preset-classic-3.9.2.tgz: 21 vulnerabilities (highest severity is: 8.2) #305

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/postcss-npm-8.5.6-e7f126c6f3-10c0.zip

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Vulnerable Library - svgo-3.3.2.tgz

Library home page: https://registry.npmjs.org/svgo/-/svgo-3.3.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/svgo-npm-3.3.2-69e1d32944-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • plugin-svgr-3.9.2.tgz
    • webpack-8.1.0.tgz
      • plugin-svgo-8.1.0.tgz
        • ❌ svgo-3.3.2.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor elements such as svg:a with href or namespaced *:href values, and it does not remove ASCII tab, line-feed, or carriage-return characters before checking URL schemes. Browsers remove those characters before parsing a scheme, allowing an executable link to pass the plugin's check. When an application processes attacker-controlled SVG input and serves the result in an active browser context, a victim who activates the surviving link can execute script in the SVG's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

Publish Date: 2026年09月01日

URL: CVE-2026-84370

CVSS 3 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-w27v-7q3p-w38r

Release Date: 2026年09月01日

Fix Resolution: svgo - 4.1.0,svgo - 3.3.5,svgo - 2.8.4,https://github.com/svg/svgo.git - v3.3.5,https://github.com/svg/svgo.git - v2.8.4,https://github.com/svg/svgo.git - v4.1.0

Step up your Open Source Security Game with Mend here

Vulnerable Library - svgo-3.3.2.tgz

Library home page: https://registry.npmjs.org/svgo/-/svgo-3.3.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/svgo-npm-3.3.2-69e1d32944-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • plugin-svgr-3.9.2.tgz
    • webpack-8.1.0.tgz
      • plugin-svgo-8.1.0.tgz
        • ❌ svgo-3.3.2.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as "svg:script" (svg:script) and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026年08月13日

URL: CVE-2026-73650

CVSS 3 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026年08月13日

Fix Resolution: https://github.com/svg/svgo.git - v3.3.4,https://github.com/svg/svgo.git - v4.0.2

Step up your Open Source Security Game with Mend here

Vulnerable Library - plugin-transform-modules-systemjs-7.28.5.tgz

This plugin transforms ES2015 modules to SystemJS

Library home page: https://registry.npmjs.org/@⁠babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.28.5.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/@⁠babel-plugin-transform-modules-systemjs-npm-7.28.5-1fe3e218f1-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • plugin-svgr-3.9.2.tgz
    • webpack-8.1.0.tgz
      • preset-env-7.28.6.tgz
        • ❌ plugin-transform-modules-systemjs-7.28.5.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.

Publish Date: 2026年05月26日

URL: CVE-2026-44728

CVSS 3 Score Details (8.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-fv7c-fp4j-7gwp

Release Date: 2026年05月09日

Fix Resolution (@⁠babel/plugin-transform-modules-systemjs): 7.29.4

Direct dependency fix Resolution (@⁠docusaurus/preset-classic): 3.10.0

Step up your Open Source Security Game with Mend here

Vulnerable Library - lodash-4.17.23.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/lodash-npm-4.17.23-50bdb1c01a-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • plugin-content-blog-3.9.2.tgz
    • ❌ lodash-4.17.23.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

Impact:
The fix for CVE-2021-23337 (GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.
When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.
Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
Patches:
Users should upgrade to version 4.18.0.
Workarounds:
Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.

Publish Date: 2026年03月31日

URL: CVE-2026-4800

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-r5fr-rjxr-66jc

Release Date: 2026年03月31日

Fix Resolution: lodash-amd - 4.18.0,lodash.template - 4.18.0,lodash-es - 4.18.0,lodash - 4.18.0

Step up your Open Source Security Game with Mend here

Vulnerable Library - js-yaml-4.1.1.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/js-yaml-npm-4.1.1-86ec786790-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • plugin-content-docs-3.9.2.tgz
    • ❌ js-yaml-4.1.1.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.

Publish Date: 2026年09月01日

URL: CVE-2026-84375

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-2883-xcg3-v3hh

Release Date: 2026年09月01日

Fix Resolution: js-yaml - 3.15.2,js-yaml - 4.3.2,js-yaml - 4.3.2,js-yaml - 3.15.2,https://github.com/nodeca/js-yaml.git - 4.3.2,https://github.com/nodeca/js-yaml.git - 3.15.2

Step up your Open Source Security Game with Mend here

Vulnerable Library - postcss-8.5.6.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/postcss-npm-8.5.6-e7f126c6f3-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • theme-classic-3.9.2.tgz
    • ❌ postcss-8.5.6.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.

Publish Date: 2026年08月17日

URL: CVE-2026-73646

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026年08月13日

Fix Resolution: https://github.com/postcss/postcss.git - 8.5.18

Step up your Open Source Security Game with Mend here

Vulnerable Library - js-yaml-4.1.1.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/js-yaml-npm-4.1.1-86ec786790-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • plugin-content-docs-3.9.2.tgz
    • ❌ js-yaml-4.1.1.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Publish Date: 2026年07月08日

URL: CVE-2026-59869

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2026年07月08日

Fix Resolution (js-yaml): 4.3.0

Direct dependency fix Resolution (@⁠docusaurus/preset-classic): 3.10.0

Step up your Open Source Security Game with Mend here

Vulnerable Library - postcss-8.5.6.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/postcss-npm-8.5.6-e7f126c6f3-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • theme-classic-3.9.2.tgz
    • ❌ postcss-8.5.6.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

Publish Date: 2026年07月27日

URL: CVE-2026-45623

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026年07月23日

Fix Resolution (postcss): 8.5.12

Direct dependency fix Resolution (@⁠docusaurus/preset-classic): 3.10.0

Step up your Open Source Security Game with Mend here

Vulnerable Library - svgo-3.3.2.tgz

Library home page: https://registry.npmjs.org/svgo/-/svgo-3.3.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/svgo-npm-3.3.2-69e1d32944-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • plugin-svgr-3.9.2.tgz
    • webpack-8.1.0.tgz
      • plugin-svgo-8.1.0.tgz
        • ❌ svgo-3.3.2.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file (811 bytes) stalling the application and even crashing the Node.js process with JavaScript heap out of memory. This issue has been patched in versions 2.8.1, 3.3.3, and 4.0.1.

Publish Date: 2026年03月06日

URL: CVE-2026-29074

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-xpqw-6gx7-v673

Release Date: 2026年03月05日

Fix Resolution: svgo - 3.3.3,svgo - 4.0.1,svgo - 2.8.1

Step up your Open Source Security Game with Mend here

Vulnerable Library - nanoid-3.3.11.tgz

A tiny (116 bytes), secure URL-friendly unique string ID generator

Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/nanoid-npm-3.3.11-f98c1f9ef6-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • theme-classic-3.9.2.tgz
    • rtlcss-4.3.0.tgz
      • postcss-8.5.6.tgz
        • ❌ nanoid-3.3.11.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

Publish Date: 2026年08月11日

URL: CVE-2026-73086

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-xwg4-73v4-xw9w

Release Date: 2026年08月11日

Fix Resolution (nanoid): 3.3.12

Direct dependency fix Resolution (@⁠docusaurus/preset-classic): 3.10.0

Step up your Open Source Security Game with Mend here

Vulnerable Library - lodash-4.17.23.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/lodash-npm-4.17.23-50bdb1c01a-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • plugin-content-blog-3.9.2.tgz
    • ❌ lodash-4.17.23.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

Impact:
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.
The issue permits deletion of prototype properties but does not allow overwriting their original behavior.
Patches:
This issue is patched in 4.18.0.
Workarounds:
None. Upgrade to the patched version.

Publish Date: 2026年03月31日

URL: CVE-2026-2950

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: GHSA-xxjr-mmjv-4gpg

Release Date: 2026年03月31日

Fix Resolution: lodash-es - 4.17.23,lodash-amd - 4.17.23,lodash - 4.17.23

Step up your Open Source Security Game with Mend here

Vulnerable Library - svgo-3.3.2.tgz

Library home page: https://registry.npmjs.org/svgo/-/svgo-3.3.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/svgo-npm-3.3.2-69e1d32944-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • plugin-svgr-3.9.2.tgz
    • webpack-8.1.0.tgz
      • plugin-svgo-8.1.0.tgz
        • ❌ svgo-3.3.2.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3 and implemented in plugins/removeScripts.js, removes SVG and XHTML script elements but does not inspect executable HTML content inside SVG foreignObject elements. Event-handler attributes such as onload and onbeforetoggle, srcdoc documents, and executable URLs in the action, data, formaction, href, and src attributes can remain in attacker-controlled SVG input. When an application uses the plugin as its only protection and serves the optimized SVG in an active browser context, the payload can execute script in the viewer's origin, expose data, modify content, or perform actions as the victim. This issue is fixed in versions 2.8.4, 3.3.5, and 4.1.0.

Publish Date: 2026年09月01日

URL: CVE-2026-84369

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-4vpr-x523-8j87

Release Date: 2026年09月01日

Fix Resolution: svgo - 2.8.4,svgo - 4.1.0,svgo - 3.3.5,https://github.com/svg/svgo.git - v3.3.5,https://github.com/svg/svgo.git - v2.8.4,https://github.com/svg/svgo.git - v4.1.0

Step up your Open Source Security Game with Mend here

Vulnerable Library - postcss-8.5.6.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/postcss-npm-8.5.6-e7f126c6f3-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • theme-classic-3.9.2.tgz
    • ❌ postcss-8.5.6.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape "</style>" sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML "<style>" tags, "</style>" in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.

