[nextcloud-command]

Audit report

This audit fix resolves 4 of the total 17 vulnerabilities found in your project.

Updated dependencies

• @vue/server-renderer
• dompurify
• vite
• vue

Fixed vulnerabilities

@vue/server-renderer #

• @vue/server-renderer: XSS via missing CR in attribute-name blacklist
• Severity: high (CVSS 7.2)
• Reference: GHSA-g2v6-rqmx-r4w6
• Affected versions: <=3.5.41
• Package usage:
  • node_modules/@vue/server-renderer

dompurify #

• DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
• Severity: low
• Reference: GHSA-p98j-92pf-mc4p
• Affected versions: <=3.4.16
• Package usage:
  • node_modules/dompurify

vite #

• launch-editor: escapeCmdArgs() omits % escaping on Windows
• Severity: moderate
• Reference: GHSA-698v-4r3x-3vcv
• Affected versions: 7.0.0 - 7.3.6
• Package usage:
  • node_modules/vite

vue #

• Caused by vulnerable dependency:
  • @vue/server-renderer
• Affected versions: 3.2.13 - 3.5.41
• Package usage:
  • node_modules/vue