Vulnerable Library - dotenv-vault-1.26.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

CVE-2025-7783

Vulnerable Library - form-data-4.0.1.tgz

A library to create readable "multipart/form-data" streams. Can be used to submit forms and file uploads to other web applications.

Library home page: https://registry.npmjs.org/form-data/-/form-data-4.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• dotenv-vault-1.26.2.tgz (Root Library)
  • axios-1.7.9.tgz
    • ❌ form-data-4.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.
This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-07-18

URL: CVE-2025-7783

CVSS 3 Score Details (8.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-fjxv-7rqg-78g4

Release Date: 2025-07-18

Fix Resolution (form-data): 4.0.4

Direct dependency fix Resolution (dotenv-vault): 1.27.0

Step up your Open Source Security Game with Mend here

CVE-2025-59343

Vulnerable Library - tar-fs-2.1.2.tgz

filesystem bindings for tar-stream

Library home page: https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• dotenv-vault-1.26.2.tgz (Root Library)
  • plugin-update-3.2.4.tgz
    • ❌ tar-fs-2.1.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.

Publish Date: 2025-09-24

URL: CVE-2025-59343

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-vj76-c3g6-qr5v

Release Date: 2025-09-24

Fix Resolution (tar-fs): 2.1.4

Direct dependency fix Resolution (dotenv-vault): 1.27.0

Step up your Open Source Security Game with Mend here

CVE-2025-58754

Vulnerable Library - axios-1.7.9.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-1.7.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• dotenv-vault-1.26.2.tgz (Root Library)
  • ❌ axios-1.7.9.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the "data:" scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory ("Buffer"/"Blob") and returns a synthetic 200 response. This path ignores "maxContentLength" / "maxBodyLength" (which only protect HTTP responses), so an attacker can supply a very large "data:" URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested "responseType: 'stream'". Versions 0.30.2 and 1.12.0 contain a patch for the issue.

Publish Date: 2025-09-12

URL: CVE-2025-58754

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-4hjh-wcwx-xvwj

Release Date: 2025-09-12

Fix Resolution: https://github.com/axios/axios.git - v1.12.0,axios - 0.30.2

Step up your Open Source Security Game with Mend here

CVE-2025-48387

Vulnerable Library - tar-fs-2.1.2.tgz

filesystem bindings for tar-stream

Library home page: https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• dotenv-vault-1.26.2.tgz (Root Library)
  • plugin-update-3.2.4.tgz
    • ❌ tar-fs-2.1.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories.

Publish Date: 2025-06-02

URL: CVE-2025-48387

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cj5-5rvv-wf4v

Release Date: 2025-06-02

Fix Resolution: tar-fs - 1.16.5,https://github.com/mafintosh/tar-fs.git - v3.0.9,https://github.com/mafintosh/tar-fs.git - v1.16.5,tar-fs - 3.0.9,tar-fs - 2.1.3,https://github.com/mafintosh/tar-fs.git - v2.1.3

Step up your Open Source Security Game with Mend here

CVE-2025-27152

Vulnerable Library - axios-1.7.9.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-1.7.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• dotenv-vault-1.26.2.tgz (Root Library)
  • ❌ axios-1.7.9.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.

Publish Date: 2025-03-07

URL: CVE-2025-27152

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-jr5f-v2jv-69x6

Release Date: 2025-03-07

Fix Resolution (axios): 1.8.2

Direct dependency fix Resolution (dotenv-vault): 1.27.0

Step up your Open Source Security Game with Mend here

CVE-2025-64718

Vulnerable Library - js-yaml-3.14.1.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• dotenv-vault-1.26.2.tgz (Root Library)
  • core-1.26.2.tgz
    • ❌ js-yaml-3.14.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution ("proto"). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1. Users can protect against this kind of attack on the server by using "node --disable-proto=delete" or "deno" (in Deno, pollution protection is on by default).

Publish Date: 2025-11-13

URL: CVE-2025-64718

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-mh29-5h37-fv8m

Release Date: 2025-11-13

Fix Resolution: js-yaml - 4.1.1,js-yaml - 3.14.2

Step up your Open Source Security Game with Mend here

CVE-2025-5889

Vulnerable Libraries - brace-expansion-2.0.1.tgz, brace-expansion-1.1.11.tgz

brace-expansion-2.0.1.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• dotenv-vault-1.26.2.tgz (Root Library)
  • core-1.26.2.tgz
    • ejs-3.1.10.tgz
      • jake-10.9.2.tgz
        • filelist-1.0.4.tgz
          • minimatch-5.1.6.tgz
            • ❌ brace-expansion-2.0.1.tgz (Vulnerable Library)

brace-expansion-1.1.11.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• dotenv-vault-1.26.2.tgz (Root Library)
  • core-1.26.2.tgz
    • ejs-3.1.10.tgz
      • jake-10.9.2.tgz
        • minimatch-3.1.2.tgz
          • ❌ brace-expansion-1.1.11.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A vulnerability was found in juliangruber brace-expansion up to 1.1.11. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to apply a patch to fix this issue.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-06-09

URL: CVE-2025-5889

CVSS 3 Score Details (3.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: GHSA-v6h2-p8h4-qcjw

Release Date: 2025-06-09

Fix Resolution: brace-expansion - 1.1.12,brace-expansion - 4.0.1

Step up your Open Source Security Game with Mend here

CVE-2025-54798

Vulnerable Library - tmp-0.0.33.tgz

Temporary file and directory creator

Library home page: https://registry.npmjs.org/tmp/-/tmp-0.0.33.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• dotenv-vault-1.26.2.tgz (Root Library)
  • plugin-update-3.2.4.tgz
    • inquirer-8.2.6.tgz
      • external-editor-3.1.0.tgz
        • ❌ tmp-0.0.33.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.

Publish Date: 2025-08-07

URL: CVE-2025-54798

CVSS 3 Score Details (2.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-52f5-9888-hmc6

Release Date: 2025-08-06

Fix Resolution: tmp - 0.2.4

Step up your Open Source Security Game with Mend here