{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@aws-sdk/client-s3": {
      "name": "@aws-sdk/client-s3",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "@aws-sdk/core",
        "@aws-sdk/credential-provider-node",
        "@aws-sdk/middleware-flexible-checksums",
        "@aws-sdk/middleware-sdk-s3",
        "@aws-sdk/middleware-user-agent",
        "@aws-sdk/signature-v4-multi-region",
        "@aws-sdk/util-user-agent-node"
      ],
      "effects": [],
      "range": "3.529.1 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/client-s3"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/client-sso": {
      "name": "@aws-sdk/client-sso",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/core",
        "@aws-sdk/middleware-user-agent",
        "@aws-sdk/util-user-agent-node"
      ],
      "effects": [
        "@aws-sdk/credential-provider-sso"
      ],
      "range": "3.529.1 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/client-sso"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/client-sts": {
      "name": "@aws-sdk/client-sts",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "@aws-sdk/core",
        "@aws-sdk/credential-provider-node",
        "@aws-sdk/middleware-user-agent",
        "@aws-sdk/util-user-agent-node"
      ],
      "effects": [],
      "range": "3.529.1 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/client-sts"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/core": {
      "name": "@aws-sdk/core",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "fast-xml-parser"
      ],
      "effects": [
        "@aws-sdk/client-s3",
        "@aws-sdk/client-sso",
        "@aws-sdk/client-sts",
        "@aws-sdk/credential-provider-env",
        "@aws-sdk/credential-provider-http",
        "@aws-sdk/credential-provider-ini",
        "@aws-sdk/credential-provider-process",
        "@aws-sdk/credential-provider-sso",
        "@aws-sdk/credential-provider-web-identity",
        "@aws-sdk/middleware-flexible-checksums",
        "@aws-sdk/middleware-sdk-s3",
        "@aws-sdk/middleware-user-agent",
        "@aws-sdk/nested-clients"
      ],
      "range": "3.529.1 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/core"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/credential-provider-env": {
      "name": "@aws-sdk/credential-provider-env",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/core"
      ],
      "effects": [],
      "range": "3.667.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/credential-provider-env"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/credential-provider-http": {
      "name": "@aws-sdk/credential-provider-http",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/core"
      ],
      "effects": [
        "@aws-sdk/credential-provider-node"
      ],
      "range": "3.667.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/credential-provider-http"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/credential-provider-ini": {
      "name": "@aws-sdk/credential-provider-ini",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/core",
        "@aws-sdk/credential-provider-env",
        "@aws-sdk/credential-provider-http",
        "@aws-sdk/credential-provider-process",
        "@aws-sdk/credential-provider-sso",
        "@aws-sdk/credential-provider-web-identity",
        "@aws-sdk/nested-clients"
      ],
      "effects": [],
      "range": "3.667.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/credential-provider-ini"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/credential-provider-node": {
      "name": "@aws-sdk/credential-provider-node",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/credential-provider-env",
        "@aws-sdk/credential-provider-http",
        "@aws-sdk/credential-provider-ini",
        "@aws-sdk/credential-provider-process",
        "@aws-sdk/credential-provider-sso",
        "@aws-sdk/credential-provider-web-identity"
      ],
      "effects": [
        "@aws-sdk/client-s3",
        "@aws-sdk/client-sts"
      ],
      "range": "3.667.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/credential-provider-node"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/credential-provider-process": {
      "name": "@aws-sdk/credential-provider-process",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/core"
      ],
      "effects": [],
      "range": "3.667.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/credential-provider-process"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/credential-provider-sso": {
      "name": "@aws-sdk/credential-provider-sso",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/client-sso",
        "@aws-sdk/core",
        "@aws-sdk/token-providers"
      ],
      "effects": [],
      "range": "3.529.1 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/credential-provider-sso"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/credential-provider-web-identity": {
      "name": "@aws-sdk/credential-provider-web-identity",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/core",
        "@aws-sdk/nested-clients"
      ],
      "effects": [],
      "range": "3.667.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/credential-provider-web-identity"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/middleware-flexible-checksums": {
      "name": "@aws-sdk/middleware-flexible-checksums",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/core"
      ],
      "effects": [
        "@aws-sdk/client-s3"
      ],
      "range": "3.666.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/middleware-flexible-checksums"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/middleware-sdk-s3": {
      "name": "@aws-sdk/middleware-sdk-s3",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/core"
      ],
      "effects": [
        "@aws-sdk/client-s3",
        "@aws-sdk/signature-v4-multi-region"
      ],
      "range": "3.624.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/middleware-sdk-s3"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/middleware-user-agent": {
      "name": "@aws-sdk/middleware-user-agent",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/core"
      ],
      "effects": [
        "@aws-sdk/client-sso",
        "@aws-sdk/client-sts",
        "@aws-sdk/util-user-agent-node"
      ],
      "range": "3.666.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/middleware-user-agent"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/nested-clients": {
      "name": "@aws-sdk/nested-clients",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/core",
        "@aws-sdk/middleware-user-agent",
        "@aws-sdk/util-user-agent-node"
      ],
      "effects": [
        "@aws-sdk/credential-provider-ini",
        "@aws-sdk/credential-provider-web-identity",
        "@aws-sdk/token-providers"
      ],
      "range": "<=3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/nested-clients"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/signature-v4-multi-region": {
      "name": "@aws-sdk/signature-v4-multi-region",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/middleware-sdk-s3"
      ],
      "effects": [],
      "range": "3.624.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/signature-v4-multi-region"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/token-providers": {
      "name": "@aws-sdk/token-providers",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/nested-clients"
      ],
      "effects": [
        "@aws-sdk/credential-provider-sso"
      ],
      "range": "3.730.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/token-providers"
      ],
      "fixAvailable": true
    },
    "@aws-sdk/util-user-agent-node": {
      "name": "@aws-sdk/util-user-agent-node",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "@aws-sdk/middleware-user-agent"
      ],
      "effects": [],
      "range": "3.666.0 - 3.893.0",
      "nodes": [
        "node_modules/@aws-sdk/util-user-agent-node"
      ],
      "fixAvailable": true
    },
    "@puppeteer/browsers": {
      "name": "@puppeteer/browsers",
      "severity": "high",
      "isDirect": false,
      "via": [
        "extract-zip"
      ],
      "effects": [
        "puppeteer",
        "puppeteer-core"
      ],
      "range": "<=2.13.2",
      "nodes": [
        "node_modules/@puppeteer/browsers"
      ],
      "fixAvailable": {
        "name": "puppeteer",
        "version": "25.16.0",
        "isSemVerMajor": true
      }
    },
    "@smithy/config-resolver": {
      "name": "@smithy/config-resolver",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1111987,
          "name": "@smithy/config-resolver",
          "dependency": "@smithy/config-resolver",
          "title": "AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value",
          "url": "https://github.com/advisories/GHSA-6475-r3vj-m8vf",
          "severity": "low",
          "cwe": [
            "CWE-20"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
          },
          "range": "<4.4.0"
        }
      ],
      "effects": [],
      "range": "<4.4.0",
      "nodes": [
        "node_modules/@smithy/config-resolver"
      ],
      "fixAvailable": true
    },
    "@smithy/middleware-retry": {
      "name": "@smithy/middleware-retry",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "uuid"
      ],
      "effects": [],
      "range": "<=4.2.4",
      "nodes": [
        "node_modules/@smithy/middleware-retry"
      ],
      "fixAvailable": true
    },
    "basic-ftp": {
      "name": "basic-ftp",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1113518,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "Basic FTP has Path Traversal Vulnerability in its downloadToDir() method",
          "url": "https://github.com/advisories/GHSA-5rq4-664w-9x2c",
          "severity": "critical",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 9.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
          },
          "range": "<5.2.0"
        },
        {
          "source": 1116454,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",
          "url": "https://github.com/advisories/GHSA-6v7q-wjvx-w8wg",
          "severity": "high",
          "cwe": [
            "CWE-93"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"
          },
          "range": "<=5.2.1"
        },
        {
