starlight-0.37.7.tgz: 3 vulnerabilities (highest severity is: 7.5)

[mend-for-github-com]

Vulnerable Library - starlight-0.37.7.tgz

Sample Path to Dependency File: /tutorials/messages_api-node-rcs-rich_card/package.json

Path to vulnerable library: /sources/voice-javascript-conversational_ai_bot/package.json,/tutorials/voice-javascript-build_call_menu/package.json,/sources/voice-javascript-build_call_menu/package.json,/tutorials/voice-javascript-conversational_ai_bot/package.json

Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (starlight version)	Remediation Possible**
CVE-2026-73646	High	7.5	postcss-8.5.16.tgz	Transitive	N/A*	❌
CVE-2025-65019	Medium	5.4	internal-helpers-0.6.1.tgz	Transitive	0.38.0	✅
CVE-2026-69153	Medium	5.3	postcss-8.5.16.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-73646

Vulnerable Library - postcss-8.5.16.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz

Sample Path to Dependency File: /sources/voice-javascript-conversational_ai_bot/package.json

Path to vulnerable library: /sources/voice-javascript-conversational_ai_bot/package.json,/tutorials/voice-javascript-build_call_menu/package.json,/sources/voice-javascript-build_call_menu/package.json,/tutorials/voice-javascript-conversational_ai_bot/package.json

Dependency Hierarchy:

• starlight-0.37.7.tgz (Root Library)
  • astro-expressive-code-0.41.7.tgz
    • rehype-expressive-code-0.41.7.tgz
      • expressive-code-0.41.7.tgz
        • core-0.41.7.tgz
          • ❌ postcss-8.5.16.tgz (Vulnerable Library)

Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.

Publish Date: 2026-08-17

URL: CVE-2026-73646

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-13

Fix Resolution: https://github.com/postcss/postcss.git - 8.5.18

CVE-2025-65019

Vulnerable Library - internal-helpers-0.6.1.tgz

Internal helpers used by core Astro packages.

Library home page: https://registry.npmjs.org/@⁠astrojs/internal-helpers/-/internal-helpers-0.6.1.tgz

Sample Path to Dependency File: /sources/video-javascript-client-observability/package.json

Path to vulnerable library: /sources/video-javascript-client-observability/package.json,/tutorials/messages_api-node-rcs-branded_messaging/package.json,/sources/video-node-client-observability/package.json,/tutorials/messages_api-node-rcs-rich_card/package.json,/tutorials/video-javascript-client-observability/package.json,/sources/messages_api-node-rcs-rich_card/package.json,/tutorials/video-node-client-observability/package.json,/sources/messages_api-node-rcs-branded_messaging/package.json

Dependency Hierarchy:

• starlight-0.37.7.tgz (Root Library)
  • mdx-4.2.6.tgz
    • markdown-remark-6.3.1.tgz
      • ❌ internal-helpers-0.6.1.tgz (Vulnerable Library)

Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4

Found in base branch: main

Vulnerability Details

Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@⁠astrojs/cloudflare) with output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This enables Cross-Site Scripting (XSS) attacks through malicious SVG payloads, bypassing domain restrictions and Content Security Policy protections. This issue has been patched in version 5.15.9.

Publish Date: 2025-11-19

URL: CVE-2025-65019

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-11-19

Fix Resolution (@⁠astrojs/internal-helpers): 0.7.5

Direct dependency fix Resolution (@⁠astrojs/starlight): 0.38.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-69153

Vulnerable Library - postcss-8.5.16.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz

Sample Path to Dependency File: /sources/voice-javascript-conversational_ai_bot/package.json

Path to vulnerable library: /sources/voice-javascript-conversational_ai_bot/package.json,/tutorials/voice-javascript-build_call_menu/package.json,/sources/voice-javascript-build_call_menu/package.json,/tutorials/voice-javascript-conversational_ai_bot/package.json

Dependency Hierarchy:

• starlight-0.37.7.tgz (Root Library)
  • astro-expressive-code-0.41.7.tgz
    • rehype-expressive-code-0.41.7.tgz
      • expressive-code-0.41.7.tgz
        • core-0.41.7.tgz
          • ❌ postcss-8.5.16.tgz (Vulnerable Library)

Found in HEAD commit: f400f39c07df86338418f7902a27a7c22c1442b4

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

Publish Date: 2026-08-03

URL: CVE-2026-69153

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-03

Fix Resolution: https://github.com/postcss/postcss.git - 8.5.23

---

⛑️Automatic Remediation will be attempted for this issue.