSA-93q8-gq69-wqmw: Inefficient Regular Expression Complexity in chalk/ansi-regex.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade ansi-regex to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-93q8-gq69-wqmw)

Known vulnerabilities in async 2.6.1

dependency · source: scanner (dependencies) · effort: S · id f7e2ce9e78e5db10

1 published advisory affects async 2.6.1 (npm), declared in package-lock.json: GHSA-fwr7-v2mv-hh25: Prototype Pollution in async.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade async to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-fwr7-v2mv-hh25)

Known vulnerabilities in body-parser 1.18.3

dependency · source: scanner (dependencies) · effort: S · id 3869a80a7ff7d87a

3 published advisories affect body-parser 1.18.3 (npm), declared in package-lock.json: GHSA-27r3-jxmh-p828: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body; GHSA-qwcr-r2fm-qrc7: body-parser vulnerable to denial of service when url encoding is enabled; GHSA-v422-hmwv-36x6: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade body-parser to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-27r3-jxmh-p828, GHSA-qwcr-r2fm-qrc7, GHSA-v422-hmwv-36x6)

Known vulnerabilities in brace-expansion 1.1.11

dependency · source: scanner (dependencies) · effort: S · id 465c9e03c1f1a676

8 published advisories affect brace-expansion 1.1.11 (npm), declared in package-lock.json: GHSA-3jxr-9vmj-r5cp: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups; GHSA-6j4f-fj2g-mc7p: brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion; GHSA-f886-m6hf-6m8v: brace-expansion: Zero-step sequence causes process hang and memory exhaustion; GHSA-mh99-v99m-4gvg: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash; GHSA-q2hr-2g5m-vwhr: brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service; GHSA-qhr7-859c-m2p7: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion; GHSA-rgw5-rvv9-x895: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation; GHSA-v6h2-p8h4-qcjw: brace-expansion Regular Expression Denial of Service vulnerability.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade brace-expansion to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895, GHSA-v6h2-p8h4-qcjw)

Known vulnerabilities in brace-expansion 1.1.6

dependency · source: scanner (dependencies) · effort: S · id c6be1eb3045a51db

9 published advisories affect brace-expansion 1.1.6 (npm), declared in package-lock.json: GHSA-3jxr-9vmj-r5cp: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups; GHSA-6j4f-fj2g-mc7p: brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion; GHSA-832h-xg76-4gv6: ReDoS in brace-expansion; GHSA-f886-m6hf-6m8v: brace-expansion: Zero-step sequence causes process hang and memory exhaustion; GHSA-mh99-v99m-4gvg: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash; GHSA-q2hr-2g5m-vwhr: brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service; GHSA-qhr7-859c-m2p7: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion; GHSA-rgw5-rvv9-x895: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation; GHSA-v6h2-p8h4-qcjw: brace-expansion Regular Expression Denial of Service vulnerability.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade brace-expansion to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-832h-xg76-4gv6, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895, GHSA-v6h2-p8h4-qcjw)

Known vulnerabilities in braces 1.8.5

dependency · source: scanner (dependencies) · effort: S · id 49c135ac5d138a4e

1 published advisory affects braces 1.8.5 (npm), declared in package-lock.json: GHSA-grv7-fg5c-xmjg: Uncontrolled resource consumption in braces.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade braces to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-grv7-fg5c-xmjg)

Known vulnerabilities in braces 2.3.2

dependency · source: scanner (dependencies) · effort: S · id 8e5b2da52c1c0d44

1 published advisory affects braces 2.3.2 (npm), declared in package-lock.json: GHSA-grv7-fg5c-xmjg: Uncontrolled resource consumption in braces.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade braces to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-grv7-fg5c-xmjg)

Known vulnerabilities in cross-spawn 4.0.0

dependency · source: scanner (dependencies) · effort: S · id dfe9dadb5734b7ac

1 published advisory affects cross-spawn 4.0.0 (npm), declared in package-lock.json: GHSA-3xgq-45jj-v275: Regular Expression Denial of Service (ReDoS) in cross-spawn.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade cross-spawn to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-3xgq-45jj-v275)

Known vulnerabilities in cross-spawn 4.0.2

dependency · source: scanner (dependencies) · effort: S · id b5a12b72ff007682

1 published advisory affects cross-spawn 4.0.2 (npm), declared in package-lock.json: GHSA-3xgq-45jj-v275: Regular Expression Denial of Service (ReDoS) in cross-spawn.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade cross-spawn to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-3xgq-45jj-v275)

Known vulnerabilities in cross-spawn 5.1.0

dependency · source: scanner (dependencies) · effort: S · id 7ed6be60ee7f051f

1 published advisory affects cross-spawn 5.1.0 (npm), declared in package-lock.json: GHSA-3xgq-45jj-v275: Regular Expression Denial of Service (ReDoS) in cross-spawn.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade cross-spawn to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-3xgq-45jj-v275)

Known vulnerabilities in cross-spawn 6.0.5

dependency · source: scanner (dependencies) · effort: S · id 9d3be9d4d7836414

1 published advisory affects cross-spawn 6.0.5 (npm), declared in package-lock.json: GHSA-3xgq-45jj-v275: Regular Expression Denial of Service (ReDoS) in cross-spawn.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade cross-spawn to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-3xgq-45jj-v275)

Known vulnerabilities in cross-spawn 7.0.3

dependency · source: scanner (dependencies) · effort: S · id 961689d517470666

1 published advisory affects cross-spawn 7.0.3 (npm), declared in package-lock.json: GHSA-3xgq-45jj-v275: Regular Expression Denial of Service (ReDoS) in cross-spawn.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade cross-spawn to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-3xgq-45jj-v275)

Known vulnerabilities in debug 2.2.0

dependency · source: scanner (dependencies) · effort: S · id c49afa4d0d2650d9

2 published advisories affect debug 2.2.0 (npm), declared in package-lock.json: GHSA-9vvw-cc9w-f27h: debug Inefficient Regular Expression Complexity vulnerability; GHSA-gxpj-cx7g-858c: Regular Expression Denial of Service in debug.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade debug to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-9vvw-cc9w-f27h, GHSA-gxpj-cx7g-858c)

Known vulnerabilities in decode-uri-component 0.2.0

dependency · source: scanner (dependencies) · effort: S · id 9713a45504ae6c70

3 published advisories affect decode-uri-component 0.2.0 (npm), declared in package-lock.json: GHSA-qr28-fpjm-wq7f: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs; GHSA-vcc3-ghjq-m6fr: decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input; GHSA-w573-4hg7-7wgq: decode-uri-component vulnerable to Denial of Service (DoS).

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade decode-uri-component to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-qr28-fpjm-wq7f, GHSA-vcc3-ghjq-m6fr, GHSA-w573-4hg7-7wgq)

Known vulnerabilities in diff 1.4.0

dependency · source: scanner (dependencies) · effort: S · id 0a1c783c82f3a702

2 published advisories affect diff 1.4.0 (npm), declared in package-lock.json: GHSA-73rr-hh4g-fpgx: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch; GHSA-h6ch-v84p-w6p9: Regular Expression Denial of Service (ReDoS).

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade diff to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-73rr-hh4g-fpgx, GHSA-h6ch-v84p-w6p9)

Known vulnerabilities in dot-prop 4.2.0

dependency · source: scanner (dependencies) · effort: S · id df2746eb9cd6e41b

1 published advisory affects dot-prop 4.2.0 (npm), declared in package-lock.json: GHSA-ff7x-qrg7-qggm: dot-prop Prototype Pollution vulnerability.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade dot-prop to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-ff7x-qrg7-qggm)

Known vulnerabilities in extract-zip 1.6.7

dependency · source: scanner (dependencies) · effort: S · id d4029d5c82e908db

2 published advisories affect extract-zip 1.6.7 (npm), declared in package-lock.json: GHSA-7pqw-9j4j-h8q3: extract-zip allows arbitrary file writes through symlink archive entries; GHSA-jmr9-qjv8-65gv: extract-zip unvalidated symlink path traversal.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade extract-zip to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv)

Known vulnerabilities in fstream 1.0.10

dependency · source: scanner (dependencies) · effort: S · id 3a6737956ac119e2

1 published advisory affects fstream 1.0.10 (npm), declared in package-lock.json: GHSA-xf7w-r453-m56c: Arbitrary File Overwrite in fstream.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade fstream to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-xf7w-r453-m56c)

Known vulnerabilities in grunt 1.0.3

dependency · source: scanner (dependencies) · effort: S · id 6ed4c0da48cf72cc

3 published advisories affect grunt 1.0.3 (npm), declared in package-lock.json: GHSA-j383-35pm-c5h4: Path Traversal in Grunt; GHSA-m5pj-vjjf-4m3h: Arbitrary Code Execution in grunt; GHSA-rm36-94g8-835r: Race Condition in Grunt.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade grunt to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-j383-35pm-c5h4, GHSA-m5pj-vjjf-4m3h, GHSA-rm36-94g8-835r)

Known vulnerabilities in hawk 1.0.0

dependency · source: scanner (dependencies) · effort: S · id 4771448224a2aa1a

2 published advisories affect hawk 1.0.0 (npm), declared in package-lock.json: GHSA-44pw-h2cw-w3vq: Uncontrolled Resource Consumption in Hawk; GHSA-jcpv-g9rr-qxrc: Regular Expression Denial of Service in hawk.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade hawk to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-44pw-h2cw-w3vq, GHSA-jcpv-g9rr-qxrc)

Known vulnerabilities in hawk 3.1.3

dependency · source: scanner (dependencies) · effort: S · id d3ac3c16e84373b5

1 published advisory affects hawk 3.1.3 (npm), declared in package-lock.json: GHSA-44pw-h2cw-w3vq: Uncontrolled Resource Consumption in Hawk.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade hawk to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-44pw-h2cw-w3vq)

Known vulnerabilities in hoek 0.9.1

dependency · source: scanner (dependencies) · effort: S · id 02428b9f37bd34a7

2 published advisories affect hoek 0.9.1 (npm), declared in package-lock.json: GHSA-c429-5p7v-vgjp: hoek subject to prototype pollution via the clone function.; GHSA-jp4x-w63m-7wgm: Prototype Pollution in hoek.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade hoek to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-c429-5p7v-vgjp, GHSA-jp4x-w63m-7wgm)

Known vulnerabilities in hoek 2.16.3

dependency · source: scanner (dependencies) · effort: S · id fcf93e1f414ea1db

2 published advisories affect hoek 2.16.3 (npm), declared in package-lock.json: GHSA-c429-5p7v-vgjp: hoek subject to prototype pollution via the clone function.; GHSA-jp4x-w63m-7wgm: Prototype Pollution in hoek.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade hoek to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-c429-5p7v-vgjp, GHSA-jp4x-w63m-7wgm)

Known vulnerabilities in i 0.3.6

dependency · source: scanner (dependencies) · effort: S · id 881be7af48c5ef6c

1 published advisory affects i 0.3.6 (npm), declared in package-lock.json: GHSA-x55w-vjjp-222r: inflect vulnerable to Inefficient Regular Expression Complexity.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade i to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-x55w-vjjp-222r)

Known vulnerabilities in ini 1.3.4

dependency · source: scanner (dependencies) · effort: S · id 1e2d06f7979427c8

1 published advisory affects ini 1.3.4 (npm), declared in package-lock.json: GHSA-qqgx-2p2h-9c37: ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade ini to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-qqgx-2p2h-9c37)

Known vulnerabilities in ini 1.3.5

dependency · source: scanner (dependencies) · effort: S · id 179cdd59e972a231

1 published advisory affects ini 1.3.5 (npm), declared in package-lock.json: GHSA-qqgx-2p2h-9c37: ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade ini to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-qqgx-2p2h-9c37)

Known vulnerabilities in js-yaml 3.5.5

dependency · source: scanner (dependencies) · effort: S · id 584f0296510880a2

7 published advisories affect js-yaml 3.5.5 (npm), declared in package-lock.json: GHSA-2883-xcg3-v3hh: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources; GHSA-2pr6-76vf-7546: Denial of Service in js-yaml; GHSA-52cp-r559-cp3m: js-yaml: YAML merge-key chains can force quadratic CPU consumption; GHSA-5p4m-2wfm-xmqj: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported; GHSA-8j8c-7jfh-h6hx: Code Injection in js-yaml; GHSA-h67p-54hq-rp68: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases; GHSA-mh29-5h37-fv8m: js-yaml has prototype pollution in merge (<<).

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade js-yaml to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-2883-xcg3-v3hh, GHSA-2pr6-76vf-7546, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-8j8c-7jfh-h6hx, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m)

Known vulnerabilities in js-yaml 3.6.1

dependency · source: scanner (dependencies) · effort: S · id 05d1c14ccdb8c7c5

7 published advisories affect js-yaml 3.6.1 (npm), declared in package-lock.json: GHSA-2883-xcg3-v3hh: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources; GHSA-2pr6-76vf-7546: Denial of Service in js-yaml; GHSA-52cp-r559-cp3m: js-yaml: YAML merge-key chains can force quadratic CPU consumption; GHSA-5p4m-2wfm-xmqj: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported; GHSA-8j8c-7jfh-h6hx: Code Injection in js-yaml; GHSA-h67p-54hq-rp68: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases; GHSA-mh29-5h37-fv8m: js-yaml has prototype pollution in merge (<<).