          "source": 1117083,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()",
          "url": "https://github.com/advisories/GHSA-rp42-5vxx-qpwr",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=5.2.2"
        },
        {
          "source": 1118825,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering",
          "url": "https://github.com/advisories/GHSA-rpmf-866q-6p89",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=5.3.0"
        },
        {
          "source": 1240853,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)",
          "url": "https://github.com/advisories/GHSA-c475-qrg2-pj4r",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=6.2.0"
        }
      ],
      "effects": [],
      "range": "<=6.2.0",
      "nodes": [
        "node_modules/basic-ftp"
      ],
      "fixAvailable": true
    },
    "brace-expansion": {
      "name": "brace-expansion",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1105443,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion Regular Expression Denial of Service vulnerability",
          "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw",
          "severity": "low",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 3.1,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=1.0.0 <=1.1.11"
        },
        {
          "source": 1115540,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
          "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.13"
        },
        {
          "source": 1123897,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
          "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<1.1.16"
        },
        {
          "source": 1130588,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
          "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.17"
        },
        {
          "source": 1130737,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.18"
        },
        {
          "source": 1240100,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
          "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<1.1.21"
        },
        {
          "source": 1240104,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
          "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.20"
        },
        {
          "source": 1240108,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
          "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.19"
        }
      ],
      "effects": [],
      "range": "<=1.1.20",
      "nodes": [
        "node_modules/brace-expansion"
      ],
      "fixAvailable": true
    },
    "extract-zip": {
      "name": "extract-zip",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1139346,
          "name": "extract-zip",
          "dependency": "extract-zip",
          "title": "extract-zip unvalidated symlink path traversal",
          "url": "https://github.com/advisories/GHSA-jmr9-qjv8-65gv",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
          },
          "range": "<=2.0.1"
        },
        {
          "source": 1193685,
          "name": "extract-zip",
          "dependency": "extract-zip",
          "title": "extract-zip allows arbitrary file writes through symlink archive entries",
          "url": "https://github.com/advisories/GHSA-7pqw-9j4j-h8q3",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
          },
          "range": "<=2.0.1"
        }
      ],
      "effects": [
        "@puppeteer/browsers"
      ],
      "range": "*",
      "nodes": [
        "node_modules/extract-zip"
      ],
      "fixAvailable": {
        "name": "puppeteer",
        "version": "25.16.0",
        "isSemVerMajor": true
      }
    },
    "fast-xml-parser": {
      "name": "fast-xml-parser",
      "severity": "critical",
      "isDirect": true,
      "via": [
        {
          "source": 1113567,
          "name": "fast-xml-parser",
          "dependency": "fast-xml-parser",
          "title": "fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names",
          "url": "https://github.com/advisories/GHSA-m7jm-9gc2-mpf2",
          "severity": "critical",
          "cwe": [
            "CWE-185"
          ],
          "cvss": {
            "score": 9.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N"
          },
          "range": ">=4.1.3 <4.5.4"
        },
        {
          "source": 1113570,
          "name": "fast-xml-parser",
          "dependency": "fast-xml-parser",
          "title": "fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)",
          "url": "https://github.com/advisories/GHSA-jmr7-xgp7-cmfj",
          "severity": "high",
          "cwe": [
            "CWE-776"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.1.3 <4.5.4"
        },
        {
          "source": 1114149,
          "name": "fast-xml-parser",
          "dependency": "fast-xml-parser",
          "title": "fast-xml-parser has stack overflow in XMLBuilder with preserveOrder",
          "url": "https://github.com/advisories/GHSA-fj3w-jwp8-x2g3",
          "severity": "low",
          "cwe": [
            "CWE-120"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=4.0.0-beta.0 <4.5.4"
        },
        {
          "source": 1115338,
          "name": "fast-xml-parser",
          "dependency": "fast-xml-parser",
          "title": "fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)",
          "url": "https://github.com/advisories/GHSA-8gc5-j5rx-235r",
          "severity": "high",
          "cwe": [
            "CWE-776"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0-beta.3 <4.5.5"
        },
        {
          "source": 1116308,
          "name": "fast-xml-parser",
          "dependency": "fast-xml-parser",
          "title": "Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser",
          "url": "https://github.com/advisories/GHSA-jp2q-39xq-3w4g",
          "severity": "moderate",
          "cwe": [
            "CWE-1284"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0-beta.3 <4.5.5"
        },
        {
          "source": 1117911,
          "name": "fast-xml-parser",
          "dependency": "fast-xml-parser",
          "title": "fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters",
          "url": "https://github.com/advisories/GHSA-gh4j-gqv2-49f6",
          "severity": "moderate",
          "cwe": [
            "CWE-91"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<5.7.0"
        }
      ],
      "effects": [
        "@aws-sdk/core"
      ],
      "range": "<=5.6.0",
      "nodes": [
        "node_modules/@aws-sdk/core/node_modules/fast-xml-parser",
        "node_modules/fast-xml-parser"
      ],
      "fixAvailable": {
        "name": "fast-xml-parser",
        "version": "5.11.2",
        "isSemVerMajor": true
      }
    },
    "ip-address": {
      "name": "ip-address",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1118827,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address has XSS in Address6 HTML-emitting methods",
          "url": "https://github.com/advisories/GHSA-v2v4-37r5-5v8g",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.1.0"
        },
        {
          "source": 1130722,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass",
          "url": "https://github.com/advisories/GHSA-mwp4-54f8-5fhr",
          "severity": "high",
          "cwe": [
            "CWE-20",
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.3.0"
        },
        {
          "source": 1239948,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts",
          "url": "https://github.com/advisories/GHSA-rpw4-54j3-4h4q",
          "severity": "moderate",
          "cwe": [
            "CWE-697",
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.5.0"
        },
        {
          "source": 1240097,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range",
          "url": "https://github.com/advisories/GHSA-j6r3-76f7-8jcv",
          "severity": "moderate",
          "cwe": [
            "CWE-697",
            "CWE-843"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.7.0"
        },
        {
          "source": 1240098,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process",
          "url": "https://github.com/advisories/GHSA-h3mg-xc3c-68pw",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.7.0"
        },
        {
          "source": 1242883,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process",
          "url": "https://github.com/advisories/GHSA-rxp7-6hxx-x8q5",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.7.3"
        }
      ],
      "effects": [
        "socks"
      ],
      "range": "<=10.7.3",
      "nodes": [
        "node_modules/ip-address"
      ],
      "fixAvailable": true
    },
    "js-yaml": {
      "name": "js-yaml",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1112715,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml has prototype pollution in merge (<<)",
          "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=4.0.0 <4.1.1"
        },
        {
          "source": 1121860,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
          "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68",
          "severity": "moderate",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=4.0.0 <=4.1.1"
        },
        {
          "source": 1123911,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption",
          "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.0"
        },
        {
          "source": 1138115,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported",
          "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.1"
        },
        {
          "source": 1193727,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
          "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.2"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.3.1",
      "nodes": [
        "node_modules/js-yaml"
      ],
      "fixAvailable": true
    },
    "minimatch": {
      "name": "minimatch",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113459,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
          "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<3.1.3"
        },
        {
          "source": 1113538,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
          "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.1.3"
        },
        {
