0 critical · 12 high · 2 medium · 1 low · 15 total (deduped by advisory)
NPM package @datagrok/eda@1.9.0 — production dependency tree audited with npm audit.
| Advisory | Severity | Dependency | Installed | Vulnerable range | Fixed by | CVSS | Description |
|---|---|---|---|---|---|---|---|
| GHSA-29qv-4j9f-fjw5 | HIGH | mathjs | 15.1.1 | >=13.1.1 <15.2.0 | available | 8.8 | Unsafe object property setter in mathjs |
| GHSA-3jxr-9vmj-r5cp | HIGH | brace-expansion | 1.1.12 | >=2.0.0 <2.1.2 | available | 5.3 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-4c8g-83qw-93j6 | HIGH | fast-uri | 3.1.0 | >=3.0.0 <3.1.3 | available | 7.5 | fast-uri vulnerable to host confusion via failed IDN canonicalization |
| GHSA-7p8r-x3mc-p8w7 | HIGH | fast-uri | 3.1.0 | >=3.0.0 <3.1.5 | available | 7.5 | fast-uri vulnerable to host confusion via backslash authority introducer |
| GHSA-96hv-2xvq-fx4p | HIGH | ws | 8.19.0 | >=8.0.0 <8.21.0 | available | 7.5 | ws: Memory exhaustion DoS from tiny fragments and data chunks |
| GHSA-jvff-x2qm-6286 | HIGH | mathjs | 15.1.1 | >=13.1.0 <15.2.0 | available | 8.8 | mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes |
| GHSA-mh99-v99m-4gvg | HIGH | brace-expansion | 1.1.12 | <1.1.17 | available | 7.5 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-ph9p-34f9-6g65 | HIGH | tmp | 0.2.5 | <0.2.6 | available | tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape | |
| GHSA-q3j6-qgpj-74h6 | HIGH | fast-uri | 3.1.0 | >=3.0.0 <=3.1.0 | available | 7.5 | fast-uri vulnerable to path traversal via percent-encoded dot segments |
| GHSA-rgw5-rvv9-x895 | HIGH | brace-expansion | 1.1.12 | >=2.0.0 <2.1.4 | available | 7.5 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-v2hh-gcrm-f6hx | HIGH | fast-uri | 3.1.0 | >=3.0.0 <=3.1.3 | available | 7.5 | fast-uri vulnerable to host confusion via literal backslash authority delimiter |
| GHSA-v39h-62p7-jpjc | HIGH | fast-uri | 3.1.0 | >=3.0.0 <=3.1.1 | available | 7.5 | fast-uri vulnerable to host confusion via percent-encoded authority delimiters |
| GHSA-58qx-3vcg-4xpx | MEDIUM | ws | 8.19.0 | >=8.0.0 <8.20.1 | available | 4.4 | ws: Uninitialized memory disclosure |
| GHSA-f886-m6hf-6m8v | MEDIUM | brace-expansion | 1.1.12 | <1.1.13 | available | 6.5 | brace-expansion: Zero-step sequence causes process hang and memory exhaustion |
| GHSA-4x5r-pxfx-6jf8 | LOW | @babel/core | 7.29.0 | <=7.29.0 | available | 3.2 | @babel/core: Arbitrary File Read via sourceMappingURL Comment |