Risk grade
F
100 / 100
Findings
29
0 critical12 high15 medium2 low0 info0 on CISA KEV0ATT&CK
Showing 29 of 29 findings
Findings
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsgrypeCVE-2026-13149EPSS 0.3%
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsgrypeCVE-2026-13149EPSS 0.3%
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/SetgrypeCVE-2026-59880EPSS 0.4%
- Immutable.js `List` 32-bit trie overflow → unrecoverable DoSgrypeCVE-2026-59879EPSS 0.4%
- shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)grypeCVE-2026-13311EPSS 0.4%
- Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)semgrepplayground/define/__tests__/define.spec.ts:10
- Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)semgreppackages/vite/src/node/ssr/ssrStacktrace.ts:15
- Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)Dynamic code execution via eval()/new Function() — arbitrary-code-execution risk if any operand is attacker-influenced. Avoid; parse explicitly. (Apache-2.0.)semgreppackages/vite/src/node/utils.ts:1772
- Shell command built with interpolated input via child_process.exec — command injection risk. Use execFile with an argv array. (First-party socbox; Apache-2.0.)Shell command built with interpolated input via child_process.exec — command injection risk. Use execFile with an argv array. (First-party socbox; Apache-2.0.)semgreppackages/vite/src/node/__tests__/scan.spec.ts:28
- Shell command built with interpolated input via child_process.exec — command injection risk. Use execFile with an argv array. (First-party socbox; Apache-2.0.)Shell command built with interpolated input via child_process.exec — command injection risk. Use execFile with an argv array. (First-party socbox; Apache-2.0.)semgreppackages/vite/src/node/__tests__/scan.spec.ts:35
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(ecosystem-ci trigger)checkov.github/workflows/ecosystem-ci-trigger.yml:11
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on oncheckov.github/workflows/copilot-setup-steps.yml:13
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Issue Close Require)checkov.github/workflows/issue-close-require.yml:11
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Issue Labeled)checkov.github/workflows/issue-labeled.yml:11
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Publish Package)checkov.github/workflows/publish.yml:15
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Add GitHub Release Tag)checkov.github/workflows/release-tag.yml:16
- Ensure top-level permissions are not set to write-allEnsure top-level permissions are not set to write-all on on(Semantic Pull Request)checkov.github/workflows/semantic-pull-request.yml:20
- body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement### Impact When body-parser is configured with an invalid `limit` option value, such as an unparseable string or `NaN`, `bytes.parse()` returns `null` and the request body size check is silently skipped. Applications that rely on `limit` as their primary safeguard against oversi…osv-scannerCVE-2026-12590
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups### Summary brace-expansion's expand() exhibits exponential-time - O(2ⁿ) - behavior in the number of consecutive non-expanding {} groups. A short, all-ASCII input (~90 bytes/30 groups) blocks the calling thread for minutes; a slightly longer input hangs it effectively indefinitel…osv-scannerCVE-2026-13149
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups### Summary brace-expansion's expand() exhibits exponential-time - O(2ⁿ) - behavior in the number of consecutive non-expanding {} groups. A short, all-ASCII input (~90 bytes/30 groups) blocks the calling thread for minutes; a slightly longer input hangs it effectively indefinitel…osv-scannerCVE-2026-13149
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining many brace groups, an attacker keeps the result count under `max` while making every result grow with the number of groups. Building `ma…osv-scannerCVE-2026-14257
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining many brace groups, an attacker keeps the result count under `max` while making every result grow with the number of groups. Building `ma…osv-scannerCVE-2026-14257
- Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set## Summary `Immutable.Map` and `Immutable.Set` keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the **keys** inserted into a Map can craft many keys that all collide…osv-scannerCVE-2026-59880
- Immutable.js `List` 32-bit trie overflow → unrecoverable DoS## Summary `List#set`, `List#setSize`, `List#setIn`, `List#updateIn` (and the functional `set` / `setIn` / `updateIn`) mishandle an index or size in the range `[2 ** 30, 2 ** 31)`: - On an **empty** `List` the operation enters an **uncatchable infinite loop** (a tight CPU spin;…osv-scannerCVE-2026-59879
- shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)### Summary `shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses `Array.prototype.concat` as the accumulator. Each `prev.concat(arg)` copies the entire growing array, so `parse()` runs in **O(n²)** in the number of tokens. An unauthenticated attacker who c…osv-scannerCVE-2026-13311
- body-parser vulnerable to denial of service when invalid limit value silently disables size enforcementgrypeCVE-2026-12590EPSS 0.3%
- body-parser: body-parser: Denial of Service via invalid limit optionImpact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that …trivyCVE-2026-12590
This report is public.