[Security] HIGH: 1 critical/high dependency vulns #32

New issue

Closed

opened 2026-05-16 02:08:25 +00:00 by Mark · 2 comments

Mark commented

2026-05-16 02:08:25 +00:00

Owner

Critical/High Severity Dependency Vulnerancies

@babel/plugin-transform-modules-systemjs

Severity: HIGH
CVEs: 1117908
Current version: 7.12.0 - 7.29.0
Fix available: True
Direct dependency: False
Details: @babel/plugin-transform-modules-systemjs: 1117908

Auto-filed by security-sweep.py on 2026-05-15 19:08 UTC

## Critical/High Severity Dependency Vulnerancies ### @babel/plugin-transform-modules-systemjs - **Severity:** HIGH - **CVEs:** 1117908 - **Current version:** 7.12.0 - 7.29.0 - **Fix available:** True - **Direct dependency:** False - **Details:** @babel/plugin-transform-modules-systemjs: 1117908 --- *Auto-filed by security-sweep.py on 2026-05-15 19:08 UTC*

Mark added the

blocked:verify-failed

label

2026-05-16 02:08:25 +00:00

Mark added

triage-approved

quickfix

and removed

blocked:verify-failed

labels

2026-05-18 22:15:41 +00:00

Mark commented

2026-05-19 08:03:52 +00:00

Author

Owner

Investigation Summary

This vulnerability was already fixed before the issue was filed.

Evidence:

Fix already in place: package.json has overrides for @babel/plugin-transform-modules-systemjs at version 7.29.4
Committed: April 9, 2026 in commit 515987267f358e9ef7e5514567d721492355cbc4 ("Add simple-git-hooks and fix security vulnerabilities")
npm audit: Shows 0 vulnerabilities
Build verification: npm run build succeeds ✓

The Override:

"overrides": {
  "@babel/plugin-transform-modules-systemjs": "7.29.4"
}

Version 7.29.4 is outside the vulnerable range (7.12.0 - 7.29.0).

Conclusion

The security-sweep.py script appears to have filed this issue after the fix was already applied. Closing as resolved.

Verified by opencode agent on 2026-05-19

## Investigation Summary This vulnerability was **already fixed** before the issue was filed. ### Evidence: - **Fix already in place**: `package.json` has `overrides` for `@babel/plugin-transform-modules-systemjs` at version `7.29.4` - **Committed**: April 9, 2026 in commit `515987267f358e9ef7e5514567d721492355cbc4` ("Add simple-git-hooks and fix security vulnerabilities") - **npm audit**: Shows **0 vulnerabilities** - **Build verification**: `npm run build` succeeds ✓ ### The Override: ```json "overrides": { "@babel/plugin-transform-modules-systemjs": "7.29.4" } ``` Version `7.29.4` is outside the vulnerable range (`7.12.0 - 7.29.0`). ### Conclusion The security-sweep.py script appears to have filed this issue after the fix was already applied. Closing as resolved. --- *Verified by opencode agent on 2026-05-19*

Mark closed this issue

2026-05-19 08:03:53 +00:00

Mark commented

2026-05-19 08:04:11 +00:00

Author

Owner

Quickfix applied via opencode.

Mark removed the

quickfix

triage-approved

labels

2026-05-19 08:04:11 +00:00