github.com/microsoft/playwright

Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)

Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)

Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)

Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)

Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)

Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)

Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)

Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

## Vulnerability Details **File**: `lib/previous-map.js` **Line**: 87-98 (`loadFile`), 129-144 (`loadMap`) ### Root Cause PostCSS auto-detects a `/*# sourceMappingURL=... */` comment inside the CSS text it is asked to parse and, unless the caller explicitly passes `map: false`…

Ensure that a user for the container has been created on /utils/docker/Dockerfile.noble.

Ensure that a user for the container has been created on /utils/docker/Dockerfile.jammy.

Ensure that a user for the container has been created on /utils/docker/Dockerfile.resolute.

Ensure that HEALTHCHECK instructions have been added to container images on /utils/docker/Dockerfile.resolute.

Ensure that HEALTHCHECK instructions have been added to container images on /utils/docker/Dockerfile.noble.

Ensure that HEALTHCHECK instructions have been added to container images on /utils/docker/Dockerfile.jammy.

Ensure top-level permissions are not set to write-all on on(PR: bump driver/Docker Node.js)

Ensure top-level permissions are not set to write-all on on(PR: bump stable-test-runner)

Ensure top-level permissions are not set to write-all on on(tests BiDi)

Ensure top-level permissions are not set to write-all on on(components)

Ensure top-level permissions are not set to write-all on on(tests docker)

Ensure top-level permissions are not set to write-all on on(tests docker (changes))

Ensure top-level permissions are not set to write-all on on(tests docker (release))

Ensure top-level permissions are not set to write-all on on(extension)

Ensure top-level permissions are not set to write-all on on(tests WebView (iOS Simulator))

Ensure top-level permissions are not set to write-all on on(Update test results DB)

Ensure top-level permissions are not set to write-all on on(Copilot Setup Steps)

Ensure top-level permissions are not set to write-all on on(MCP)

Ensure top-level permissions are not set to write-all on on(tests 1)

Ensure top-level permissions are not set to write-all on on(Copilot Setup Steps)

Ensure top-level permissions are not set to write-all on on(infra)

Ensure top-level permissions are not set to write-all on on(Publish Extension to Chrome Web Store)

Ensure top-level permissions are not set to write-all on on(publish release - npm, trace viewer)

The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(tests BiDi)

### Summary brace-expansion's expand() exhibits exponential-time - O(2ⁿ) - behavior in the number of consecutive non-expanding {} groups. A short, all-ASCII input (~90 bytes/30 groups) blocks the calling thread for minutes; a slightly longer input hangs it effectively indefinitel…

### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining many brace groups, an attacker keeps the result count under `max` while making every result grow with the number of groups. Building `ma…

### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining many brace groups, an attacker keeps the result count under `max` while making every result grow with the number of groups. Building `ma…

### Impact `fast-uri` v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node's native WHATWG `URL` (used by `fetch()`, `undici`, and Node's `http`/`https` clients) normalizes `\` to `/` for special schemes (`http`, `https`, `ws`, `wss`, `ftp…

# fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped Delimiters ## Summary fast-xml-parser XMLBuilder does not escape the `-->` sequence in comment content or the `]]>` sequence in CDATA sections when building XML from JavaScript objects. This allows XML inje…

The same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44). ### Summary On Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\`, which …

## Vulnerability Details **File**: `lib/previous-map.js` **Line**: 87-98 (`loadFile`), 129-144 (`loadMap`) ### Root Cause PostCSS auto-detects a `/*# sourceMappingURL=... */` comment inside the CSS text it is asked to parse and, unless the caller explicitly passes `map: false`…

MD5/SHA1 is cryptographically broken for security use (integrity/signatures/ password hashing). Use SHA-256+ or a password KDF. (Apache-2.0.)

MD5/SHA1 is cryptographically broken for security use (integrity/signatures/ password hashing). Use SHA-256+ or a password KDF. (Apache-2.0.)

MD5/SHA1 is cryptographically broken for security use (integrity/signatures/ password hashing). Use SHA-256+ or a password KDF. (Apache-2.0.)

MD5/SHA1 is cryptographically broken for security use (integrity/signatures/ password hashing). Use SHA-256+ or a password KDF. (Apache-2.0.)

MD5/SHA1 is cryptographically broken for security use (integrity/signatures/ password hashing). Use SHA-256+ or a password KDF. (Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This …