[Snyk] Fix for 2 vulnerabilities

[bijupki]

Snyk has created this PR to fix 2 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json
• yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Prototype Pollution SNYK-JS-AXIOS-15252993	828
	Allocation of Resources Without Limits or Throttling SNYK-JS-QS-15268416	708

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Allocation of Resources Without Limits or Throttling

[segrem25830-pki]

Checkmarx One – Scan Summary & Details – f3e19786-587d-42d0-a551-c538dcc56c46

New Issues (10)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2025-13465	Npm-lodash-4.17.21	details Recommended version: 4.17.23 Description: Lodash versions from 4.0.0 through 4.17.22 are vulnerable to Prototype Pollution in the "_.unset" and "_.omit" functions. An attacker can pass craf... Attack Vector: NETWORK Attack Complexity: LOW Exploitable Path: first@/cypress/support/commands.js - ... - first@/package/lodash.js Vulnerable Package
2		CVE-2025-13465	Npm-lodash-es-4.17.21	details Recommended version: 4.17.23 Description: Lodash versions from 4.0.0 through 4.17.22 are vulnerable to Prototype Pollution in the "_.unset" and "_.omit" functions. An attacker can pass craf... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
3		CVE-2025-14505	Npm-elliptic-6.5.4	details Description: The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
4		CVE-2025-15284	Npm-qs-6.7.0	details Recommended version: 6.7.4 Description: Improper Input Validation vulnerability in qs (parse modules) versions prior to 6.14.1 allows HTTP Denial-of-Service (DoS). The "arrayLimit" option... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
5		CVE-2025-15284	Npm-qs-6.5.2	details Recommended version: 6.5.4 Description: Improper Input Validation vulnerability in qs (parse modules) versions prior to 6.14.1 allows HTTP Denial-of-Service (DoS). The "arrayLimit" option... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
6		CVE-2025-50537	Npm-eslint-7.32.0	details Recommended version: 9.26.0 Description: Stack Overflow vulnerability in ESLint prior to 9.26.0 when serializing objects with circular references in "eslint/lib/shared/serialization.js". T... Attack Vector: LOCAL Attack Complexity: LOW Vulnerable Package
7		CVE-2026-2391	Npm-qs-6.5.2	details Recommended version: 6.5.4 Description: ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to c... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
8		CVE-2026-2391	Npm-qs-6.7.0	details Recommended version: 6.7.4 Description: ### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to c... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
9		CVE-2026-24001	Npm-diff-3.5.0	details Recommended version: 3.5.1 Description: jsdiff is a JavaScript text differencing implementation. Prior to versions 4.0.3, 5.x prior to 5.2.1 and 6.x through 8.x prior to 8.0.3, attempting... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
10		CVE-2026-24001	Npm-diff-5.1.0	details Recommended version: 5.2.1 Description: jsdiff is a JavaScript text differencing implementation. Prior to versions 4.0.3, 5.x prior to 5.2.1 and 6.x through 8.x prior to 8.0.3, attempting... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package

Fixed Issues (6)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2021-3749	Npm-axios-0.21.1
	CVE-2025-27152	Npm-axios-0.21.1
	CVE-2025-58754	Npm-axios-0.21.1
	CVE-2023-45857	Npm-axios-0.21.1
	CVE-2025-13466	Npm-body-parser-1.19.0
	Unsafe_Use_Of_Target_blank	/src/FormComponents/Uploader.js: 1169

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR