Skip to content

Conversation

@nextcloud-command
Copy link
Contributor

@nextcloud-command nextcloud-command commented Jan 20, 2026

Audit report

This audit fix resolves 2 of the total 30 vulnerabilities found in your project.

Updated dependencies

Fixed vulnerabilities

lodash #

  • Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions
  • Severity: moderate (CVSS 6.5)
  • Reference: GHSA-xxjr-mmjv-4gpg
  • Affected versions: 4.0.0 - 4.17.21
  • Package usage:
    • node_modules/lodash

webpack #

  • webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
  • Severity: low (CVSS 3.7)
  • Reference: GHSA-8fgc-7cc6-rx7x
  • Affected versions: 5.49.0 - 5.104.0
  • Package usage:
    • node_modules/webpack

Signed-off-by: GitHub <noreply@github.com>
@nextcloud-command nextcloud-command force-pushed the automated/noid/stable5.6-fix-npm-audit branch from 8459465 to d179e48 Compare February 10, 2026 03:34
"version": "8.35.0",
"resolved": "https://registry.npmjs.org/@nextcloud/vue/-/vue-8.35.0.tgz",
"integrity": "sha512-qPm0aaPbnt7n694WQ97T+EMQTxCa3+RPKDzsBVD6vb01N4uGYwjvrEEOLVmBMlEWqkFy+ks3tpeOjkDPOoJbNA==",
"version": "8.36.0",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The usual unrelated suspect

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants