pnpm-audit-hook 1.0.0

package/dist/static-db/data/packages/@octokit__webhooks.json

@@ -0,0 +1,27 @@
+{
+  "name": "@octokit/webhooks",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-pwfr-8pq7-x9qv",
+      "title": "Unauthenticated Denial of Service in the octokit/webhooks library",
+      "description": "### Impact\nVersions [v9.26.0](https://github.com/octokit/webhooks.js/releases/tag/v9.26.0), [v10.9.x](https://github.com/octokit/webhooks.js/releases/tag/v10.9.1)), [v11.1.x](https://github.com/octokit/webhooks.js/releases/tag/v11.1.1), [v12.0.x](https://github.com/octokit/webhooks.js/releases/tag/v12.0.3) all contained the code that would throw the error.\n\nSpecifically, during a pentest we encountered a bug in the octokit/webhooks library (a dependency of Probot, a framework for building Github",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-pwfr-8pq7-x9qv",
+      "publishedAt": "2023-12-16T00:52:19Z",
+      "modifiedAt": "2023-12-16T00:52:21Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-pwfr-8pq7-x9qv"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2023-50728"
+        }
+      ],
+      "affectedRange": ">= 12.0.0, < 12.0.3",
+      "fixedVersion": "12.0.3"
+    }
+  ]
+}

package/dist/static-db/data/packages/@okta__oidc-middleware.json

@@ -0,0 +1,27 @@
+{
+  "name": "@okta/oidc-middleware",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-58h4-9m7m-j9m4",
+      "title": "@okta/oidc-middlewareOpen Redirect vulnerability",
+      "description": "An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.\n\n**Affected products and versions**\nOkta OIDC Middleware prior to version 5.0.0.\n\n**Resolution**\nThe vulnerability is fixed in OIDC Middleware 5.0.0.  To remediate this vulnerability, upgrade Okta OIDC Middleware to this version or later.\n\n**CVE details**\n**CVE ID:**\t\t[CVE-2022-3145](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-3145)\n**Published",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-58h4-9m7m-j9m4",
+      "publishedAt": "2023-01-09T20:06:02Z",
+      "modifiedAt": "2023-02-07T05:06:20Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-58h4-9m7m-j9m4"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2022-3145"
+        }
+      ],
+      "affectedRange": "< 5.0.0",
+      "fixedVersion": "5.0.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/@oneuptime__common-server.json

@@ -0,0 +1,27 @@
+{
+  "name": "@oneuptime/common-server",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-246p-xmg8-wmcq",
+      "title": "OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation",
+      "description": "## Summary\nA security vulnerability exists in oneuptime's local storage handling, where a regular user can escalate privileges by modifying the `is_master_admin` key to `true`. This allows unauthorized access to administrative functionalities.\n\n## Details\nThe vulnerability lies in the improper validation of client-side stored data within the web application. Specifically, the `is_master_admin` key, stored in the local storage of the browser, can be manipulated by an attacker. By changing this ke",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-246p-xmg8-wmcq",
+      "publishedAt": "2024-03-25T19:37:27Z",
+      "modifiedAt": "2024-03-26T13:40:14Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-246p-xmg8-wmcq"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-29194"
+        }
+      ],
+      "affectedRange": "< 7.0.1815",
+      "fixedVersion": "7.0.1815"
+    }
+  ]
+}

package/dist/static-db/data/packages/@oneuptime__common.json

@@ -0,0 +1,48 @@
+{
+  "name": "@oneuptime/common",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-m449-vh5f-574g",
+      "title": "OneUptime Unauthorized User Creation via API",
+      "description": "### Summary\nA low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.\n\n### PoC\nA low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully.\n![WhatsApp Image 2025-11-23 at 14 27 32_0e0f5889](https://github.com/user-attachments/assets/5a539310-c9a2-4466-8926-b49b9b2a2422)\n\n### Impact\nThis allows attackers to create unauthorized accounts.",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-m449-vh5f-574g",
+      "publishedAt": "2025-11-26T19:33:08Z",
+      "modifiedAt": "2025-12-01T16:02:31Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-m449-vh5f-574g"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-65966"
+        }
+      ],
+      "affectedRange": "< 9.1.0",
+      "fixedVersion": "9.1.0"
+    },
+    {
+      "id": "GHSA-675q-66gf-gqg8",
+      "title": "OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation ",
+      "description": "### Summary\n\nDuring the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, a user is able to gain access to the admin dashboard interface.  However, despite accessing the admin panel, the user does not have sufficient permissions to view or interact with actual data. \n\n\n### PoC\nIntercept the login response and change \"isMasterAdmin\": false → \"isMasterAdmin\": true \n<img width=\"1405\" height=\"567\" alt=",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-675q-66gf-gqg8",
+      "publishedAt": "2025-11-25T22:55:50Z",
+      "modifiedAt": "2025-11-27T09:01:21Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-675q-66gf-gqg8"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-66028"
+        }
+      ],
+      "affectedRange": "< 8.0.5567",
+      "fixedVersion": "8.0.5567"
+    }
+  ]
+}

