================================================================================
            DEPENDENCY VULNERABILITY AUDIT — Combined Report
================================================================================
Generated: 2026-04-09T10:15:00Z
Project:   acme-webapp (internal web application)

================================================================================
SECTION 1: npm audit (Node.js frontend + API gateway)
================================================================================
Run: npm audit --json | npm-audit-formatter
Found 9 vulnerabilities in 847 scanned packages

# CRITICAL

[1] Package:           lodash
    Installed Version: 4.17.20
    Fixed Version:     4.17.21
    CVE:               CVE-2021-23337
    Severity:          CRITICAL (CVSS 7.2)
    Description:       Command injection via template function when a
                       variable property is passed as an argument.
    Path:              acme-webapp > express-utils > lodash
    Breaking Change:   No — patch-level update.
    Recommendation:    npm audit fix

[2] Package:           jsonwebtoken
    Installed Version: 8.5.1
    Fixed Version:     9.0.0
    CVE:               CVE-2022-23529
    Severity:          CRITICAL (CVSS 9.8)
    Description:       Insecure implementation of key retrieval function allows
                       attackers to forge JWT tokens via prototype pollution of
                       the secretOrPublicKey parameter.
    Path:              acme-webapp > auth-middleware > jsonwebtoken
    Breaking Change:   YES — v9.0.0 drops callback-style API, changes default
                       algorithm handling. Requires code changes.
    Recommendation:    Manual upgrade + test authentication flows.

[3] Package:           xml2js
    Installed Version: 0.4.23
    Fixed Version:     0.5.0
    CVE:               CVE-2023-0842
    Severity:          CRITICAL (CVSS 9.8)
    Description:       Prototype pollution via __proto__ key in parsed XML allows
                       arbitrary property injection on JavaScript objects.
    Path:              acme-webapp > saml-auth > xml2js
    Breaking Change:   YES — v0.5.0 changes default parser options and drops
                       Node.js < 14 support.
    Recommendation:    Upgrade xml2js and test SAML authentication.

# HIGH

[4] Package:           axios
    Installed Version: 1.6.0
    Fixed Version:     1.6.2
    CVE:               CVE-2023-45857
    Severity:          HIGH (CVSS 7.1)
    Description:       XSRF-TOKEN cookie value is leaked to any host via
                       cross-site requests when withCredentials is enabled.
    Path:              acme-webapp > axios
    Breaking Change:   No — patch-level update.
    Recommendation:    npm audit fix

[5] Package:           follow-redirects
    Installed Version: 1.15.4
    Fixed Version:     1.15.6
    CVE:               CVE-2024-28849
    Severity:          HIGH (CVSS 6.5)
    Description:       Authorization header leaked when following cross-origin
                       redirects. Credentials may be sent to untrusted servers.
    Path:              acme-webapp > axios > follow-redirects
    Breaking Change:   No — patch-level update.
    Recommendation:    npm audit fix

[6] Package:           express
    Installed Version: 4.18.2
    Fixed Version:     4.19.2
    CVE:               CVE-2024-29041
    Severity:          HIGH (CVSS 6.1)
    Description:       Open redirect vulnerability. Malformed URLs bypass
                       redirect validation allowing phishing attacks.
    Path:              acme-webapp > express
    Breaking Change:   No — minor version update.
    Recommendation:    npm audit fix

# MEDIUM

[7] Package:           semver
    Installed Version: 7.5.2
    Fixed Version:     7.5.4
    CVE:               CVE-2022-25883
    Severity:          MEDIUM (CVSS 5.3)
    Description:       Regular expression denial of service (ReDoS) when
                       parsing untrusted semver strings.
    Path:              acme-webapp > npm > semver (dev dependency)
    Breaking Change:   No — patch-level update.
    Recommendation:    npm audit fix

[8] Package:           braces
    Installed Version: 3.0.2
    Fixed Version:     3.0.3
    CVE:               CVE-2024-4068
    Severity:          MEDIUM (CVSS 7.5)
    Description:       Uncontrolled resource consumption via crafted brace
                       expansion patterns. Can crash Node.js process.
    Path:              acme-webapp > chokidar > braces (dev dependency)
    Breaking Change:   No — patch-level update.
    Recommendation:    npm audit fix

[9] Package:           postcss
    Installed Version: 8.4.31
    Fixed Version:     NO FIX AVAILABLE
    CVE:               CVE-2025-0147 (hypothetical)
    Severity:          MEDIUM (CVSS 5.3)
    Description:       Parser mishandles crafted CSS input, potentially allowing
                       injection when processing untrusted stylesheets.
    Path:              acme-webapp > tailwindcss > postcss (dev dependency)
    Breaking Change:   N/A — no fix released yet.
    Recommendation:    Monitor for upstream fix. Do not process untrusted CSS.

