Repository navigation
[Bug]: 12 packages in pnpm-lock.yaml have high or critical security advisories #23907
Description
Before submitting
- I searched existing issues and did not find a duplicate.
- I included enough detail to reproduce or investigate the problem.
Area
Build, CI, or release tooling. The affected packages sit under apps/server, apps/web, apps/marketing, scripts, and the deploy tooling, but the fix is in pnpm-lock.yaml and the package manifests.
Steps to reproduce
- Check out
main. I used 1c8e79e, and 5127302 gives the same result. - Run
osv-scanner scan source --lockfile pnpm-lock.yaml.
Expected behavior
The lockfile resolves no package version that has a published high or critical advisory, where a fixed release exists.
Actual behavior
The scan reports 12 packages with 16 high or critical advisories between them. Eight of the packages have a fixed release. PR #23906 moves those eight onto the fixed release. The four that are left have no fixed release, or need a major-version upgrade.
Severity is the CVSS score that OSV reports. The "Where T3 Code uses it" column comes from the lockfile's dependency paths. I did not test whether any advisory is exploitable through T3 Code itself.
Fixed in #23906
| Package | From → to | Advisory | CVE | CVSS | Issue | Where T3 Code uses it |
|---|---|---|---|---|---|---|
@modelcontextprotocol/sdk |
1.29.0 → 1.32.0 | GHSA-22jm-h49p-29qw | CVE-2026-111767 | 8.6 | Experimental tasks are not bound to the session that created them. | apps/server. It is a peer of @anthropic-ai/claude-agent-sdk, which the Claude provider uses. |
| GHSA-46jr-4wx8-v453 | CVE-2026-111768 | 7.5 | One HTTP request within the default size limit can exhaust server memory during validation. | |||
| GHSA-6qxp-vccf-f47h | CVE-2026-104850 | 7.5 | The OAuth client can send credentials to an authorization server that the MCP server chooses. | |||
| GHSA-rvq5-wwqv-78pq | CVE-2026-111771 | 6.8 | Server bearer auth accepts tokens issued for another service. | |||
| GHSA-6prh-2h8m-c8cw | CVE-2026-111769 | 6.5 | HTTP client transports and OAuth requests follow cross-origin redirects and re-send credentials. | |||
dompurify |
3.4.16 → 3.4.17 | GHSA-cg2g-xh64-v4q7 | none assigned | 9.2 | SAFE_FOR_TEMPLATES bypass. Split template expressions survive in attached shadow-root content. |
apps/web. MermaidDiagram.tsx sanitizes diagram SVG, and diagrams can come from untrusted PR text. |
| GHSA-mrv2-3pqr-j5jr | none assigned | 7.6 | IN_PLACE: a hook that removes a parent or a sibling leaves event handlers armed on the detached subtree. |
|||
| GHSA-c6gr-qvv4-5v3f | none assigned | not scored | The SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml. |
|||
seroval |
1.5.4 → 1.7.0 | GHSA-p6vx-979v-rg4c | CVE-2026-104846 | 9.8 | fromJSON() Promise thenable assimilation calls plugin-produced callables. This bypasses an earlier fix. |
apps/web, through @tanstack/router-core. |
| GHSA-jp82-f5mq-hwhp | CVE-2026-104845 | 7.5 | An unchecked TypedArray length in JSON deserialization can exhaust memory. | |||
shell-quote |
1.10.0 → 1.12.0 | GHSA-pqg4-j6r4-53mv | CVE-2026-102422 | 9.2 | quote() command injection through a line terminator in a token after a { comment } token. |
Dev tooling, through react-devtools-core (React Native) and @alchemy.run/sigil. |
proxy-addr |
2.0.7 → 2.0.8 | GHSA-jqcg-44mw-7w3h | CVE-2026-90711 | 9.1 | IP spoofing through an IPv4-mapped IPv6 trust subnet. | express, which only the MCP SDK pulls in. |
sharp |
0.35.4 → 0.35.5 | GHSA-wq5f-xc86-pv6w | CVE-2026-114111 | 8.9 | Vulnerable bundled librsvg (CVE-2026-96889). |
apps/marketing image builds, scripts/export-android-icons.ts, and alchemy's Cloudflare runtime. |
source-map-js |
1.2.1 → 1.2.2 | GHSA-68fv-2mgg-jv7q | CVE-2026-93749 | 8.7 | Event-loop denial of service through indexed source-map section offsets. | Build tooling, through magicast under astro. |
