================================================================================ DEPENDENCY VULNERABILITY AUDIT — Combined Report ================================================================================ Generated: 2026-04-09T10:15:00Z Project: acme-webapp (internal web application) ================================================================================ SECTION 1: npm audit (Node.js frontend + API gateway) ================================================================================ Run: npm audit --json | npm-audit-formatter Found 9 vulnerabilities in 847 scanned packages # CRITICAL [1] Package: lodash Installed Version: 4.17.20 Fixed Version: 4.17.21 CVE: CVE-2021-23337 Severity: CRITICAL (CVSS 7.2) Description: Command injection via template function when a variable property is passed as an argument. Path: acme-webapp > express-utils > lodash Breaking Change: No — patch-level update. Recommendation: npm audit fix [2] Package: jsonwebtoken Installed Version: 8.5.1 Fixed Version: 9.0.0 CVE: CVE-2022-23529 Severity: CRITICAL (CVSS 9.8) Description: Insecure implementation of key retrieval function allows attackers to forge JWT tokens via prototype pollution of the secretOrPublicKey parameter. Path: acme-webapp > auth-middleware > jsonwebtoken Breaking Change: YES — v9.0.0 drops callback-style API, changes default algorithm handling. Requires code changes. Recommendation: Manual upgrade + test authentication flows. [3] Package: xml2js Installed Version: 0.4.23 Fixed Version: 0.5.0 CVE: CVE-2023-0842 Severity: CRITICAL (CVSS 9.8) Description: Prototype pollution via __proto__ key in parsed XML allows arbitrary property injection on JavaScript objects. Path: acme-webapp > saml-auth > xml2js Breaking Change: YES — v0.5.0 changes default parser options and drops Node.js < 14 support. Recommendation: Upgrade xml2js and test SAML authentication. # HIGH [4] Package: axios Installed Version: 1.6.0 Fixed Version: 1.6.2 CVE: CVE-2023-45857 Severity: HIGH (CVSS 7.1) Description: XSRF-TOKEN cookie value is leaked to any host via cross-site requests when withCredentials is enabled. Path: acme-webapp > axios Breaking Change: No — patch-level update. Recommendation: npm audit fix [5] Package: follow-redirects Installed Version: 1.15.4 Fixed Version: 1.15.6 CVE: CVE-2024-28849 Severity: HIGH (CVSS 6.5) Description: Authorization header leaked when following cross-origin redirects. Credentials may be sent to untrusted servers. Path: acme-webapp > axios > follow-redirects Breaking Change: No — patch-level update. Recommendation: npm audit fix [6] Package: express Installed Version: 4.18.2 Fixed Version: 4.19.2 CVE: CVE-2024-29041 Severity: HIGH (CVSS 6.1) Description: Open redirect vulnerability. Malformed URLs bypass redirect validation allowing phishing attacks. Path: acme-webapp > express Breaking Change: No — minor version update. Recommendation: npm audit fix # MEDIUM [7] Package: semver Installed Version: 7.5.2 Fixed Version: 7.5.4 CVE: CVE-2022-25883 Severity: MEDIUM (CVSS 5.3) Description: Regular expression denial of service (ReDoS) when parsing untrusted semver strings. Path: acme-webapp > npm > semver (dev dependency) Breaking Change: No — patch-level update. Recommendation: npm audit fix [8] Package: braces Installed Version: 3.0.2 Fixed Version: 3.0.3 CVE: CVE-2024-4068 Severity: MEDIUM (CVSS 7.5) Description: Uncontrolled resource consumption via crafted brace expansion patterns. Can crash Node.js process. Path: acme-webapp > chokidar > braces (dev dependency) Breaking Change: No — patch-level update. Recommendation: npm audit fix [9] Package: postcss Installed Version: 8.4.31 Fixed Version: NO FIX AVAILABLE CVE: CVE-2025-0147 (hypothetical) Severity: MEDIUM (CVSS 5.3) Description: Parser mishandles crafted CSS input, potentially allowing injection when processing untrusted stylesheets. Path: acme-webapp > tailwindcss > postcss (dev dependency) Breaking Change: N/A — no fix