[Security] HIGH: 9 critical/high dependency vulns #33

New issue

Closed

opened 2026-05-17 10:08:55 +00:00 by Mark · 1 comment

Mark commented

2026-05-17 10:08:55 +00:00

Owner

Critical/High Severity Dependency Vulnerancies

@babel/plugin-transform-modules-systemjs

Severity: HIGH
CVEs: 1117908
Current version: 7.12.0 - 7.29.0
Fix available: True
Direct dependency: False
Details: @babel/plugin-transform-modules-systemjs: 1117908

axios

Severity: HIGH
CVEs: 1116673, 1116675, 1117574, 1117576, 1117577, 1117580, 1117581, 1117583, 1117585, 1117587, 1117589, 1117591, 1117593, 1117595, 1118607
Current version: 1.0.0 - 1.15.1
Fix available: True
Direct dependency: False
Details: axios: 1116673 1116675 1117574 1117576 1117577 1117580 1117581 1117583 1117585 1117587 1117589 1117591 1117593 1117595 1118607

fast-xml-builder

Severity: HIGH
CVEs: 1118965
Current version: <=1.1.6
Fix available: True
Direct dependency: False
Details: fast-xml-builder: 1118965

flatted

Severity: HIGH
CVEs: 1114526, 1115357
Current version: <=3.4.1
Fix available: True
Direct dependency: False
Details: flatted: 1114526 1115357

lodash

Severity: HIGH
CVEs: 1112455, 1115806, 1115810
Current version: <=4.17.23
Fix available: True
Direct dependency: False
Details: lodash: 1112455 1115806 1115810

minimatch

Severity: HIGH
CVEs: 1113459, 1113465, 1113538, 1113544, 1113546, 1113552
Current version: <=3.1.3 || 9.0.0 - 9.0.6
Fix available: True
Direct dependency: False
Details: minimatch: 1113459 1113465 1113538 1113544 1113546 1113552

picomatch

Severity: HIGH
CVEs: 1115549, 1115551, 1115552, 1115554
Current version: <=2.3.1 || 4.0.0 - 4.0.3
Fix available: True
Direct dependency: False
Details: picomatch: 1115549 1115551 1115552 1115554

rollup

Severity: HIGH
CVEs: 1113515
Current version: 4.0.0 - 4.58.0
Fix available: True
Direct dependency: False
Details: rollup: 1113515

vite

Severity: HIGH
CVEs: 1116230, 1116232, 1116235
Current version: 7.0.0 - 7.3.1
Fix available: True
Direct dependency: True
Details: vite: 1116230 1116232 1116235

Auto-filed by security-sweep.py on 2026-05-17 03:08 UTC

## Critical/High Severity Dependency Vulnerancies ### @babel/plugin-transform-modules-systemjs - **Severity:** HIGH - **CVEs:** 1117908 - **Current version:** 7.12.0 - 7.29.0 - **Fix available:** True - **Direct dependency:** False - **Details:** @babel/plugin-transform-modules-systemjs: 1117908 ### axios - **Severity:** HIGH - **CVEs:** 1116673, 1116675, 1117574, 1117576, 1117577, 1117580, 1117581, 1117583, 1117585, 1117587, 1117589, 1117591, 1117593, 1117595, 1118607 - **Current version:** 1.0.0 - 1.15.1 - **Fix available:** True - **Direct dependency:** False - **Details:** axios: 1116673 1116675 1117574 1117576 1117577 1117580 1117581 1117583 1117585 1117587 1117589 1117591 1117593 1117595 1118607 ### fast-xml-builder - **Severity:** HIGH - **CVEs:** 1118965 - **Current version:** <=1.1.6 - **Fix available:** True - **Direct dependency:** False - **Details:** fast-xml-builder: 1118965 ### flatted - **Severity:** HIGH - **CVEs:** 1114526, 1115357 - **Current version:** <=3.4.1 - **Fix available:** True - **Direct dependency:** False - **Details:** flatted: 1114526 1115357 ### lodash - **Severity:** HIGH - **CVEs:** 1112455, 1115806, 1115810 - **Current version:** <=4.17.23 - **Fix available:** True - **Direct dependency:** False - **Details:** lodash: 1112455 1115806 1115810 ### minimatch - **Severity:** HIGH - **CVEs:** 1113459, 1113465, 1113538, 1113544, 1113546, 1113552 - **Current version:** <=3.1.3 || 9.0.0 - 9.0.6 - **Fix available:** True - **Direct dependency:** False - **Details:** minimatch: 1113459 1113465 1113538 1113544 1113546 1113552 ### picomatch - **Severity:** HIGH - **CVEs:** 1115549, 1115551, 1115552, 1115554 - **Current version:** <=2.3.1 || 4.0.0 - 4.0.3 - **Fix available:** True - **Direct dependency:** False - **Details:** picomatch: 1115549 1115551 1115552 1115554 ### rollup - **Severity:** HIGH - **CVEs:** 1113515 - **Current version:** 4.0.0 - 4.58.0 - **Fix available:** True - **Direct dependency:** False - **Details:** rollup: 1113515 ### vite - **Severity:** HIGH - **CVEs:** 1116230, 1116232, 1116235 - **Current version:** 7.0.0 - 7.3.1 - **Fix available:** True - **Direct dependency:** True - **Details:** vite: 1116230 1116232 1116235 --- *Auto-filed by security-sweep.py on 2026-05-17 03:08 UTC*