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade js-yaml to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-2883-xcg3-v3hh, GHSA-2pr6-76vf-7546, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-8j8c-7jfh-h6hx, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m)

Known vulnerabilities in kind-of 6.0.2

dependency · source: scanner (dependencies) · effort: S · id e2d76d12e6b396aa

1 published advisory affects kind-of 6.0.2 (npm), declared in package-lock.json: GHSA-6c8f-qphg-qjgp: Validation Bypass in kind-of.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade kind-of to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-6c8f-qphg-qjgp)

Known vulnerabilities in lodash 4.17.20

dependency · source: scanner (dependencies) · effort: S · id 363d292685451735

4 published advisories affect lodash 4.17.20 (npm), declared in package-lock.json: GHSA-29mw-wpgm-hmr9: Regular Expression Denial of Service (ReDoS) in lodash; GHSA-35jh-r3h4-6jhm: Command Injection in lodash; GHSA-r5fr-rjxr-66jc: lodash vulnerable to Code Injection via _.template imports key names; GHSA-xxjr-mmjv-4gpg: Lodash has Prototype Pollution Vulnerability in _.unset, _.omit, and _.pullAt functions.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade lodash to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-29mw-wpgm-hmr9, GHSA-35jh-r3h4-6jhm, GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg)

Known vulnerabilities in lodash 4.17.21

dependency · source: scanner (dependencies) · effort: S · id acee990e95b57170

2 published advisories affect lodash 4.17.21 (npm), declared in package-lock.json: GHSA-r5fr-rjxr-66jc: lodash vulnerable to Code Injection via _.template imports key names; GHSA-xxjr-mmjv-4gpg: Lodash has Prototype Pollution Vulnerability in _.unset, _.omit, and _.pullAt functions.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade lodash to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg)

Known vulnerabilities in marked 0.3.5

dependency · source: scanner (dependencies) · effort: S · id 38861c70750604f1

6 published advisories affect marked 0.3.5 (npm), declared in package-lock.json: GHSA-5v2h-r2cx-5xgj: Inefficient Regular Expression Complexity in marked; GHSA-7px7-7xjx-hxm8: Marked vulnerable to XSS from data URIs; GHSA-p9wx-2529-fp83: Marked allows Regular Expression Denial of Service (ReDoS) attacks; GHSA-rrrm-qjm4-v8hf: Inefficient Regular Expression Complexity in marked; GHSA-vfvf-mqq8-rwqc: Sanitization bypass using HTML Entities in marked; GHSA-x5pg-88wf-qq4p: Regular Expression Denial of Service in marked.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade marked to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-5v2h-r2cx-5xgj, GHSA-7px7-7xjx-hxm8, GHSA-p9wx-2529-fp83, GHSA-rrrm-qjm4-v8hf, GHSA-vfvf-mqq8-rwqc, GHSA-x5pg-88wf-qq4p)

Known vulnerabilities in mime 1.2.11

dependency · source: scanner (dependencies) · effort: S · id f02d9e65d0484b0f

1 published advisory affects mime 1.2.11 (npm), declared in package-lock.json: GHSA-wrvr-8mpx-r7pp: mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade mime to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-wrvr-8mpx-r7pp)

Known vulnerabilities in minimatch 0.3.0

dependency · source: scanner (dependencies) · effort: S · id 5f28de816709197c

5 published advisories affect minimatch 0.3.0 (npm), declared in package-lock.json: GHSA-23c5-xmqv-rm74: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions; GHSA-3ppc-4f35-3m26: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern; GHSA-7r86-cg39-jmmj: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments; GHSA-f8q6-p94x-37v3: minimatch ReDoS vulnerability; GHSA-hxm2-r34f-qmc5: Regular Expression Denial of Service in minimatch.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade minimatch to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-f8q6-p94x-37v3, GHSA-hxm2-r34f-qmc5)

Known vulnerabilities in minimatch 3.0.2

dependency · source: scanner (dependencies) · effort: S · id c9acac164262a463

4 published advisories affect minimatch 3.0.2 (npm), declared in package-lock.json: GHSA-23c5-xmqv-rm74: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions; GHSA-3ppc-4f35-3m26: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern; GHSA-7r86-cg39-jmmj: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments; GHSA-f8q6-p94x-37v3: minimatch ReDoS vulnerability.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade minimatch to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-f8q6-p94x-37v3)

Known vulnerabilities in minimatch 3.0.3

dependency · source: scanner (dependencies) · effort: S · id 59d4e4e1f5e7fade

4 published advisories affect minimatch 3.0.3 (npm), declared in package-lock.json: GHSA-23c5-xmqv-rm74: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions; GHSA-3ppc-4f35-3m26: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern; GHSA-7r86-cg39-jmmj: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments; GHSA-f8q6-p94x-37v3: minimatch ReDoS vulnerability.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade minimatch to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-f8q6-p94x-37v3)

Known vulnerabilities in minimatch 3.0.4

dependency · source: scanner (dependencies) · effort: S · id 8ca94da4bfe47848

4 published advisories affect minimatch 3.0.4 (npm), declared in package-lock.json: GHSA-23c5-xmqv-rm74: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions; GHSA-3ppc-4f35-3m26: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern; GHSA-7r86-cg39-jmmj: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments; GHSA-f8q6-p94x-37v3: minimatch ReDoS vulnerability.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade minimatch to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-f8q6-p94x-37v3)

Known vulnerabilities in moment 2.24.0

dependency · source: scanner (dependencies) · effort: S · id 88fa707b3df2196e

2 published advisories affect moment 2.24.0 (npm), declared in package-lock.json: GHSA-8hfj-j24r-96c4: Path Traversal: 'dir/../../filename' in moment.locale; GHSA-wc69-rhjr-hc9g: Moment.js vulnerable to Inefficient Regular Expression Complexity.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade moment to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-8hfj-j24r-96c4, GHSA-wc69-rhjr-hc9g)

Known vulnerabilities in mongodb 2.2.36

dependency · source: scanner (dependencies) · effort: S · id 2758e0efeefd409e

1 published advisory affects mongodb 2.2.36 (npm), declared in package-lock.json: GHSA-mh5c-679w-hh4r: Denial of Service in mongodb.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade mongodb to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-mh5c-679w-hh4r)

Known vulnerabilities in nconf 0.10.0

dependency · source: scanner (dependencies) · effort: S · id cfeec70f02dc79cc

1 published advisory affects nconf 0.10.0 (npm), declared in package-lock.json: GHSA-6xwr-q98w-rvg7: Prototype Pollution in nconf.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade nconf to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-6xwr-q98w-rvg7)

Known vulnerabilities in nconf 0.6.9

dependency · source: scanner (dependencies) · effort: S · id 61ca459443c1d16d

1 published advisory affects nconf 0.6.9 (npm), declared in package-lock.json: GHSA-6xwr-q98w-rvg7: Prototype Pollution in nconf.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade nconf to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-6xwr-q98w-rvg7)

Known vulnerabilities in npm 3.10.10

dependency · source: scanner (dependencies) · effort: S · id cbfe8a10bbddcf09

5 published advisories affect npm 3.10.10 (npm), declared in package-lock.json: GHSA-4328-8hgf-7wjr: npm Vulnerable to Global node_modules Binary Overwrite; GHSA-93f3-23rq-pjfp: npm CLI exposing sensitive information through logs; GHSA-m6cx-g6qm-p2cx: Arbitrary File Write in npm; GHSA-ph34-pc88-72gc: Incorrect Permission Assignment for Critical Resource in NPM; GHSA-x8qc-rrcw-4r46: npm symlink reference outside of node_modules.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade npm to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-4328-8hgf-7wjr, GHSA-93f3-23rq-pjfp, GHSA-m6cx-g6qm-p2cx, GHSA-ph34-pc88-72gc, GHSA-x8qc-rrcw-4r46)

Known vulnerabilities in npm-user-validate 0.1.5

dependency · source: scanner (dependencies) · effort: S · id 082453e387c21e06

1 published advisory affects npm-user-validate 0.1.5 (npm), declared in package-lock.json: GHSA-pw54-mh39-w3hc: Regular expression denial of service in npm-user-validate.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade npm-user-validate to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-pw54-mh39-w3hc)

Known vulnerabilities in path-to-regexp 0.1.7

dependency · source: scanner (dependencies) · effort: S · id 38140ebc257b38ca

2 published advisories affect path-to-regexp 0.1.7 (npm), declared in package-lock.json: GHSA-37ch-88jc-xwx2: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters; GHSA-rhx6-c78j-4q9w: path-to-regexp contains a ReDoS.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade path-to-regexp to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-37ch-88jc-xwx2, GHSA-rhx6-c78j-4q9w)

Known vulnerabilities in qs 0.6.6

dependency · source: scanner (dependencies) · effort: S · id dc09b16210953d4a

5 published advisories affect qs 0.6.6 (npm), declared in package-lock.json: GHSA-6rw7-vpxm-498p: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion; GHSA-f9cm-p3w6-xvr3: Denial-of-Service Extended Event Loop Blocking in qs; GHSA-gqgv-6jq5-jjj9: Prototype Pollution Protection Bypass in qs; GHSA-hrpp-h998-j3pp: qs vulnerable to Prototype Pollution; GHSA-jjv7-qpx3-h62q: Denial-of-Service Memory Exhaustion in qs.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade qs to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-6rw7-vpxm-498p, GHSA-f9cm-p3w6-xvr3, GHSA-gqgv-6jq5-jjj9, GHSA-hrpp-h998-j3pp, GHSA-jjv7-qpx3-h62q)

Known vulnerabilities in qs 5.2.1

dependency · source: scanner (dependencies) · effort: S · id 36322ef20aacef6e

4 published advisories affect qs 5.2.1 (npm), declared in package-lock.json: GHSA-4mjr-xmp4-gh2g: qs: Denial of Service via Attacker Controlled isBuffer; GHSA-6rw7-vpxm-498p: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion; GHSA-gqgv-6jq5-jjj9: Prototype Pollution Protection Bypass in qs; GHSA-hrpp-h998-j3pp: qs vulnerable to Prototype Pollution.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade qs to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-4mjr-xmp4-gh2g, GHSA-6rw7-vpxm-498p, GHSA-gqgv-6jq5-jjj9, GHSA-hrpp-h998-j3pp)

Known vulnerabilities in qs 6.2.1

dependency · source: scanner (dependencies) · effort: S · id e29852a7d99b3a70

4 published advisories affect qs 6.2.1 (npm), declared in package-lock.json: GHSA-4mjr-xmp4-gh2g: qs: Denial of Service via Attacker Controlled isBuffer; GHSA-6rw7-vpxm-498p: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion; GHSA-gqgv-6jq5-jjj9: Prototype Pollution Protection Bypass in qs; GHSA-hrpp-h998-j3pp: qs vulnerable to Prototype Pollution.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade qs to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-4mjr-xmp4-gh2g, GHSA-6rw7-vpxm-498p, GHSA-gqgv-6jq5-jjj9, GHSA-hrpp-h998-j3pp)

Known vulnerabilities in qs 6.3.2

dependency · source: scanner (dependencies) · effort: S · id 6e228e015f8643ea

3 published advisories affect qs 6.3.2 (npm), declared in package-lock.json: GHSA-4mjr-xmp4-gh2g: qs: Denial of Service via Attacker Controlled isBuffer; GHSA-6rw7-vpxm-498p: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion; GHSA-hrpp-h998-j3pp: qs vulnerable to Prototype Pollution.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade qs to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-4mjr-xmp4-gh2g, GHSA-6rw7-vpxm-498p, GHSA-hrpp-h998-j3pp)

Known vulnerabilities in qs 6.5.2

dependency · source: scanner (dependencies) · effort: S · id 5b43efe875b1c346

3 published advisories affect qs 6.5.2 (npm), declared in package-lock.json: GHSA-4mjr-xmp4-gh2g: qs: Denial of Service via Attacker Controlled isBuffer; GHSA-6rw7-vpxm-498p: qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion; GHSA-hrpp-h998-j3pp: qs vulnerable to Prototype Pollution.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade qs to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-4mjr-xmp4-gh2g, GHSA-6rw7-vpxm-498p, GHSA-hrpp-h998-j3pp)

Known vulnerabilities in semver 5.3.0

dependency · source: scanner (dependencies) · effort: S · id eae36d29179e999b

1 published advisory affects semver 5.3.0 (npm), declared in package-lock.json: GHSA-c2qf-rxjj-qqgw: semver vulnerable to Regular Expression Denial of Service.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade semver to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-c2qf-rxjj-qqgw)

Known vulnerabilities in semver 5.6.0

dependency · source: scanner (dependencies) · effort: S · id 9ba832b07428d43e

1 published advisory affects semver 5.6.0 (npm), declared in package-lock.json: GHSA-c2qf-rxjj-qqgw: semver vulnerable to Regular Expression Denial of Service.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade semver to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-c2qf-rxjj-qqgw)

Known vulnerabilities in semver 5.7.0

dependency · source: scanner (dependencies) · effort: S · id 06f5450267b48273

1 published advisory affects semver 5.7.0 (npm), declared in package-lock.json: GHSA-c2qf-rxjj-qqgw: semver vulnerable to Regular Expression Denial of Service.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade semver to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-c2qf-rxjj-qqgw)

Known vulnerabilities in shelljs 0.3.0

dependency · source: scanner (dependencies) · effort: S · id c54221081567f493

2 published advisories affect shelljs 0.3.0 (npm), declared in package-lock.json: GHSA-4rq4-32rv-6wp6: Improper Privilege Management in shelljs; GHSA-64g7-mvw6-v9qj: Improper Privilege Management in shelljs.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade shelljs to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-4rq4-32rv-6wp6, GHSA-64g7-mvw6-v9qj)

Known vulnerabilities in sshpk 1.10.1

dependency · source: scanner (dependencies) · effort: S · id cbbde1db3b7b8bcb

1 published advisory affects sshpk 1.10.1 (npm), declared in package-lock.json: GHSA-2m39-62fm-q8r3: Regular Expression Denial of Service in sshpk.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade sshpk to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-2m39-62fm-q8r3)

Known vulnerabilities in swig 1.4.2

dependency · source: scanner (dependencies) · effort: S · id e7342b1ff1ade27c

1 published advisory affects swig 1.4.2 (npm), declared in package-lock.json: GHSA-2rq5-699j-x7p6: Arbitrary local file read vulnerability during template rendering .