package/dist/static-db/data/packages/@oneuptime__model.json

@@ -0,0 +1,27 @@
+{
+  "name": "@oneuptime/model",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-246p-xmg8-wmcq",
+      "title": "OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation",
+      "description": "## Summary\nA security vulnerability exists in oneuptime's local storage handling, where a regular user can escalate privileges by modifying the `is_master_admin` key to `true`. This allows unauthorized access to administrative functionalities.\n\n## Details\nThe vulnerability lies in the improper validation of client-side stored data within the web application. Specifically, the `is_master_admin` key, stored in the local storage of the browser, can be manipulated by an attacker. By changing this ke",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-246p-xmg8-wmcq",
+      "publishedAt": "2024-03-25T19:37:27Z",
+      "modifiedAt": "2024-03-26T13:40:14Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-246p-xmg8-wmcq"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-29194"
+        }
+      ],
+      "affectedRange": "< 7.0.1815",
+      "fixedVersion": "7.0.1815"
+    }
+  ]
+}

package/dist/static-db/data/packages/@openai__codex.json

@@ -0,0 +1,27 @@
+{
+  "name": "@openai/codex",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-w5fx-fh39-j5rw",
+      "title": "Codex has sandbox bypass due to bug in path configuration logic",
+      "description": "Due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated `cwd` as the sandbox’s writable root, including paths outside of the folder where the user started their session.\n\nThis logic bypassed the intended workspace boundary and enables arbitrary file writes and command execution where the Codex process has permissions - this did not impact the network-disabled sandbox restriction.\n\n**Remediation**\nWe released a patch in Codex CLI **0.39.0** that canonicalizes and ",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-w5fx-fh39-j5rw",
+      "publishedAt": "2025-09-19T17:14:04Z",
+      "modifiedAt": "2025-09-22T22:00:37Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-w5fx-fh39-j5rw"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-59532"
+        }
+      ],
+      "affectedRange": ">= 0.2.0, <= 0.38.0",
+      "fixedVersion": "0.39.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/@openc3__tool-common.json

@@ -0,0 +1,48 @@
+{
+  "name": "@openc3/tool-common",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-4xqv-47rm-37mm",
+      "title": "OpenC3 stores passwords in clear text (`GHSL-2024-129`)",
+      "description": "### Summary\nOpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128).\n\nNote: This CVE only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition\n\n### Impact\nThis issue may lead to Information Disclosure.",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-4xqv-47rm-37mm",
+      "publishedAt": "2024-10-02T19:29:35Z",
+      "modifiedAt": "2024-11-13T23:24:17Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-4xqv-47rm-37mm"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-47529"
+        }
+      ],
+      "affectedRange": "< 5.19.0",
+      "fixedVersion": "5.19.0"
+    },
+    {
+      "id": "GHSA-vfj8-5pj7-2f9g",
+      "title": "OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)",
+      "description": "### Summary\nThe login functionality contains a reflected cross-site scripting (XSS) vulnerability.\n\nNote: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition\n\n### Impact\nThis issue may lead up to Remote Code Execution (RCE).",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-vfj8-5pj7-2f9g",
+      "publishedAt": "2024-10-02T19:29:23Z",
+      "modifiedAt": "2024-10-31T13:50:03Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-vfj8-5pj7-2f9g"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2024-43795"
+        }
+      ],
+      "affectedRange": "< 5.19.0",
+      "fixedVersion": "5.19.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/@openlist-frontend__openlist-frontend.json

