Sca flags

[msaleemzp]

No description provided.

[zeropath-ai-dev]

🟡 79 security issues detected below the blocking threshold. Reviewed everything up to 014ebb8.

The following issues were found:

• Issue 1: webpack:CVE-2025-68458

  • Location: package-lock.json
  • Score: MEDIUM (50.0)
  • Description: Package webpack version 5.75.0 has vulnerability CVE-2025-68458. Fixed in version 5.104.1. webpack: webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
  • Link to UI: https://dev.branch.zeropath.com/app/issues/0437d9cf-ae07-4155-b341-8f0c773c63ed (Issue 1, id: 0437d9cf-ae07-4155-b341-8f0c773c63ed)

• Issue 2: ejs:CVE-2024-33883

  • Location: package-lock.json
  • Score: MEDIUM (50.0)
  • Description: Package ejs version 3.1.8 has vulnerability CVE-2024-33883. Fixed in version 3.1.10. The ejs (aka Embedded JavaScript templates) package before 3.1.10 for ...
  • Link to UI: https://dev.branch.zeropath.com/app/issues/068cee01-cd19-48af-a5db-1169df228835 (Issue 2, id: 068cee01-cd19-48af-a5db-1169df228835)

• Issue 3: semver:CVE-2022-25883

  • Location: package-lock.json
  • Score: MEDIUM (50.0)
  • Description: Package semver version 6.3.0 has vulnerability CVE-2022-25883. Fixed in version 7.5.2, 6.3.1, 5.7.2. nodejs-semver: Regular expression denial of service
  • Link to UI: https://dev.branch.zeropath.com/app/issues/07918b1d-be6d-4fab-b6e1-6f2a21d247e5 (Issue 3, id: 07918b1d-be6d-4fab-b6e1-6f2a21d247e5)

• Issue 4: brace-expansion:CVE-2025-5889

  • Location: package-lock.json
  • Score: MEDIUM (50.0)
  • Description: Package brace-expansion version 1.1.11 has vulnerability CVE-2025-5889. Fixed in version 2.0.2, 1.1.12, 3.0.1, 4.0.1. brace-expansion: juliangruber brace-expansion index.js expand redos
  • Link to UI: https://dev.branch.zeropath.com/app/issues/0b10797d-f680-4ed4-beae-1d801dd4c248 (Issue 4, id: 0b10797d-f680-4ed4-beae-1d801dd4c248)

• Issue 5: nth-check:CVE-2021-3803

  • Location: package-lock.json
  • Score: MEDIUM (50.0)
  • Description: Package nth-check version 1.0.2 has vulnerability CVE-2021-3803. Fixed in version 2.0.1. nodejs-nth-check: inefficient regular expression complexity
  • Link to UI: https://dev.branch.zeropath.com/app/issues/0e95dbf0-2baa-4421-b82e-d4cafdad21d9 (Issue 5, id: 0e95dbf0-2baa-4421-b82e-d4cafdad21d9)

• Issue 6: diff:CVE-2026-24001

  • Location: package-lock.json
  • Score: MEDIUM (50.0)
  • Description: Package diff version 5.1.0 has vulnerability CVE-2026-24001. Fixed in version 8.0.3, 5.2.2, 4.0.4, 3.5.1. jsdiff: denial of service vulnerability in parsePatch and applyPatch
  • Link to UI: https://dev.branch.zeropath.com/app/issues/11aa2215-f413-45da-b301-70182fa75787 (Issue 6, id: 11aa2215-f413-45da-b301-70182fa75787)

• Issue 7: serialize-javascript:CVE-2024-11831

  • Location: package-lock.json
  • Score: MEDIUM (50.0)
  • Description: Package serialize-javascript version 6.0.1 has vulnerability CVE-2024-11831. Fixed in version 6.0.2. npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript
  • Link to UI: https://dev.branch.zeropath.com/app/issues/1419532b-1555-4d23-87ca-29e7b8a3c99e (Issue 7, id: 1419532b-1555-4d23-87ca-29e7b8a3c99e)

• Issue 8: webpack:CVE-2023-28154

  • Location: package-lock.json
  • Score: MEDIUM (50.0)
  • Description: Package webpack version 5.75.0 has vulnerability CVE-2023-28154. Fixed in version 5.76.0. webpack: avoid cross-realm objects
  • Link to UI: https://dev.branch.zeropath.com/app/issues/19fcc5db-66aa-49ff-87a7-009fc1bf256c (Issue 8, id: 19fcc5db-66aa-49ff-87a7-009fc1bf256c)

• Issue 9: serve-static:CVE-2024-43800

  • Location: package-lock.json
  • Score: MEDIUM (50.0)
  • Description: Package serve-static version 1.15.0 has vulnerability CVE-2024-43800. Fixed in version 1.16.0, 2.1.0. serve-static: Improper Sanitization in serve-static
  • Link to UI: https://dev.branch.zeropath.com/app/issues/1c19bd6f-c2e4-457e-ad63-3afd9cbf47cb (Issue 9, id: 1c19bd6f-c2e4-457e-ad63-3afd9cbf47cb)

• Issue 10: http-proxy-middleware:CVE-2025-32996

  • Location: package-lock.json
  • Score: MEDIUM (50.0)
  • Description: Package http-proxy-middleware version 2.0.6 has vulnerability CVE-2025-32996. Fixed in version 2.0.8, 3.0.4. http-proxy-middleware: Always-Incorrect Control Flow Implementation in http-proxy-middleware
  • Link to UI: https://dev.branch.zeropath.com/app/issues/1ea1b467-5639-467c-9f80-39a9e405e136 (Issue 10, id: 1ea1b467-5639-467c-9f80-39a9e405e136)

...and 69 more issue(s). View all scan results

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://dev.branch.zeropath.com/app/repositories/3a335366-043f-4a3f-aa3e-34ed9701337e?scanId=dfd61d4e-11b1-40f9-92e4-85fa84f79970&codeScanTypes=PrScan&tab=issues

Detected Code Changes

The diff is too large to display a summary of code changes.