released yet. Recommendation: Monitor for upstream fix. Do not process untrusted CSS. ================================================================================ SECTION 2: pip-audit (Python backend services) ================================================================================ Run: pip-audit --format columns --desc Found 6 vulnerabilities in 124 scanned packages # CRITICAL [10] Package: pillow Installed Version: 9.5.0 Fixed Version: 10.0.1 CVE: CVE-2023-44271 Severity: CRITICAL (CVSS 7.5) Description: Denial of service via uncontrolled resource consumption when opening crafted image files. Memory exhaustion can crash the application or host system. Breaking Change: YES — Pillow 10.x removes deprecated features including FreeType < 2.10 support, changes to Image.merge() API, and drops Python 3.7 support. Recommendation: Upgrade and run image processing test suite. [11] Package: cryptography Installed Version: 41.0.4 Fixed Version: 42.0.0 CVE: CVE-2024-26130 Severity: HIGH (CVSS 7.5) Description: NULL dereference when loading PKCS#7 certificates can crash the Python process. Exploitable via crafted certificate input. Breaking Change: YES — v42.0.0 increases minimum OpenSSL to 3.0, removes several deprecated functions. Recommendation: Upgrade cryptography and verify OpenSSL compatibility. # HIGH [12] Package: requests Installed Version: 2.31.0 Fixed Version: 2.32.0 CVE: CVE-2024-35195 Severity: HIGH (CVSS 5.6) Description: Session object does not verify certificates after making the first request with verify=False, even if verify is later set to True. Breaking Change: No — minor version update. Recommendation: pip install --upgrade requests # MEDIUM [13] Package: jinja2 Installed Version: 3.1.2 Fixed Version: 3.1.4 CVE: CVE-2024-34064 Severity: MEDIUM (CVSS 5.4) Description: Cross-site scripting via xmlattr filter when rendering untrusted attribute values in HTML templates. Breaking Change: No — patch-level update. Recommendation: pip install --upgrade jinja2 [14] Package: werkzeug Installed Version: 3.0.1 Fixed Version: 3.0.3 CVE: CVE-2024-34069 Severity: MEDIUM (CVSS 7.5) Description: Debugger can be exploited if accidentally left enabled in production. Remote code execution possible. Breaking Change: No — patch-level update. Recommendation: pip install --upgrade werkzeug. Ensure debugger is disabled in production (FLASK_DEBUG=0). [15] Package: setuptools Installed Version: 69.1.0 Fixed Version: NO FIX AVAILABLE CVE: CVE-2024-6345 Severity: MEDIUM (CVSS 6.1) Description: Remote code execution via download functions in package_index module when processing URLs from untrusted sources. Breaking Change: N/A — no complete fix released. Partial mitigation in 70.0.0 but vulnerability not fully resolved. Recommendation: Avoid using easy_install or package_index module. Pin setuptools and monitor for upstream fix. ================================================================================ AUDIT SUMMARY ================================================================================ npm packages scanned: 847 npm vulnerabilities: 9 (3 critical, 3 high, 3 medium) pip packages scanned: 124 pip vulnerabilities: 6 (1 critical, 2 high, 3 medium) TOTAL vulnerabilities: 15 With no fix available: 2 (postcss CVE-2025-0147, setuptools CVE-2024-6345) With breaking changes: 4 (jsonwebtoken, xml2js, pillow, cryptography) Auto-fixable (npm): 5 (lodash, axios, follow-redirects, express, semver, braces) ================================================================================ ACTION REQUIRED: - 5 vulnerabilities can be resolved with `npm audit fix` - 4 require manual upgrade + testing due to breaking changes - 2 have no fix available — apply compensating controls - 4 are patch/minor updates with no breaking changes ================================================================================ END OF REPORT ================================================================================