Publish Date: 2026年04月24日

URL: CVE-2026-41305

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-qx2v-qp2m-jg93

Release Date: 2026年04月24日

Fix Resolution (postcss): 8.5.10

Direct dependency fix Resolution (@⁠docusaurus/preset-classic): 3.10.0

Step up your Open Source Security Game with Mend here

Vulnerable Library - nanoid-3.3.11.tgz

A tiny (116 bytes), secure URL-friendly unique string ID generator

Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/nanoid-npm-3.3.11-f98c1f9ef6-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • theme-classic-3.9.2.tgz
    • rtlcss-4.3.0.tgz
      • postcss-8.5.6.tgz
        • ❌ nanoid-3.3.11.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Publish Date: 2026年07月29日

URL: CVE-2026-67214

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2026年07月29日

Fix Resolution: https://github.com/ai/nanoid.git - 5.1.16

Step up your Open Source Security Game with Mend here

Vulnerable Library - nanoid-3.3.11.tgz

A tiny (116 bytes), secure URL-friendly unique string ID generator

Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/nanoid-npm-3.3.11-f98c1f9ef6-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • theme-classic-3.9.2.tgz
    • rtlcss-4.3.0.tgz
      • postcss-8.5.6.tgz
        • ❌ nanoid-3.3.11.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Publish Date: 2026年07月29日

URL: CVE-2026-67213

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2026年07月29日

Fix Resolution: https://github.com/ai/nanoid.git - 5.1.6

Step up your Open Source Security Game with Mend here

Vulnerable Library - postcss-8.5.6.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/postcss-npm-8.5.6-e7f126c6f3-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • theme-classic-3.9.2.tgz
    • ❌ postcss-8.5.6.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

Publish Date: 2026年08月03日

URL: CVE-2026-69153

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026年08月03日

Fix Resolution: https://github.com/postcss/postcss.git - 8.5.23

Step up your Open Source Security Game with Mend here

Vulnerable Library - js-yaml-4.1.1.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/js-yaml-npm-4.1.1-86ec786790-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • plugin-content-docs-3.9.2.tgz
    • ❌ js-yaml-4.1.1.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

Publish Date: 2026年06月22日

URL: CVE-2026-53550

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Release Date: 2026年06月15日

Fix Resolution: https://github.com/nodeca/js-yaml.git - 4.2.0

Step up your Open Source Security Game with Mend here

Vulnerable Library - joi-17.13.3.tgz

Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/joi-npm-17.13.3-866dad5bc8-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • types-3.9.2.tgz
    • ❌ joi-17.13.3.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.

Publish Date: 2026年07月14日

URL: CVE-2026-48038

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Release Date: 2026年06月12日

Fix Resolution: https://github.com/hapijs/joi.git - 17.13.4

Step up your Open Source Security Game with Mend here

Vulnerable Library - joi-17.13.3.tgz

Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/joi-npm-17.13.3-866dad5bc8-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • types-3.9.2.tgz
    • ❌ joi-17.13.3.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @⁠hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named proto writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @⁠hapi/joi version is available.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026年09月01日

URL: CVE-2026-84368

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-6w3j-5fw6-r9vr

Release Date: 2026年09月01日

Fix Resolution: joi - 18.2.5,joi - 17.13.6,https://github.com/hapijs/joi.git - v18.2.5,https://github.com/hapijs/joi.git - v17.13.6

Step up your Open Source Security Game with Mend here

Vulnerable Library - joi-17.13.3.tgz

Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/joi-npm-17.13.3-866dad5bc8-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • types-3.9.2.tgz
    • ❌ joi-17.13.3.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-proto with an object value, causing the target to render as proto and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026年09月01日

URL: CVE-2026-84367

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-gg4h-3hg2-grpc

Release Date: 2026年09月01日

Fix Resolution: joi - 18.2.4,joi - 17.13.5,https://github.com/hapijs/joi.git - v18.2.4,https://github.com/hapijs/joi.git - v17.13.5

Step up your Open Source Security Game with Mend here

Vulnerable Library - core-7.28.6.tgz

Babel compiler core.

Library home page: https://registry.npmjs.org/@⁠babel/core/-/core-7.28.6.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/@⁠babel-core-npm-7.28.6-0abdbf2b3d-10c0.zip

Dependency Hierarchy:

• preset-classic-3.9.2.tgz (Root Library)
  • plugin-svgr-3.9.2.tgz
    • core-8.1.0.tgz
      • ❌ core-7.28.6.tgz (Vulnerable Library)

Found in HEAD commit: deb491397b42b1b14f6ff7eaf94755865d6483aa

Found in base branch: main

Vulnerability Details

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @⁠babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @⁠babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

Publish Date: 2026年06月22日

URL: CVE-2026-49356

CVSS 3 Score Details (3.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026年06月15日

Fix Resolution: https://github.com/babel/babel.git - 7.29.6,https://github.com/babel/babel.git - 8.0.0-rc.6

Step up your Open Source Security Game with Mend here