0 critical · 3 high · 0 medium · 0 low · 3 total (deduped by advisory)
NPM package datagrok-tools@6.7.5 — production dependency tree audited with npm audit.
| Advisory | Severity | Dependency | Installed | Vulnerable range | Fixed by | CVSS | Description |
|---|---|---|---|---|---|---|---|
| GHSA-7pqw-9j4j-h8q3 | HIGH | extract-zip | 2.0.1 | <=2.0.1 | puppeteer@25.12.0 | 8.1 | extract-zip allows arbitrary file writes through symlink archive entries |
| GHSA-c475-qrg2-pj4r | HIGH | basic-ftp | 5.3.1 | <=6.2.0 | puppeteer@25.12.0 | basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) | |
| GHSA-jmr9-qjv8-65gv | HIGH | extract-zip | 2.0.1 | <=2.0.1 | puppeteer@25.12.0 | 8.1 | extract-zip unvalidated symlink path traversal |