[Security] HIGH: 7 critical/high dependency vulns #8

New issue

Closed

opened 2026-05-17 10:16:16 +00:00 by Mark · 1 comment

Mark commented

2026-05-17 10:16:16 +00:00

Owner

Critical/High Severity Dependency Vulnerancies

@babel/plugin-transform-modules-systemjs

Severity: HIGH
CVEs: 1117908
Current version: 7.12.0 - 7.29.0
Fix available: True
Direct dependency: False
Details: @babel/plugin-transform-modules-systemjs: 1117908

flatted

Severity: HIGH
CVEs: 1114526, 1115357
Current version: <=3.4.1
Fix available: True
Direct dependency: False
Details: flatted: 1114526 1115357

lodash

Severity: HIGH
CVEs: 1112455, 1115806, 1115810
Current version: <=4.17.23
Fix available: True
Direct dependency: False
Details: lodash: 1112455 1115806 1115810

minimatch

Severity: HIGH
CVEs: 1113459, 1113465, 1113538, 1113544, 1113546, 1113552
Current version: <=3.1.3 || 9.0.0 - 9.0.6
Fix available: True
Direct dependency: False
Details: minimatch: 1113459 1113465 1113538 1113544 1113546 1113552

picomatch

Severity: HIGH
CVEs: 1115549, 1115551, 1115552, 1115554
Current version: <=2.3.1 || 4.0.0 - 4.0.3
Fix available: True
Direct dependency: False
Details: picomatch: 1115549 1115551 1115552 1115554

rollup

Severity: HIGH
CVEs: 1113515
Current version: 4.0.0 - 4.58.0
Fix available: True
Direct dependency: False
Details: rollup: 1113515

vite

Severity: HIGH
CVEs: 1116230, 1116232, 1116235
Current version: 7.0.0 - 7.3.1
Fix available: True
Direct dependency: True
Details: vite: 1116230 1116232 1116235

Auto-filed by security-sweep.py on 2026-05-17 03:16 UTC

## Critical/High Severity Dependency Vulnerancies ### @babel/plugin-transform-modules-systemjs - **Severity:** HIGH - **CVEs:** 1117908 - **Current version:** 7.12.0 - 7.29.0 - **Fix available:** True - **Direct dependency:** False - **Details:** @babel/plugin-transform-modules-systemjs: 1117908 ### flatted - **Severity:** HIGH - **CVEs:** 1114526, 1115357 - **Current version:** <=3.4.1 - **Fix available:** True - **Direct dependency:** False - **Details:** flatted: 1114526 1115357 ### lodash - **Severity:** HIGH - **CVEs:** 1112455, 1115806, 1115810 - **Current version:** <=4.17.23 - **Fix available:** True - **Direct dependency:** False - **Details:** lodash: 1112455 1115806 1115810 ### minimatch - **Severity:** HIGH - **CVEs:** 1113459, 1113465, 1113538, 1113544, 1113546, 1113552 - **Current version:** <=3.1.3 || 9.0.0 - 9.0.6 - **Fix available:** True - **Direct dependency:** False - **Details:** minimatch: 1113459 1113465 1113538 1113544 1113546 1113552 ### picomatch - **Severity:** HIGH - **CVEs:** 1115549, 1115551, 1115552, 1115554 - **Current version:** <=2.3.1 || 4.0.0 - 4.0.3 - **Fix available:** True - **Direct dependency:** False - **Details:** picomatch: 1115549 1115551 1115552 1115554 ### rollup - **Severity:** HIGH - **CVEs:** 1113515 - **Current version:** 4.0.0 - 4.58.0 - **Fix available:** True - **Direct dependency:** False - **Details:** rollup: 1113515 ### vite - **Severity:** HIGH - **CVEs:** 1116230, 1116232, 1116235 - **Current version:** 7.0.0 - 7.3.1 - **Fix available:** True - **Direct dependency:** True - **Details:** vite: 1116230 1116232 1116235 --- *Auto-filed by security-sweep.py on 2026-05-17 03:16 UTC*