path-to-regexp |
6.1.0 → 6.3.0 | GHSA-9wv6-86v2-598j | CVE-2024-45296, CVE-2026-4867 | 7.7 | Generated regular expressions backtrack (ReDoS). | Deploy config, through @vercel/config → @vercel/routing-utils. That package pins 6.1.0 exactly, so the PR adds a pnpm override. |
Still open
| Package | Advisory | CVE | CVSS | Issue | Reached through | Why it is not in #23906 |
|---|---|---|---|---|---|---|
braces 3.0.3 |
GHSA-vfj7-8cjw-p6xm | CVE-2026-93687 | 8.7 | Stack exhaustion from deeply nested patterns. | micromatch |
No fixed release yet. |
node-forge 1.4.0 |
GHSA-86w9-cpqp-85rv | CVE-2026-33894, CVE-2026-85393 | 8.7 | RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements. |
@expo/cli, @expo/code-signing-certificates |
No fixed release yet. |
http-cache-semantics 4.2.0 |
GHSA-ch52-4w7c-c8xp | CVE-2026-93748 | 8.7 | max-stale handling can disclose cached responses across users. |
astro, cacheable-request |
No fixed release yet. |
uuid 7.0.3 |
GHSA-w5hq-g745-h8pq | CVE-2026-41907, CVE-2026-41988 | 7.5 | Missing buffer bounds check in v3, v5, and v6 when buf is passed. |
xcode (Expo config plugins) |
The first fixed release is 11.1.1, a major-version jump inside Expo's tooling. That needs its own change. |
Impact
Minor bug or occasional failure. I did not see any failure. The risk is the advisories above. Most of the affected paths are build or dev tooling. The runtime paths are the MCP SDK on the server, and DOMPurify and seroval in the web client.
Version or commit
main @ 5127302
Environment
macOS 26 (Apple Silicon), Node 24.22.1, pnpm 12.14.0, osv-scanner (Homebrew).
Logs or stack traces
$ osv-scanner scan source --lockfile pnpm-lock.yaml
# high or critical, by package (CVSS):
@modelcontextprotocol/sdk@1.29.0 8.6 dompurify@3.4.16 9.2
seroval@1.5.4 9.8 shell-quote@1.10.0 9.2
proxy-addr@2.0.7 9.1 sharp@0.35.4 8.9
source-map-js@1.2.1 8.7 path-to-regexp@6.1.0 7.7
braces@3.0.3 8.7 node-forge@1.4.0 8.7
http-cache-semantics@4.2.0 8.7 uuid@7.0.3 7.5Workaround
None needed beyond #23906. After that PR, the same scan reports 4 high or critical packages instead of 12. The 4 are the "Still open" rows above.
Activity
ezrover commentedon Oct 23, 2026
The lockfile scan above misses seven packages that ship inside the 0.1.2 desktop app. #23906 does not change any of them.
Five of them are inlined into
@cursor/sdk's prebuiltdist/files, sopnpm-lock.yamlnever lists them at these versions. The lockfile resolves@modelcontextprotocol/sdk@1.29.0, for example, but the app runs the Cursor SDK's own bundled copy, which is 1.25.1. The other two come from T3 Code's own dependencies.I found them by extracting
app.asarfrom the signed 0.1.2 macOS build (x64), reading thenode_modules/.pnpm/<name>@<version>paths in the bundled JavaScript and thepackage.jsonfiles, and querying OSV for each name and version.@modelcontextprotocol/sdk1.25.1@cursor/sdk1.0.35dist/*/458.js,689.jsjs-yaml3.14.1@cursor/sdk458.js!!omap<<)js-yaml4.3.1@cursor/sdk458.js,689.jsfast-uri3.1.7@cursor/sdk458.jsfile-type16.5.4@cursor/sdk250.jsstream-json3.6.0apps/server(pinned inapps/server/package.json),dist/binCli-*.mjsxml2js0.4.23dbus-next0.10.2,apps/desktop/dist-electron/main.cjsUpgrading
@cursor/sdkdoes not fix this yet. I unpacked the latest release, 1.0.40, and it still bundles@modelcontextprotocol/sdk1.25.1,js-yaml3.14.1 and 4.3.1, andfile-type16.5.4. Onlyfast-urimoves to the fixed 3.1.8. Those four need a rebuild from Cursor.stream-json3.7.0 andxml2js0.6.2 are on npm. Forxml2js,dbus-next0.10.2 pins^0.4.17, so it would take a pnpm override or a patcheddbus-next.I did not test whether any of these code paths can be reached in T3 Code. I checked 0.1.1 too, and it ships the same seven packages at the same versions.