Mark/redlens
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[Security] HIGH: 2 critical/high dependency vulns #35

New issue
Closed
opened 2026-05-17 10:05:29 +00:00 by Mark · 2 comments
Mark commented 2026-05-17 10:05:29 +00:00
Owner
Copy link

Critical/High Severity Dependency Vulnerancies

drizzle-orm

  • Severity: HIGH
  • CVEs: 1116251
  • Current version: <0.45.2
  • Fix available: {'name': 'drizzle-orm', 'version': '0.45.2', 'isSemVerMajor': True}
  • Direct dependency: True
  • Details: drizzle-orm: 1116251

next

  • Severity: HIGH
  • CVEs: 1112593, 1112653, 1114897, 1114940, 1116376, 1117931, 1118942, 1118944, 1118946, 1118948, 1118952, 1118954, 1118958, 1118962
  • Current version: 9.3.4-canary.0 - 16.3.0-canary.5
  • Fix available: {'name': 'next', 'version': '16.2.6', 'isSemVerMajor': True}
  • Direct dependency: True
  • Details: next: 1112593 1112653 1114897 1114940 1116376 1117931 1118942 1118944 1118946 1118948 1118952 1118954 1118958 1118962

Auto-filed by security-sweep.py on 2026-05-17 03:05 UTC

## Critical/High Severity Dependency Vulnerancies ### drizzle-orm - **Severity:** HIGH - **CVEs:** 1116251 - **Current version:** <0.45.2 - **Fix available:** {'name': 'drizzle-orm', 'version': '0.45.2', 'isSemVerMajor': True} - **Direct dependency:** True - **Details:** drizzle-orm: 1116251 ### next - **Severity:** HIGH - **CVEs:** 1112593, 1112653, 1114897, 1114940, 1116376, 1117931, 1118942, 1118944, 1118946, 1118948, 1118952, 1118954, 1118958, 1118962 - **Current version:** 9.3.4-canary.0 - 16.3.0-canary.5 - **Fix available:** {'name': 'next', 'version': '16.2.6', 'isSemVerMajor': True} - **Direct dependency:** True - **Details:** next: 1112593 1112653 1114897 1114940 1116376 1117931 1118942 1118944 1118946 1118948 1118952 1118954 1118958 1118962 --- *Auto-filed by security-sweep.py on 2026-05-17 03:05 UTC*
Mark commented 2026-05-19 04:54:02 +00:00
Author
Owner
Copy link

Investigation Results

After investigating the repository, I found that drizzle-orm and next do not exist in this project's dependencies:

  • Checking app/package.json: Neither package is listed
  • Checking app/package-lock.json: Neither package appears
  • Running npm audit: No vulnerabilities reported for these packages

This appears to be a false positive from the security-sweep.py script. The project is a Vite-based React application (not Next.js) and doesn't use Drizzle ORM.

Actual Vulnerabilities Fixed

The npm audit revealed 9 actual vulnerabilities (6 HIGH, 3 MODERATE) in transitive dependencies:

Package Severity Fix
lodash HIGH upgraded to 4.60.4
flatted HIGH upgraded via transitive deps
minimatch HIGH upgraded via transitive deps
picomatch HIGH upgraded via transitive deps
rollup HIGH upgraded via transitive deps
vite HIGH upgraded via transitive deps
ajv MODERATE upgraded via transitive deps
brace-expansion MODERATE upgraded via transitive deps
postcss MODERATE upgraded via transitive deps

Resolution

Fixed via commit 653746a: ran npm audit fix which resolved all 9 vulnerabilities. Build and typecheck both pass successfully.

Recommendation

The security-sweep.py script should be updated to verify dependencies actually exist in the project before filing issues. This prevents false positives like this one.

## Investigation Results After investigating the repository, I found that **drizzle-orm** and **next** do not exist in this project's dependencies: - Checking `app/package.json`: Neither package is listed - Checking `app/package-lock.json`: Neither package appears - Running `npm audit`: No vulnerabilities reported for these packages This appears to be a **false positive** from the security-sweep.py script. The project is a Vite-based React application (not Next.js) and doesn't use Drizzle ORM. ## Actual Vulnerabilities Fixed The `npm audit` revealed 9 actual vulnerabilities (6 HIGH, 3 MODERATE) in transitive dependencies: | Package | Severity | Fix | |---------|----------|-----| | lodash | HIGH | upgraded to 4.60.4 | | flatted | HIGH | upgraded via transitive deps | | minimatch | HIGH | upgraded via transitive deps | | picomatch | HIGH | upgraded via transitive deps | | rollup | HIGH | upgraded via transitive deps | | vite | HIGH | upgraded via transitive deps | | ajv | MODERATE | upgraded via transitive deps | | brace-expansion | MODERATE | upgraded via transitive deps | | postcss | MODERATE | upgraded via transitive deps | ## Resolution Fixed via commit `653746a`: ran `npm audit fix` which resolved all 9 vulnerabilities. Build and typecheck both pass successfully. ## Recommendation The security-sweep.py script should be updated to verify dependencies actually exist in the project before filing issues. This prevents false positives like this one.
Mark closed this issue 2026-05-19 04:54:06 +00:00
Mark commented 2026-05-19 04:54:17 +00:00
Author
Owner
Copy link

Quickfix applied via opencode.

Quickfix applied via opencode.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
blocked:gate-lint

   
blocked:needs-decision

   
blocked:needs-human

   
blocked:verify-failed

   
bug

   
enhancement

   
feature-request

   
in-progress

Issue is currently being worked on by a quickfix runner

  
needs-decompose

Issue needs decompose processing

  
needs-triage

Needs triage evaluation before queue routing

  
ops-task

   
quickfix

   
security/high

High severity security issue

  
test-coverage

Test coverage review / gap report

  
triage-approved
No labels
blocked:gate-lint
blocked:needs-decision
blocked:needs-human
blocked:verify-failed
bug
enhancement
feature-request
in-progress
needs-decompose
needs-triage
ops-task
quickfix
security/high
test-coverage
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Mark/redlens#35
No description provided.