================================================================================
SECTION 2: pip-audit (Python backend services)
================================================================================
Run: pip-audit --format columns --desc
Found 6 vulnerabilities in 124 scanned packages

# CRITICAL

[10] Package:          pillow
     Installed Version: 9.5.0
     Fixed Version:     10.0.1
     CVE:               CVE-2023-44271
     Severity:          CRITICAL (CVSS 7.5)
     Description:       Denial of service via uncontrolled resource consumption
                        when opening crafted image files. Memory exhaustion can
                        crash the application or host system.
     Breaking Change:   YES — Pillow 10.x removes deprecated features including
                        FreeType < 2.10 support, changes to Image.merge() API,
                        and drops Python 3.7 support.
     Recommendation:    Upgrade and run image processing test suite.

[11] Package:          cryptography
     Installed Version: 41.0.4
     Fixed Version:     42.0.0
     CVE:               CVE-2024-26130
     Severity:          HIGH (CVSS 7.5)
     Description:       NULL dereference when loading PKCS#7 certificates can
                        crash the Python process. Exploitable via crafted
                        certificate input.
     Breaking Change:   YES — v42.0.0 increases minimum OpenSSL to 3.0,
                        removes several deprecated functions.
     Recommendation:    Upgrade cryptography and verify OpenSSL compatibility.

# HIGH

[12] Package:          requests
     Installed Version: 2.31.0
     Fixed Version:     2.32.0
     CVE:               CVE-2024-35195
     Severity:          HIGH (CVSS 5.6)
     Description:       Session object does not verify certificates after making
                        the first request with verify=False, even if verify is
                        later set to True.
     Breaking Change:   No — minor version update.
     Recommendation:    pip install --upgrade requests

# MEDIUM

[13] Package:          jinja2
     Installed Version: 3.1.2
     Fixed Version:     3.1.4
     CVE:               CVE-2024-34064
     Severity:          MEDIUM (CVSS 5.4)
     Description:       Cross-site scripting via xmlattr filter when rendering
                        untrusted attribute values in HTML templates.
     Breaking Change:   No — patch-level update.
     Recommendation:    pip install --upgrade jinja2

[14] Package:          werkzeug
     Installed Version: 3.0.1
     Fixed Version:     3.0.3
     CVE:               CVE-2024-34069
     Severity:          MEDIUM (CVSS 7.5)
     Description:       Debugger can be exploited if accidentally left enabled
                        in production. Remote code execution possible.
     Breaking Change:   No — patch-level update.
     Recommendation:    pip install --upgrade werkzeug. Ensure debugger is
                        disabled in production (FLASK_DEBUG=0).

[15] Package:          setuptools
     Installed Version: 69.1.0
     Fixed Version:     NO FIX AVAILABLE
     CVE:               CVE-2024-6345
     Severity:          MEDIUM (CVSS 6.1)
     Description:       Remote code execution via download functions in
                        package_index module when processing URLs from
                        untrusted sources.
     Breaking Change:   N/A — no complete fix released. Partial mitigation
                        in 70.0.0 but vulnerability not fully resolved.
     Recommendation:    Avoid using easy_install or package_index module.
                        Pin setuptools and monitor for upstream fix.

================================================================================
                              AUDIT SUMMARY
================================================================================

  npm packages scanned:     847
  npm vulnerabilities:        9   (3 critical, 3 high, 3 medium)

  pip packages scanned:     124
  pip vulnerabilities:        6   (1 critical, 2 high, 3 medium)

  TOTAL vulnerabilities:     15
  With no fix available:      2   (postcss CVE-2025-0147, setuptools CVE-2024-6345)
  With breaking changes:      4   (jsonwebtoken, xml2js, pillow, cryptography)
  Auto-fixable (npm):         5   (lodash, axios, follow-redirects, express, semver, braces)

================================================================================
  ACTION REQUIRED:
  - 5 vulnerabilities can be resolved with `npm audit fix`
  - 4 require manual upgrade + testing due to breaking changes
  - 2 have no fix available — apply compensating controls
  - 4 are patch/minor updates with no breaking changes
================================================================================
END OF REPORT
================================================================================