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade swig to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-2rq5-699j-x7p6)

Known vulnerabilities in tmp 0.0.24

dependency · source: scanner (dependencies) · effort: S · id a6300799c416e2bb

2 published advisories affect tmp 0.0.24 (npm), declared in package-lock.json: GHSA-52f5-9888-hmc6: tmp allows arbitrary temporary file / directory write via symbolic link dir parameter; GHSA-ph9p-34f9-6g65: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade tmp to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-52f5-9888-hmc6, GHSA-ph9p-34f9-6g65)

Known vulnerabilities in tmp 0.1.0

dependency · source: scanner (dependencies) · effort: S · id 4e559af49391b80c

2 published advisories affect tmp 0.1.0 (npm), declared in package-lock.json: GHSA-52f5-9888-hmc6: tmp allows arbitrary temporary file / directory write via symbolic link dir parameter; GHSA-ph9p-34f9-6g65: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade tmp to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-52f5-9888-hmc6, GHSA-ph9p-34f9-6g65)

Known vulnerabilities in tough-cookie 2.2.2

dependency · source: scanner (dependencies) · effort: S · id dea7815dc79483d9

3 published advisories affect tough-cookie 2.2.2 (npm), declared in package-lock.json: GHSA-72xf-g2v4-qvf3: tough-cookie Prototype Pollution vulnerability; GHSA-g7q5-pjjr-gqvp: Regular Expression Denial of Service in tough-cookie; GHSA-qhv9-728r-6jqg: ReDoS via long string of semicolons in tough-cookie.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade tough-cookie to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-72xf-g2v4-qvf3, GHSA-g7q5-pjjr-gqvp, GHSA-qhv9-728r-6jqg)

Known vulnerabilities in tough-cookie 2.3.1

dependency · source: scanner (dependencies) · effort: S · id ae1a749c3c85562d

2 published advisories affect tough-cookie 2.3.1 (npm), declared in package-lock.json: GHSA-72xf-g2v4-qvf3: tough-cookie Prototype Pollution vulnerability; GHSA-g7q5-pjjr-gqvp: Regular Expression Denial of Service in tough-cookie.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade tough-cookie to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-72xf-g2v4-qvf3, GHSA-g7q5-pjjr-gqvp)

Known vulnerabilities in trim-newlines 1.0.0

dependency · source: scanner (dependencies) · effort: S · id 20ac97e64349a405

1 published advisory affects trim-newlines 1.0.0 (npm), declared in package-lock.json: GHSA-7p7h-4mm5-852v: Uncontrolled Resource Consumption in trim-newlines.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade trim-newlines to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-7p7h-4mm5-852v)

Known vulnerabilities in uglify-js 2.4.24

dependency · source: scanner (dependencies) · effort: S · id 0a9482ef323371f4

1 published advisory affects uglify-js 2.4.24 (npm), declared in package-lock.json: GHSA-c9f4-xj24-8jqx: Regular Expression Denial of Service in uglify-js.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade uglify-js to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-c9f4-xj24-8jqx)

Known vulnerabilities in uuid 3.3.2

dependency · source: scanner (dependencies) · effort: S · id bfde9ae5afd31364

1 published advisory affects uuid 3.3.2 (npm), declared in package-lock.json: GHSA-w5hq-g745-h8pq: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade uuid to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-w5hq-g745-h8pq)

Known vulnerabilities in websocket-extensions 0.1.3

dependency · source: scanner (dependencies) · effort: S · id 20a0281a8c1d5608

1 published advisory affects websocket-extensions 0.1.3 (npm), declared in package-lock.json: GHSA-g78m-2chm-r7qv: Regular Expression Denial of Service in websocket-extensions (NPM package).

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade websocket-extensions to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-g78m-2chm-r7qv)

Known vulnerabilities in ws 1.1.5

dependency · source: scanner (dependencies) · effort: S · id 5399bd80853367b8

1 published advisory affects ws 1.1.5 (npm), declared in package-lock.json: GHSA-96hv-2xvq-fx4p: ws: Memory exhaustion DoS from tiny fragments and data chunks.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade ws to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-96hv-2xvq-fx4p)

Known vulnerabilities in y18n 3.2.1

dependency · source: scanner (dependencies) · effort: S · id 4a76ba2d2b651c3a

1 published advisory affects y18n 3.2.1 (npm), declared in package-lock.json: GHSA-c4w7-xm78-47vh: Prototype Pollution in y18n.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade y18n to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-c4w7-xm78-47vh)

Medium (37)

Bulk commits

process · source: scanner (generated_bulk) · effort: L · id 51577234fe744da5

7 commit(s) each changed more than 2,000 lines (677,783 lines, 51% of all changed lines).

Impact. Changes this large are rarely reviewed line by line; they are typical of generated code pasted in wholesale, so defects and copied secrets slip through.

Remediation. Review the largest of these commits for code nobody owns, and require smaller, reviewed changes from now on.

Effort. L: review the largest unreviewed commits (scanner rule generated_bulk.bulk_commits)

Evidence.

• . (a7b556da2a25 2013-12-02 Chetan Karande: +625,625 -1 in 4313 file(s): Included node_modules for faster and consistent deployemnts)
• . (5848aad1d8b4 2023-03-06 Liran Tal: +15,684 -924 in 2 file(s): fix: revert marked changes back to make sure we use the vulnerable version)
• . (aad96e69ce76 2019-03-03 ckarande: +11,290 -0 in 1 file(s): Update package versions)
• . (a58571ada601 2013-11-17 Chetan Karande: +9,837 -0 in 47 file(s): closes #1, closes # 3, closes #4, closes #5, closes #6)
• . (60f02d28b384 2019-08-07 Josep: +3,384 -3,410 in 3 file(s): Add nodemon as npm script)
• . (7593798f995e 2020-04-02 fabre-pierre-jean: +2,744 -2,064 in 3 file(s): add forever node_modules)
• . (199e6b58e6a3 2014-03-11 Chetan Karande: +2,283 -537 in 57 file(s): Update for release)

Dependency or build directories in the source

maintainability · source: scanner (vendored_bulk) · effort: M · id 6b9252b3385d5a78

1 directory of third-party or build output (15 files, 0.8 MB) are part of the source: app/assets/vendor.

Impact. Third-party code is versioned alongside the tool's own: it bloats every clone, hides local edits to dependencies, and never receives security updates.

Remediation. Remove these directories from the source, list them in .gitignore, and restore them from the package manager's manifest and lockfile at build time.

Effort. M: restore dependencies from the manifest at build time (scanner rule vendored_bulk.vendored_directories)

Evidence.

• app/assets/vendor (15 files, 0.8 MB)

Route handlers with no authentication check nearby

security · source: scanner (client_exposure) · effort: L · id 8b4a401cca718575

15 route handler(s) in 2 file(s) have no authentication identifier (auth, session, jwt, current user, guard) near them. This is a heuristic for review: middleware or a wrapper elsewhere may protect them. Model extraction, when configured, is asked to confirm each one.

Impact. An unprotected handler that reads or changes data exposes it to anyone who can reach the server.

Remediation. Confirm each handler is protected; add authentication middleware or an explicit check where it is not.

Effort. L: confirm and add authentication across the handlers (scanner rule client_exposure.unauthenticated_routes)

Evidence.

• app/routes/index.js:47 — app.get("/profile", isLoggedIn, profileHandler.displayProfile); (GET /profile)
• app/routes/index.js:48 — app.post("/profile", isLoggedIn, profileHandler.handleProfileUpdate); (POST /profile)
• app/routes/index.js:51 — app.get("/contributions", isLoggedIn, contributionsHandler.displayContributions); (GET /contributions)
• app/routes/index.js:52 — app.post("/contributions", isLoggedIn, contributionsHandler.handleContributionsUpdate); (POST /contributions)
• app/routes/index.js:55 — app.get("/benefits", isLoggedIn, benefitsHandler.displayBenefits); (GET /benefits)
• app/routes/index.js:56 — app.post("/benefits", isLoggedIn, benefitsHandler.updateBenefits); (POST /benefits)
• app/routes/index.js:58 — app.get("/benefits", isLoggedIn, isAdmin, benefitsHandler.displayBenefits); (GET /benefits)
• app/routes/index.js:59 — app.post("/benefits", isLoggedIn, isAdmin, benefitsHandler.updateBenefits); (POST /benefits)
• app/routes/index.js:63 — app.get("/allocations/:userId", isLoggedIn, allocationsHandler.displayAllocations); (GET /allocations/:userId)
• app/routes/index.js:66 — app.get("/memos", isLoggedIn, memosHandler.displayMemos); (GET /memos)
• app/routes/index.js:67 — app.post("/memos", isLoggedIn, memosHandler.addMemos); (POST /memos)
• app/routes/index.js:70 — app.get("/learn", isLoggedIn, (req, res) => { (GET /learn)
• app/routes/index.js:76 — app.get("/research", isLoggedIn, researchHandler.displayResearch); (GET /research)
• app/routes/tutorial.js:8 — router.get("/", (req, res) => { (GET /)
• app/routes/tutorial.js:31 — router.get('/${page}', (req, res) => { (GET /${page})

Oversized functions

maintainability · source: scanner (oversized_files) · effort: M · id 0df185b9a631a705

2 functions are longer than 150 lines; the longest is SessionHandler in app/routes/session.js (268 lines).