          "source": 1113546,
          "name": "minimatch",
          "dependency": "minimatch",
          "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
          "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<3.1.4"
        }
      ],
      "effects": [],
      "range": "<=3.1.3",
      "nodes": [
        "node_modules/minimatch"
      ],
      "fixAvailable": true
    },
    "puppeteer": {
      "name": "puppeteer",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@puppeteer/browsers",
        "puppeteer-core"
      ],
      "effects": [],
      "range": "19.8.1 - 24.43.1",
      "nodes": [
        "node_modules/puppeteer"
      ],
      "fixAvailable": {
        "name": "puppeteer",
        "version": "25.16.0",
        "isSemVerMajor": true
      }
    },
    "puppeteer-core": {
      "name": "puppeteer-core",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@puppeteer/browsers"
      ],
      "effects": [
        "puppeteer"
      ],
      "range": "19.8.4 - 24.43.1",
      "nodes": [
        "node_modules/puppeteer-core"
      ],
      "fixAvailable": {
        "name": "puppeteer",
        "version": "25.16.0",
        "isSemVerMajor": true
      }
    },
    "socks": {
      "name": "socks",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "ip-address"
      ],
      "effects": [],
      "range": "2.7.2 - 2.8.6",
      "nodes": [
        "node_modules/socks"
      ],
      "fixAvailable": true
    },
    "tar-fs": {
      "name": "tar-fs",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1109534,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
          "url": "https://github.com/advisories/GHSA-vj76-c3g6-qr5v",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-61"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=3.0.0 <3.1.1"
        },
        {
          "source": 1109542,
          "name": "tar-fs",
          "dependency": "tar-fs",
          "title": "tar-fs can extract outside the specified dir with a specific tarball",
          "url": "https://github.com/advisories/GHSA-8cj5-5rvv-wf4v",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=3.0.0 <3.0.9"
        }
      ],
      "effects": [],
      "range": "3.0.0 - 3.1.0",
      "nodes": [
        "node_modules/tar-fs"
      ],
      "fixAvailable": true
    },
    "undici": {
      "name": "undici",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1112496,
          "name": "undici",
          "dependency": "undici",
          "title": "Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
          "url": "https://github.com/advisories/GHSA-g9mf-h72j-4rw9",
          "severity": "moderate",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.23.0"
        },
        {
          "source": 1114592,
          "name": "undici",
          "dependency": "undici",
          "title": "Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
          "url": "https://github.com/advisories/GHSA-f269-vfmq-vjvj",
          "severity": "high",
          "cwe": [
            "CWE-248",
            "CWE-1284"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=6.0.0 <6.24.0"
        },
        {
          "source": 1114594,
          "name": "undici",
          "dependency": "undici",
          "title": "Undici has an HTTP Request/Response Smuggling issue",
          "url": "https://github.com/advisories/GHSA-2mjp-6q6p-2qxm",
          "severity": "moderate",
          "cwe": [
            "CWE-444"
          ],
          "cvss": {
            "score": 6.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
          },
          "range": "<6.24.0"
        },
        {
          "source": 1114638,
          "name": "undici",
          "dependency": "undici",
          "title": "Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression",
          "url": "https://github.com/advisories/GHSA-vrm6-8vpv-qv8q",
          "severity": "high",
          "cwe": [
            "CWE-409"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.24.0"
        },
        {
          "source": 1114640,
          "name": "undici",
          "dependency": "undici",
          "title": "Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation",
          "url": "https://github.com/advisories/GHSA-v9p9-hfj2-hcw8",
          "severity": "high",
          "cwe": [
            "CWE-248"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.24.0"
        },
        {
          "source": 1114642,
          "name": "undici",
          "dependency": "undici",
          "title": "Undici has CRLF Injection in undici via `upgrade` option",
          "url": "https://github.com/advisories/GHSA-4992-7rv2-5pvq",
          "severity": "moderate",
          "cwe": [
            "CWE-93"
          ],
          "cvss": {
            "score": 4.6,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
          },
          "range": "<6.24.0"
        },
        {
          "source": 1121242,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to HTTP header injection via Set-Cookie percent-decoding",
          "url": "https://github.com/advisories/GHSA-p88m-4jfj-68fv",
          "severity": "moderate",
          "cwe": [
            "CWE-93"
          ],
          "cvss": {
            "score": 5.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<6.27.0"
        },
        {
          "source": 1121245,
          "name": "undici",
          "dependency": "undici",
          "title": "undici WebSocket client vulnerable to denial of service via fragment count bypass",
          "url": "https://github.com/advisories/GHSA-vxpw-j846-p89q",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<6.27.0"
        },
        {
          "source": 1121255,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching",
          "url": "https://github.com/advisories/GHSA-g8m3-5g58-fq7m",
          "severity": "low",
          "cwe": [
            "CWE-183"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<6.27.0"
        },
        {
          "source": 1130716,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to downstream response desynchronization via retry interceptor",
          "url": "https://github.com/advisories/GHSA-8xcm-r25x-g524",
          "severity": "moderate",
          "cwe": [
            "CWE-444"
          ],
          "cvss": {
            "score": 4.8,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<6.28.0"
        },
        {
          "source": 1130727,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to CRLF Injection via blob-like body 'type' property",
          "url": "https://github.com/advisories/GHSA-m8rv-5g2x-5cg5",
          "severity": "moderate",
          "cwe": [
            "CWE-93"
          ],
          "cvss": {
            "score": 4.2,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
          },
          "range": "<6.28.0"
        },
        {
          "source": 1130732,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields",
          "url": "https://github.com/advisories/GHSA-v3r7-h72x-cjcm",
          "severity": "moderate",
          "cwe": [
            "CWE-74"
          ],
          "cvss": {
            "score": 4.8,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
          },
          "range": "<6.28.0"
        },
        {
          "source": 1137243,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse",
          "url": "https://github.com/advisories/GHSA-35p6-xmwp-9g52",
          "severity": "low",
          "cwe": [
            "CWE-367"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<6.27.0"
        },
        {
          "source": 1240039,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to downstream response splitting via retry interceptor",
          "url": "https://github.com/advisories/GHSA-r53p-7pc4-xj5r",
          "severity": "low",
          "cwe": [
            "CWE-444"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": "<6.28.1"
        },
        {
          "source": 1240042,
          "name": "undici",
          "dependency": "undici",
          "title": "undici vulnerable to Denial of Service via unrequested WebSocket subprotocol",
          "url": "https://github.com/advisories/GHSA-rfgv-xxqx-mfg5",
          "severity": "high",
          "cwe": [
            "CWE-248",
            "CWE-252"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=6.7.0 <6.28.1"
        }
      ],
      "effects": [],
      "range": "<=6.28.0",
      "nodes": [
        "node_modules/undici"
      ],
      "fixAvailable": true
    },
    "uuid": {
      "name": "uuid",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1119441,
          "name": "uuid",
          "dependency": "uuid",
          "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
          "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
          "severity": "moderate",
          "cwe": [
            "CWE-787",
            "CWE-1285"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": "<11.1.1"
        }
      ],
      "effects": [
        "@smithy/middleware-retry"
      ],
      "range": "<11.1.1",
      "nodes": [
        "node_modules/uuid"
      ],
      "fixAvailable": true
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1119108,
          "name": "ws",
          "dependency": "ws",
          "title": "ws: Uninitialized memory disclosure",
          "url": "https://github.com/advisories/GHSA-58qx-3vcg-4xpx",
          "severity": "moderate",
          "cwe": [
            "CWE-908"
          ],
          "cvss": {
            "score": 4.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
          },
          "range": ">=8.0.0 <8.20.1"
        },
        {
          "source": 1123259,
          "name": "ws",
          "dependency": "ws",
          "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks",
          "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770",
            "CWE-1050"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=8.0.0 <8.21.0"
        }
      ],
      "effects": [],
      "range": "8.0.0 - 8.20.1",
      "nodes": [
        "node_modules/ws"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 1,
      "moderate": 21,
      "high": 11,
      "critical": 2,
      "total": 35
    },
    "dependencies": {
      "prod": 264,
      "dev": 0,
      "optional": 9,
      "peer": 0,
      "peerOptional": 0,
      "total": 272
    }
  }
}