npm audit --omit=dev reports 11 vulnerabilities affecting runtime: 6 high severity and 5 moderate. Direct dependencies include @giphy/js-util (uuid indirect via transitive), pdfjs-dist (high — arbitrary JS execution on opening malicious PDF), react-router-dom (moderate), sanitize-html (moderate), katex (moderate). Indirect vulnerabilities via build/dev include brace-expansion (3 high-severity DoS), js-yaml (high), nanoid (high), postcss (moderate), react-router (moderate).
Lead review note: the sanitize-html advisories were checked against this client's usage (src/app/utils/sanitize.ts) and are not exploitable here (no form/button/video tags allowed, img src rewritten before scheme filtering, output goes through html-react-parser). Still worth bumping. pdfjs-dist (GHSA-hq66-cqwq-w95j, arbitrary JS on opening a malicious PDF) is the one that matters most since the client has an inline PDF viewer.
How to trigger
Production build includes vulnerable dependencies; CI runs npm audit only as informational (continue-on-error), so vulnerabilities don't block deploy.
Suggested fix
pdfjs-dist 5.7.284 → ≥6.2.108 (current is vulnerable in range >=5.6.83 <6.2.108; fix requires major version jump). Check release notes for breaking changes before bumping.
brace-expansion (transitive, used by build deps) — coordinate upgrades in listr/globby/etc. or add a constraint in package-lock
CI gate: Raise npm audit --audit-level=high from informational to hard-fail (or add a npm audit --audit-level=moderate check) to catch future vulnerabilities before they ship.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** high · **Type:** dependencies · **Confidence:** high
**Location:** `package.json` dependencies (via `npm audit --omit=dev --json`)
### Problem
`npm audit --omit=dev` reports 11 vulnerabilities affecting runtime: 6 high severity and 5 moderate. Direct dependencies include `@giphy/js-util` (uuid indirect via transitive), `pdfjs-dist` (high — arbitrary JS execution on opening malicious PDF), `react-router-dom` (moderate), `sanitize-html` (moderate), `katex` (moderate). Indirect vulnerabilities via build/dev include `brace-expansion` (3 high-severity DoS), `js-yaml` (high), `nanoid` (high), `postcss` (moderate), `react-router` (moderate).
**Lead review note:** the sanitize-html advisories were checked against this client's usage (`src/app/utils/sanitize.ts`) and are not exploitable here (no form/button/video tags allowed, img src rewritten before scheme filtering, output goes through html-react-parser). Still worth bumping. pdfjs-dist (GHSA-hq66-cqwq-w95j, arbitrary JS on opening a malicious PDF) is the one that matters most since the client has an inline PDF viewer.
### How to trigger
Production build includes vulnerable dependencies; CI runs `npm audit` only as informational (continue-on-error), so vulnerabilities don't block deploy.
### Suggested fix
- **pdfjs-dist 5.7.284 → ≥6.2.108** (current is vulnerable in range >=5.6.83 <6.2.108; fix requires major version jump). Check release notes for breaking changes before bumping.
- **react-router-dom 7.15.1 → 7.18.3+** (patch update, safe)
- **sanitize-html → 2.17.5+** (patch update, safe)
- **katex → 0.16.47+** (patch update, safe)
- **@giphy/js-util → 2.0.0** (major, fixes uuid transitive vulnerability)
- **brace-expansion** (transitive, used by build deps) — coordinate upgrades in listr/globby/etc. or add a constraint in package-lock
- **CI gate:** Raise `npm audit --audit-level=high` from informational to hard-fail (or add a `npm audit --audit-level=moderate` check) to catch future vulnerabilities before they ship.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · High milestone 2026-09-12 01:50:56 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: high · Type: dependencies · Confidence: high
Location:
package.jsondependencies (vianpm audit --omit=dev --json)Problem
npm audit --omit=devreports 11 vulnerabilities affecting runtime: 6 high severity and 5 moderate. Direct dependencies include@giphy/js-util(uuid indirect via transitive),pdfjs-dist(high — arbitrary JS execution on opening malicious PDF),react-router-dom(moderate),sanitize-html(moderate),katex(moderate). Indirect vulnerabilities via build/dev includebrace-expansion(3 high-severity DoS),js-yaml(high),nanoid(high),postcss(moderate),react-router(moderate).Lead review note: the sanitize-html advisories were checked against this client's usage (
src/app/utils/sanitize.ts) and are not exploitable here (no form/button/video tags allowed, img src rewritten before scheme filtering, output goes through html-react-parser). Still worth bumping. pdfjs-dist (GHSA-hq66-cqwq-w95j, arbitrary JS on opening a malicious PDF) is the one that matters most since the client has an inline PDF viewer.How to trigger
Production build includes vulnerable dependencies; CI runs
npm auditonly as informational (continue-on-error), so vulnerabilities don't block deploy.Suggested fix
npm audit --audit-level=highfrom informational to hard-fail (or add anpm audit --audit-level=moderatecheck) to catch future vulnerabilities before they ship.Filed from the September 2026 client audit (branch
lotus@4bea4895).