Impact. A function this long cannot be unit tested or reasoned about; defects hide in it.

Remediation. Extract cohesive steps into named functions with their own tests.

Effort. M: extract cohesive steps into tested functions (scanner rule oversized_files.function)

Evidence.

• app/routes/session.js:8-275 (SessionHandler: 268 lines)
• Gruntfile.js:14-194 (<anonymous>: 181 lines)

Hardcoded URLs

operability · source: scanner (hardcoded_infra) · effort: M · id fbde30d1cd4f9e51

33 distinct URLs hardcoded at 34 location(s), for example https://github.com/vuejs/vue-router/issues/261, https://raw.github.com/bekk/retire.js/master/repository/jsrepository.json, https://raw.github.com/bekk/retire.js/master/repository/npmrepository.json, https://www.owasp.org/index.php/Projects/OWASP_Node_js_Goat_Project, https://www.owasp.org/skins/owasplogo.png. Showing the first 25 locations.

Impact. Endpoints are fixed in code: moving a service or adding an environment means a code change, and the code reveals where the organisation's systems live.

Remediation. Move these values to configuration (environment variables or a config file) and document each one in the deployment guide.

Effort. M: move the values into configuration per environment (scanner rule hardcoded_infra.url)

Evidence.

• app/views/tutorial/a8.html:50 — <form method="POST" action="http://TARGET_APP_URL_HERE/profile"> (value: http://TARGET_APP_URL_HERE/profile)
• app/views/tutorial/a5.html:50 — Use latest stable version of node.js and express (or other web framework you are using). Keep a watch on published vulnerabilities of these. The vulnerabilities for node.js and express.js can be found (value: http://blog.nodejs.org/vulnerability/)
• app/views/tutorial/a5.html:51 — <a href="http://expressjs.com/advanced/security-updates.html">here</a>, respectively. (value: http://expressjs.com/advanced/security-updates.html)
• app/views/tutorial/a2.html:209 — <li><a href="http://passportjs.org/guide/authenticate/">Passport</a> authentication middleware</li> (value: http://passportjs.org/guide/authenticate/)
• app/views/tutorial/a2.html:207 — <li><a href="http://recxltd.blogspot.sg/2012/03/seven-web-server-http-headers-that.html">Seven Web Server HTTP Headers that Improve Web Application Security for Free</a> (value: http://recxltd.blogspot.sg/2012/03/seven-web-server-http-headers-that.html)
• app/views/tutorial/a9.html:51 — <a href="https://docs.npmjs.com/cli/v6/commands/npm-outdated">npm outdated</a> and <a href="https://classic.yarnpkg.com/en/docs/cli/outdated">yarn outdated</a> are both command line ways to show possi (value: https://classic.yarnpkg.com/en/docs/cli/outdated)
• app/views/tutorial/a9.html:57 — <a href="https://david-dm.org/">David DM</a> gets you an overview of your project dependencies, the version you use and the latest available, so you can quickly see what's drifting (value: https://david-dm.org/)
• app/views/research.html:17 — <input type="hidden" id="url" name="url" value="https://finance.yahoo.com/quote/"/> (value: https://finance.yahoo.com/quote/)
• app/views/tutorial/a9.html:41 — <a href="https://github.com/advisories">GitHub Advisory Database</a> (value: https://github.com/advisories)
• package.json:51 — "grunt-if": "https://github.com/binarymist/grunt-if/tarball/master", (value: https://github.com/binarymist/grunt-if/tarball/master)
• app/views/tutorial/a9.html:113 — The demo web application is using a popular library called <a href="https://github.com/chjj/marked"> Marked </a> which is a Markdown parser in JavaScript and provides an easy way to integrate markdown (value: https://github.com/chjj/marked)
• app/views/tutorial/redos.html:33 — Use Node.js's <a href="https://github.com/chriso/validator.js/">validator.js</a> package to validate expected data format instead of writing your own regular expressions (value: https://github.com/chriso/validator.js/)
• app/views/tutorial/a8.html:59 — </pre> Note: A sample app containing form for CSRF attack on NodeGoat app is available <a target="_blank" href="https://github.com/ckarande/nodegoat-csrf-attack">here</a>. (value: https://github.com/ckarande/nodegoat-csrf-attack)
• app/views/tutorial/redos.html:37 — <a href="https://github.com/substack/safe-regex">safe-regex</a> package which allows detecting if a regex is prone to catastrophic backtracking, and also allows to configure threshold for maximum repe (value: https://github.com/substack/safe-regex)
• Gruntfile.js:105 — console.log("https://github.com/vuejs/vue-router/issues/261"); (value: https://github.com/vuejs/vue-router/issues/261)
• app/views/tutorial/a1.html:179 — <li><a target="_blank" href="https://media.blackhat.com/bh-us-11/Sullivan/BH_US_11_Sullivan_Server_Side_WP.pdf">“ServerSide JavaScript Injection: Attacking NoSQL and Node.js"</a> a whitepaper by Bryan (value: https://media.blackhat.com/bh-us-11/Sullivan/BH_US_11_Sullivan_Server_Side_WP.pdf)
• app/views/tutorial/a2.html:206 — <li><a href="https://npmjs.org/package/helmet">Helmet</a> Security header middleware collection for express</li> (value: https://npmjs.org/package/helmet)
• Gruntfile.js:136 — jsRepository: "https://raw.github.com/bekk/retire.js/master/repository/jsrepository.json", (value: https://raw.github.com/bekk/retire.js/master/repository/jsrepository.json)
• Gruntfile.js:137 — nodeRepository: "https://raw.github.com/bekk/retire.js/master/repository/npmrepository.json", (value: https://raw.github.com/bekk/retire.js/master/repository/npmrepository.json)
• app/views/tutorial/a9.html:31 — <a href="https://snyk.io/">Snyk.io</a> is a Node.js CLI tool and Platform to scan and detect vulnerable packages (value: https://snyk.io/)
• app/views/tutorial/a9.html:44 — <a href="https://snyk.io/vuln">Snyk Vulnerability DB</a> (value: https://snyk.io/vuln)
• app/views/layout.html:62 — <li><a id="learn-menu-link" target="_blank" href="/learn?url=https://www.khanacademy.org/economics-finance-domain/core-finance/investment-vehicles-tutorial/ira-401ks/v/traditional-iras"><i class="fa f (value: https://www.khanacademy.org/economics-finance-domain/core-finance/investment-vehicles-tutorial/ira-401ks/v/traditional-iras)
• app/views/tutorial/a5.html:72 — Lock versions of all npm packages used, for example using <a href="https://www.npmjs.org/doc/cli/npm-shrinkwrap.html"> shrinkwarp</a>, to have full control over when to install a new version of the pa (value: https://www.npmjs.org/doc/cli/npm-shrinkwrap.html)
• app/views/tutorial/a3.html:234 — <a href="https://www.owasp.org/images/c/c5/Unraveling_some_Mysteries_around_DOM-based_XSS.pdf ">Unraveling (value: https://www.owasp.org/images/c/c5/Unraveling_some_Mysteries_around_DOM-based_XSS.pdf)
• app.json:9 — "website": "https://www.owasp.org/index.php/Projects/OWASP_Node_js_Goat_Project", (value: https://www.owasp.org/index.php/Projects/OWASP_Node_js_Goat_Project)

