{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@puppeteer/browsers": {
      "name": "@puppeteer/browsers",
      "severity": "high",
      "isDirect": false,
      "via": [
        "extract-zip"
      ],
      "effects": [
        "puppeteer",
        "puppeteer-core"
      ],
      "range": "<=2.13.2",
      "nodes": [
        "node_modules/@puppeteer/browsers"
      ],
      "fixAvailable": {
        "name": "puppeteer",
        "version": "25.16.0",
        "isSemVerMajor": true
      }
    },
    "basic-ftp": {
      "name": "basic-ftp",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1113518,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "Basic FTP has Path Traversal Vulnerability in its downloadToDir() method",
          "url": "https://github.com/advisories/GHSA-5rq4-664w-9x2c",
          "severity": "critical",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 9.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
          },
          "range": "<5.2.0"
        },
        {
          "source": 1116454,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",
          "url": "https://github.com/advisories/GHSA-6v7q-wjvx-w8wg",
          "severity": "high",
          "cwe": [
            "CWE-93"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L"
          },
          "range": "<=5.2.1"
        },
        {
          "source": 1117083,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()",
          "url": "https://github.com/advisories/GHSA-rp42-5vxx-qpwr",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=5.2.2"
        },
        {
          "source": 1118825,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering",
          "url": "https://github.com/advisories/GHSA-rpmf-866q-6p89",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=5.3.0"
        },
        {
          "source": 1240853,
          "name": "basic-ftp",
          "dependency": "basic-ftp",
          "title": "basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)",
          "url": "https://github.com/advisories/GHSA-c475-qrg2-pj4r",
          "severity": "high",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=6.2.0"
        }
      ],
      "effects": [],
      "range": "<=6.2.0",
      "nodes": [
        "node_modules/basic-ftp"
      ],
      "fixAvailable": true
    },
    "extract-zip": {
      "name": "extract-zip",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1139346,
          "name": "extract-zip",
          "dependency": "extract-zip",
          "title": "extract-zip unvalidated symlink path traversal",
          "url": "https://github.com/advisories/GHSA-jmr9-qjv8-65gv",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
          },
          "range": "<=2.0.1"
        },
        {
          "source": 1193685,
          "name": "extract-zip",
          "dependency": "extract-zip",
          "title": "extract-zip allows arbitrary file writes through symlink archive entries",
          "url": "https://github.com/advisories/GHSA-7pqw-9j4j-h8q3",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 8.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
          },
          "range": "<=2.0.1"
        }
      ],
      "effects": [
        "@puppeteer/browsers"
      ],
      "range": "*",
      "nodes": [
        "node_modules/extract-zip"
      ],
      "fixAvailable": {
        "name": "puppeteer",
        "version": "25.16.0",
        "isSemVerMajor": true
      }
    },
    "ip-address": {
      "name": "ip-address",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1118827,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address has XSS in Address6 HTML-emitting methods",
          "url": "https://github.com/advisories/GHSA-v2v4-37r5-5v8g",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.1.0"
        },
        {
          "source": 1130722,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass",
          "url": "https://github.com/advisories/GHSA-mwp4-54f8-5fhr",
          "severity": "high",
          "cwe": [
            "CWE-20",
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.3.0"
        },
        {
          "source": 1239948,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts",
          "url": "https://github.com/advisories/GHSA-rpw4-54j3-4h4q",
          "severity": "moderate",
          "cwe": [
            "CWE-697",
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.5.0"
        },
        {
          "source": 1240097,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range",
          "url": "https://github.com/advisories/GHSA-j6r3-76f7-8jcv",
          "severity": "moderate",
          "cwe": [
            "CWE-697",
            "CWE-843"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.7.0"
        },
        {
          "source": 1240098,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process",
          "url": "https://github.com/advisories/GHSA-h3mg-xc3c-68pw",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.7.0"
        },
        {
          "source": 1242883,
          "name": "ip-address",
          "dependency": "ip-address",
          "title": "ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process",
          "url": "https://github.com/advisories/GHSA-rxp7-6hxx-x8q5",
          "severity": "moderate",
          "cwe": [
            "CWE-1333"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=10.7.3"
        }
      ],
      "effects": [],
      "range": "<=10.7.3",
      "nodes": [
        "node_modules/ip-address"
      ],
      "fixAvailable": true
    },
    "js-yaml": {
      "name": "js-yaml",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1112715,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml has prototype pollution in merge (<<)",
          "url": "https://github.com/advisories/GHSA-mh29-5h37-fv8m",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
          },
          "range": ">=4.0.0 <4.1.1"
        },
        {
          "source": 1121860,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
          "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68",
          "severity": "moderate",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=4.0.0 <=4.1.1"
        },
        {
          "source": 1123911,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption",
          "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.0"
        },
        {
          "source": 1138115,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported",
          "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.1"
        },
        {
          "source": 1193727,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
          "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.2"
        }
      ],
      "effects": [],
      "range": "4.0.0 - 4.3.1",
      "nodes": [
        "node_modules/js-yaml"
      ],
      "fixAvailable": true
    },
    "puppeteer": {
      "name": "puppeteer",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@puppeteer/browsers",
        "puppeteer-core"
      ],
      "effects": [],
      "range": "19.8.1 - 24.43.1",
      "nodes": [
        "node_modules/puppeteer"
      ],
      "fixAvailable": {
        "name": "puppeteer",
        "version": "25.16.0",
        "isSemVerMajor": true
      }
    },
    "puppeteer-core": {
      "name": "puppeteer-core",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@puppeteer/browsers"
      ],
      "effects": [
        "puppeteer"
      ],
      "range": "19.8.4 - 24.43.1",
      "nodes": [
        "node_modules/puppeteer-core"
      ],
      "fixAvailable": {
        "name": "puppeteer",
        "version": "25.16.0",
        "isSemVerMajor": true
      }
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1119108,
          "name": "ws",
          "dependency": "ws",
          "title": "ws: Uninitialized memory disclosure",
          "url": "https://github.com/advisories/GHSA-58qx-3vcg-4xpx",
          "severity": "moderate",
          "cwe": [
            "CWE-908"
          ],
          "cvss": {
            "score": 4.4,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
          },
          "range": ">=8.0.0 <8.20.1"
        },
        {
          "source": 1123259,
          "name": "ws",
          "dependency": "ws",
          "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks",
          "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770",
            "CWE-1050"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=8.0.0 <8.21.0"
        }
      ],
      "effects": [],
      "range": "8.0.0 - 8.20.1",
      "nodes": [
        "node_modules/ws"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 0,
      "high": 7,
      "critical": 1,
      "total": 8
    },
    "dependencies": {
      "prod": 88,
      "dev": 0,
      "optional": 10,
      "peer": 0,
      "peerOptional": 0,
      "total": 97
    }
  }
}