@@ -0,0 +1,27 @@
+{
+  "name": "@openlist-frontend/openlist-frontend",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-2hw3-h8qx-hqqp",
+      "title": "OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer",
+      "description": "XSS via `.py` file containing script tag interpreted as HTML\n\n## Summary\n\nA vulnerability exists in the file preview/browsing feature of the application, where files with a `.py` extension that contain JavaScript code wrapped in `<script>` tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability.\n\n## Affected Versions\n\n* <= 4.0.0-rc.3\n\n## PoC\n\nCreate a `.py` file with arbitrary JavaScript content wrapped in `<script>` tags. For example:\n\n```javascri",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-2hw3-h8qx-hqqp",
+      "publishedAt": "2025-06-18T14:41:25Z",
+      "modifiedAt": "2025-06-19T15:19:19Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-2hw3-h8qx-hqqp"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-50183"
+        }
+      ],
+      "affectedRange": "<= 4.0.0-rc.3",
+      "fixedVersion": "4.0.0-rc.4"
+    }
+  ]
+}

package/dist/static-db/data/packages/@opennextjs__cloudflare.json

@@ -0,0 +1,27 @@
+{
+  "name": "@opennextjs/cloudflare",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-rvpw-p7vw-wj3m",
+      "title": "OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint",
+      "description": "A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. \n\nThe vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the `/_next/image` endpoint. \n\nThis issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next.  For example: `https:",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-rvpw-p7vw-wj3m",
+      "publishedAt": "2025-06-16T19:37:16Z",
+      "modifiedAt": "2025-06-16T21:46:53Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-rvpw-p7vw-wj3m"
+        },
+        {
+          "type": "CVE",
+          "value": "CVE-2025-6087"
+        }
+      ],
+      "affectedRange": "< 1.3.0",
+      "fixedVersion": "1.3.0"
+    }
+  ]
+}

package/dist/static-db/data/packages/@opentelemetry__instrumentation.json

@@ -0,0 +1,23 @@
+{
+  "name": "@opentelemetry/instrumentation",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-f8pq-3926-8gx5",
+      "title": "Unsanitized user controlled input in module generation",
+      "description": "## Impact\n\nThe `import-in-the-middle` loader used by `@opentelemetry/instrumentation` works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. It allows for remote code execution in cases where an application passes user-supplied input directly to an `import()` function.\n\n## Patches\n\nThis vulnerability has been patched in `@opentelemetry/instrumentation` version `0.41.2`\n\n## Workarounds\n\n- Do not pass any user-",
+      "severity": "high",
+      "url": "https://github.com/advisories/GHSA-f8pq-3926-8gx5",
+      "publishedAt": "2023-08-09T20:59:14Z",
+      "modifiedAt": "2023-08-18T05:03:02Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-f8pq-3926-8gx5"
+        }
+      ],
+      "affectedRange": ">= 0.40.0, < 0.41.2",
+      "fixedVersion": "0.41.2"
+    }
+  ]
+}

package/dist/static-db/data/packages/@openzeppelin__confidential-contracts.json

@@ -0,0 +1,23 @@
+{
+  "name": "@openzeppelin/confidential-contracts",
+  "lastUpdated": "2026-01-31T15:05:26.294Z",
+  "vulnerabilities": [
+    {
+      "id": "GHSA-hqf9-8xv5-x8xw",
+      "title": "ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.",
+      "description": "### Impact\nThe `ERC7984` contract tracks total supply using a confidential `euint64` value. If a call to the internal `_mint` function would result in the total supply overflowing, the call fails silently. The `wrap` and `onTransferReceived` functions in `ERC7984ERC20Wrapper` assume that `_mint` won't fail silently and do not check the return value. If the mint function fails silently, users do not receive the confidential wrapped token but still send the underlying token, resulting in a loss of",
+      "severity": "medium",
+      "url": "https://github.com/advisories/GHSA-hqf9-8xv5-x8xw",
+      "publishedAt": "2026-01-05T19:57:46Z",
+      "modifiedAt": "2026-01-05T19:57:47Z",
+      "identifiers": [
+        {
+          "type": "GHSA",
+          "value": "GHSA-hqf9-8xv5-x8xw"
+        }
+      ],
+      "affectedRange": "<= 0.3.0",
+      "fixedVersion": "0.3.1"
+    }
+  ]
+}