Hardcoded IP addresses

operability · source: scanner (hardcoded_infra) · effort: M · id cb11e2dae7b2c585

1 distinct IP addresses hardcoded at 2 location(s), for example 192.168.56.20.

Impact. Fixed addresses break silently when infrastructure moves and expose network layout.

Remediation. Move these values to configuration (environment variables or a config file) and document each one in the deployment guide.

Effort. M: move the values into configuration per environment (scanner rule hardcoded_infra.ip)

Evidence.

• config/env/development.js:3 — zapHostName: "192.168.56.20", (value: 192.168.56.20)
• config/env/test.js:3 — zapHostName: "192.168.56.20", (value: 192.168.56.20)

Known vulnerabilities in ajv 6.10.0

dependency · source: scanner (dependencies) · effort: S · id 31bd27cb9bb80b1a

2 published advisories affect ajv 6.10.0 (npm), declared in package-lock.json: GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using $data option; GHSA-v88g-cgmw-v5xw: Prototype Pollution in Ajv.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade ajv to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-2g4f-4pwh-qvx6, GHSA-v88g-cgmw-v5xw)

Known vulnerabilities in bl 1.0.3

dependency · source: scanner (dependencies) · effort: S · id 9234c46543fbd425

1 published advisory affects bl 1.0.3 (npm), declared in package-lock.json: GHSA-pp7h-53gx-mx7r: Remote Memory Exposure in bl.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade bl to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-pp7h-53gx-mx7r)

Known vulnerabilities in bl 1.1.2

dependency · source: scanner (dependencies) · effort: S · id 6fc158a997a3cab6

1 published advisory affects bl 1.1.2 (npm), declared in package-lock.json: GHSA-pp7h-53gx-mx7r: Remote Memory Exposure in bl.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade bl to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-pp7h-53gx-mx7r)

Known vulnerabilities in express 4.16.4

dependency · source: scanner (dependencies) · effort: S · id 080359d31f4d677c

2 published advisories affect express 4.16.4 (npm), declared in package-lock.json: GHSA-qw6h-vgh9-j6wx: express vulnerable to XSS via response.redirect(); GHSA-rv95-896h-c2vc: Express.js Open Redirect in malformed URLs.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade express to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-qw6h-vgh9-j6wx, GHSA-rv95-896h-c2vc)

Known vulnerabilities in extend 3.0.0

dependency · source: scanner (dependencies) · effort: S · id d79fd8b41579d1e9

1 published advisory affects extend 3.0.0 (npm), declared in package-lock.json: GHSA-qrmc-fj45-qfc2: Prototype Pollution in extend.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade extend to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-qrmc-fj45-qfc2)

Known vulnerabilities in got 6.7.1

dependency · source: scanner (dependencies) · effort: S · id 9c689ad3755fd398

1 published advisory affects got 6.7.1 (npm), declared in package-lock.json: GHSA-pfrx-2q88-qq97: Got allows a redirect to a UNIX socket.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade got to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-pfrx-2q88-qq97)

Known vulnerabilities in helmet-csp 1.2.2

dependency · source: scanner (dependencies) · effort: S · id eb39c7dbd4067a1d

1 published advisory affects helmet-csp 1.2.2 (npm), declared in package-lock.json: GHSA-c3m8-x3cg-qm2c: Configuration Override in helmet-csp.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade helmet-csp to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-c3m8-x3cg-qm2c)

Known vulnerabilities in hosted-git-info 2.1.5

dependency · source: scanner (dependencies) · effort: S · id c4b04389367d936b

1 published advisory affects hosted-git-info 2.1.5 (npm), declared in package-lock.json: GHSA-43f8-2h32-f4cj: Regular Expression Denial of Service in hosted-git-info.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade hosted-git-info to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-43f8-2h32-f4cj)

Known vulnerabilities in hosted-git-info 2.7.1

dependency · source: scanner (dependencies) · effort: S · id 7187ceb0062f5b91

1 published advisory affects hosted-git-info 2.7.1 (npm), declared in package-lock.json: GHSA-43f8-2h32-f4cj: Regular Expression Denial of Service in hosted-git-info.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade hosted-git-info to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-43f8-2h32-f4cj)

Known vulnerabilities in is-my-json-valid 2.15.0

dependency · source: scanner (dependencies) · effort: S · id 7feeaaa5fcaea64f

1 published advisory affects is-my-json-valid 2.15.0 (npm), declared in package-lock.json: GHSA-4hpf-3wq7-5rpr: Regular expression deinal of service (ReDoS) in is-my-json-valid.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade is-my-json-valid to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-4hpf-3wq7-5rpr)

Known vulnerabilities in jsonpointer 4.0.0

dependency · source: scanner (dependencies) · effort: S · id 68cb97edadbae3e4

1 published advisory affects jsonpointer 4.0.0 (npm), declared in package-lock.json: GHSA-282f-qqgm-c34q: Prototype Pollution in node-jsonpointer.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade jsonpointer to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-282f-qqgm-c34q)

Known vulnerabilities in jsonpointer 4.0.1

dependency · source: scanner (dependencies) · effort: S · id f3f0f9554cfc21e9

1 published advisory affects jsonpointer 4.0.1 (npm), declared in package-lock.json: GHSA-282f-qqgm-c34q: Prototype Pollution in node-jsonpointer.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade jsonpointer to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-282f-qqgm-c34q)

Known vulnerabilities in micromatch 2.3.11

dependency · source: scanner (dependencies) · effort: S · id 13cd3faa49512d1a

1 published advisory affects micromatch 2.3.11 (npm), declared in package-lock.json: GHSA-952p-6rrq-rcjv: Regular Expression Denial of Service (ReDoS) in micromatch.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade micromatch to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-952p-6rrq-rcjv)

Known vulnerabilities in micromatch 3.1.10

dependency · source: scanner (dependencies) · effort: S · id 7fe16fadabfe99d5

1 published advisory affects micromatch 3.1.10 (npm), declared in package-lock.json: GHSA-952p-6rrq-rcjv: Regular Expression Denial of Service (ReDoS) in micromatch.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade micromatch to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-952p-6rrq-rcjv)

Known vulnerabilities in ms 0.7.1

dependency · source: scanner (dependencies) · effort: S · id 5451bdfe48777b5f

1 published advisory affects ms 0.7.1 (npm), declared in package-lock.json: GHSA-w9mr-4mfr-499f: Vercel ms Inefficient Regular Expression Complexity vulnerability.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade ms to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-w9mr-4mfr-499f)

