Security: Ourbigbook

218

Vulnerabilities

Credential Leaks

⚡

AI Fix Prompts

Auto-generated prompts to fix every issue — copy into Claude, GPT, or any AI coder

Vulnerabilities (218)

Source: Repobility analyzer (https://repobility.com)
Severity	ID	Package	Version	Summary
critical	`CVE-2025-62718`	axios	1.7.7	Axios has a NO_PROXY Hostname Normalization Bypass Leads to SSRF
critical	`GHSA-f82v-jwr5-mffw`	next	14.0.4
critical	`CVE-2025-7783`	form-data	2.3.3	form-data: Unsafe random function in form-data
critical	`GHSA-f598-mfpv-gmfx`	sequelize	6.14.0
critical	`GHSA-vqfx-gj96-3w95`	sequelize	6.14.0
critical	`GHSA-7f3x-x4pr-wqhj`	parse-url	6.0.0
critical	`GHSA-m7jm-9gc2-mpf2`	fast-xml-parser	5.2.5
critical	`CVE-2023-22578`	sequelize	6.14.0	Sequelize - Default support for “raw attributes” when using parentheses
critical	`CVE-2023-22579`	sequelize	6.14.0	Unsafe fall-through in getWhereConditions
critical	`GHSA-fjxv-7rqg-78g4`	form-data	1.0.1
critical	`GHSA-j9fq-vwqv-2fm2`	parse-url	6.0.0
critical	`GHSA-wrh9-cjv3-2hpw`	sequelize	6.14.0
critical	`GHSA-jf85-cpcp-j695`	lodash	3.10.1
critical	`GHSA-gwg9-rgvj-4h5j`	morgan	1.7.0
critical	`GHSA-3p68-rc4w-qgx5`	axios	0.19.2
critical	`CVE-2023-25813`	sequelize	6.14.0	Sequelize vulnerable to SQL Injection via replacements
critical	`GHSA-5p42-m6f3-hpmj`	tree-kit	0.7.4
critical	`CVE-2022-2900`	parse-url	6.0.5	Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url
high	`GHSA-fr5h-rqp8-mj6g`	next	14.0.4
high	`CVE-2024-4068`	braces	3.0.2	braces: fails to limit the number of characters it can handle
high	`CVE-2026-33285`	liquidjs	10.21.1	LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
high	`CVE-2026-33287`	liquidjs	10.21.1	LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
high	`CVE-2026-35525`	liquidjs	10.21.1	LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
high	`GHSA-6q5m-63h6-5x4v`	liquidjs	10.21.1
high	`GHSA-9r5m-9576-7f6x`	liquidjs	10.21.1
high	`CVE-2025-12758`	validator	13.11.0	Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements
high	`CVE-2021-23337`	lodash	4.17.20	nodejs-lodash: command injection via template
high	`CVE-2026-4800`	lodash	4.17.20	lodash: lodash: Arbitrary code execution via untrusted input in template imports
high	`GHSA-r5fr-rjxr-66jc`	lodash	4.17.20
high	`GHSA-gqgv-6jq5-jjj9`	qs	4.0.0
high	`GHSA-4p35-cfcx-8653`	parse-url	6.0.0
high	`CVE-2026-26996`	minimatch	3.1.2	minimatch: minimatch: Denial of Service via specially crafted glob patterns
high	`CVE-2026-27903`	minimatch	3.1.2	minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
high	`CVE-2026-27904`	minimatch	3.1.2	minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
high	`CVE-2022-29244`	npm	8.7.0	nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace
high	`CVE-2022-0624`	parse-path	4.0.4	Authorization Bypass in parse-path
high	`GHSA-rcmh-qjqh-p98v`	nodemailer	7.0.5
high	`CVE-2026-33671`	picomatch	2.3.1	picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns
high	`GHSA-c429-5p7v-vgjp`	hoek	2.16.3
high	`GHSA-hrpp-h998-j3pp`	qs	4.0.0
high	`CVE-2026-31802`	tar	2.2.2	tar: tar: File overwrite via drive-relative symlink traversal
high	`GHSA-9vvw-cc9w-f27h`	debug	2.2.0
high	`CVE-2022-25883`	semver	5.3.0	nodejs-semver: Regular expression denial of service
high	`CVE-2026-30951`	sequelize	6.14.0	sequelize: Sequelize: Data exfiltration via SQL injection in JSON/JSONB where clause processing
high	`GHSA-8cf7-32gw-wr33`	jsonwebtoken	5.7.0
high	`CVE-2022-21227`	sqlite3	5.0.2	sqlite3: Denial of Service (DoS) in sqlite3
high	`CVE-2022-43441`	sqlite3	5.0.2	A code execution vulnerability exists in the Statement Bindings functi ...
high	`CVE-2021-32804`	tar	2.2.2	nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite
high	`CVE-2021-37713`	tar	2.2.2	nodejs-tar: Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
high	`CVE-2026-23745`	tar	2.2.2	node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives

Credential Findings (41)

Repobility analysis · methodology at https://repobility.com/research/
Severity	Pattern	File	Line
critical	Vault Token	`web/front/EditorPage.tsx`	383
critical	Vault Token	`editor.js`	33
critical	Vault Token	`editor.js`	61
critical	Vault Token	`editor.js`	181
critical	Vault Token	`editor.js`	191
critical	Vault Token	`editor.js`	194
critical	Vault Token	`editor.js`	372
critical	Database URL with Password	`nodejs_webpack_safe.js`	731
critical	Vault Token	`todo.bigb`	85
critical	Vault Token	`todo.bigb`	106
critical	Vault Token	`vscode/src/extension.ts`	365
critical	Vault Token	`vscode/src/extension.ts`	541
critical	Vault Token	`vscode/src/extension.ts`	636
critical	Vault Token	`vscode/src/extension.ts`	703
critical	[sast:aljefra/taint-deserialization] Insecure Deserialization of Tainted Data	`web/api/min.js`	18
critical	[sast:aljefra/taint-deserialization] Insecure Deserialization of Tainted Data	`web/api/min.js`	45
critical	Vault Token	`web/back/IssuePage.ts`	74
critical	Vault Token	`web/bin/rerender-articles.js`	28
critical	Vault Token	`editor.js`	27
critical	Vault Token	`web/models/site.js`	22
critical	Vault Token	`web/models/user.js`	300
critical	Vault Token	`web/models/user.js`	369
critical	Vault Token	`web/models/user.js`	381
critical	Vault Token	`web/models/user.js`	479
high	[sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment	`editor.js`	254
high	[sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment	`editor.js`	283
high	[sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment	`editor.js`	292
high	[sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL	`web/front/EditorPage.tsx`	90
high	[sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL	`nodejs_webpack_safe.js`	415
high	[sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL	`nodejs_webpack_safe.js`	428
high	[sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment	`ourbigbook_runtime.js`	410
high	[sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment	`ourbigbook_runtime.js`	416
high	[sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL	`web/front/fetcher.ts`	22
high	[sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment	`web/front/Article.tsx`	906
high	[sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment	`web/front/Article.tsx`	916
high	[sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment	`web/front/Article.tsx`	921
high	[sast:aljefra/xss-innerhtml] XSS via innerHTML Assignment	`web/front/Article.tsx`	1028
high	[sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL	`web_api.js`	213
high	[sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL	`web/front/EditorPage.tsx`	67
high	[sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL	`web/front/EditorPage.tsx`	82
high	[sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL	`web/api/users.js`	261

Export

SARIF SBOM (CycloneDX) SBOM (SPDX) Vulns CSV Generate AI Fix Prompts (5)