Known vulnerabilities in path-parse 1.0.5

dependency · source: scanner (dependencies) · effort: S · id 80bd8a4e2f31f886

1 published advisory affects path-parse 1.0.5 (npm), declared in package-lock.json: GHSA-hj48-42vr-x3v9: Regular Expression Denial of Service in path-parse.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade path-parse to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-hj48-42vr-x3v9)

Known vulnerabilities in randomatic 1.1.5

dependency · source: scanner (dependencies) · effort: S · id abac730967770e4a

1 published advisory affects randomatic 1.1.5 (npm), declared in package-lock.json: GHSA-6g33-f262-xjp4: Cryptographically Weak PRNG in randomatic.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade randomatic to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-6g33-f262-xjp4)

Known vulnerabilities in request 2.36.0

dependency · source: scanner (dependencies) · effort: S · id 076535a3b988e108

2 published advisories affect request 2.36.0 (npm), declared in package-lock.json: GHSA-7xfp-9c55-5vqj: Remote Memory Exposure in request; GHSA-p8p7-x288-28g6: Server-Side Request Forgery in Request.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade request to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-7xfp-9c55-5vqj, GHSA-p8p7-x288-28g6)

Known vulnerabilities in request 2.67.0

dependency · source: scanner (dependencies) · effort: S · id b4925464ab8f8813

2 published advisories affect request 2.67.0 (npm), declared in package-lock.json: GHSA-7xfp-9c55-5vqj: Remote Memory Exposure in request; GHSA-p8p7-x288-28g6: Server-Side Request Forgery in Request.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade request to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-7xfp-9c55-5vqj, GHSA-p8p7-x288-28g6)

Known vulnerabilities in request 2.75.0

dependency · source: scanner (dependencies) · effort: S · id 036848d6f6a3675a

1 published advisory affects request 2.75.0 (npm), declared in package-lock.json: GHSA-p8p7-x288-28g6: Server-Side Request Forgery in Request.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade request to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-p8p7-x288-28g6)

Known vulnerabilities in request 2.79.0

dependency · source: scanner (dependencies) · effort: S · id a2ec2c2045122038

1 published advisory affects request 2.79.0 (npm), declared in package-lock.json: GHSA-p8p7-x288-28g6: Server-Side Request Forgery in Request.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade request to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-p8p7-x288-28g6)

Known vulnerabilities in request 2.88.0

dependency · source: scanner (dependencies) · effort: S · id 6f4156345bf302e7

1 published advisory affects request 2.88.0 (npm), declared in package-lock.json: GHSA-p8p7-x288-28g6: Server-Side Request Forgery in Request.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade request to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-p8p7-x288-28g6)

Known vulnerabilities in send 0.16.2

dependency · source: scanner (dependencies) · effort: S · id c0b2917d05787a53

1 published advisory affects send 0.16.2 (npm), declared in package-lock.json: GHSA-m6fv-jmcg-4jfg: send vulnerable to template injection that can lead to XSS.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade send to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-m6fv-jmcg-4jfg)

Known vulnerabilities in serve-static 1.13.2

dependency · source: scanner (dependencies) · effort: S · id 84eec6fe5da6d12e

1 published advisory affects serve-static 1.13.2 (npm), declared in package-lock.json: GHSA-cm22-4g7w-348p: serve-static vulnerable to template injection that can lead to XSS.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade serve-static to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-cm22-4g7w-348p)

Known vulnerabilities in stringstream 0.0.5

dependency · source: scanner (dependencies) · effort: S · id 5fba0d8cf32f9f52

1 published advisory affects stringstream 0.0.5 (npm), declared in package-lock.json: GHSA-mf6x-7mm4-x2g7: Out-of-bounds Read in stringstream.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade stringstream to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-mf6x-7mm4-x2g7)

Known vulnerabilities in tough-cookie 2.3.4

dependency · source: scanner (dependencies) · effort: S · id 6abd3656aeac5d20

1 published advisory affects tough-cookie 2.3.4 (npm), declared in package-lock.json: GHSA-72xf-g2v4-qvf3: tough-cookie Prototype Pollution vulnerability.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade tough-cookie to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-72xf-g2v4-qvf3)

Known vulnerabilities in tough-cookie 2.4.3

dependency · source: scanner (dependencies) · effort: S · id 2d7bf77028306507

1 published advisory affects tough-cookie 2.4.3 (npm), declared in package-lock.json: GHSA-72xf-g2v4-qvf3: tough-cookie Prototype Pollution vulnerability.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade tough-cookie to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-72xf-g2v4-qvf3)

Known vulnerabilities in tunnel-agent 0.4.3

dependency · source: scanner (dependencies) · effort: S · id 8beaf39971051c60

1 published advisory affects tunnel-agent 0.4.3 (npm), declared in package-lock.json: GHSA-xc7v-wxcw-j472: Memory Exposure in tunnel-agent.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade tunnel-agent to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-xc7v-wxcw-j472)

Known vulnerabilities in undefsafe 2.0.2

dependency · source: scanner (dependencies) · effort: S · id f7411d9164a0fb35

1 published advisory affects undefsafe 2.0.2 (npm), declared in package-lock.json: GHSA-332q-7ff2-57h2: Prototype Pollution in undefsafe.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade undefsafe to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-332q-7ff2-57h2)

Known vulnerabilities in xml2js 0.4.4

dependency · source: scanner (dependencies) · effort: S · id ef60942483830d38

1 published advisory affects xml2js 0.4.4 (npm), declared in package-lock.json: GHSA-776f-qx25-q3cc: xml2js is vulnerable to prototype pollution.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade xml2js to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-776f-qx25-q3cc)

Known vulnerabilities in yargs-parser 2.4.1

dependency · source: scanner (dependencies) · effort: S · id 87dbd776b62dadf7

1 published advisory affects yargs-parser 2.4.1 (npm), declared in package-lock.json: GHSA-p9pc-299p-vxgp: yargs-parser Vulnerable to Prototype Pollution.

Impact. The tool ships a dependency with publicly documented weaknesses; exploit details for published advisories are usually available.

Remediation. Upgrade yargs-parser to a release that fixes these advisories, then re-run the scan. Check the advisories for configuration workarounds if an upgrade must wait.

Effort. S: upgrade the package; more across a major version (scanner rule dependencies.advisories)

Evidence.

• package-lock.json (advisories: GHSA-p9pc-299p-vxgp)

Low (7)

One row per finding. Impact, remediation, and excerpts for each are in analysis/findings.json, and unvarnish ask can explain any of them.

Not analysed

Excluded from analysis but counted in totals:

• lockfile: 1 file(s) — e.g. package-lock.json
• vendored:vendor: 15 file(s) — e.g. app/assets/vendor/bootstrap/bootstrap-tour.css, app/assets/vendor/bootstrap/bootstrap-tour.js, app/assets/vendor/bootstrap/bootstrap.css, app/assets/vendor/bootstrap/bootstrap.js, app/assets/vendor/chart/morris-0.4.3.min.js

Binary files (3): app/assets/favicon.ico, app/assets/images/nodegoat_logo.png, app/assets/images/owasplogo.png

Hardcoded-infrastructure scanning reads the first 4,000 characters of each line.