SpIob/FlowState

npm

A local-first developer workspace that detects when you're in flow and gets out of your way. Unified editor, terminal, and Git panel with OS-level interruption blocking and dynamic UI that adapts to your cognitive load. Built with Tauri, React, and Ollama.

← All repos

Impact

Ecosystem

Effort

Sort

Criticalnpm
Update @tauri-apps/plugin-shell to fix a critical vulnerability
Low effort SpIob/FlowState ⚠ low confidence
Claimed · @SpIob5.6/10
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell` Affects @tauri-apps/plugin-shell (declared as "^2.3.5"), used as a production dependency of this repo. Severity: critical. Source: GHSA-c9pr-q8gx-3mgp (GHSA).
Upgrade @tauri-apps/plugin-shell to 2.2.1 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
Claimed by @SpIob
▸Why this score?
Formula
0.60 × impact (9.0) + 0.40 × ecosystem value (0.5) = 5.6
Impact inputs
CVSS: unknown
Severity: critical
Dependency type: production
Advisory age: 475d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-c9pr-q8gx-3mgp for @tauri-apps/plugin-shell
Highnpm
Update react to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
4.4/10
Cross-Site Scripting in react Affects react (declared as "^19.1.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-hg79-j56m-fxgv (GHSA).
Upgrade react to 0.14.0 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.5) = 4.4
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 2146d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-hg79-j56m-fxgv for react
Highnpm
Update xterm to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
4.4/10
xterm vulnerable to remote code execution Affects xterm (declared as "^5.3.0"), used as a production dependency of this repo. Severity: high. Source: GHSA-mc23-976p-j42x (GHSA).
Upgrade xterm to 3.8.1 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (7.0) + 0.40 × ecosystem value (0.5) = 4.4
Impact inputs
CVSS: unknown
Severity: high
Dependency type: production
Advisory age: 2745d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-mc23-976p-j42x for xterm
Mediumnpm
Update react to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
3.2/10
Cross-Site Scripting in react Affects react (declared as "^19.1.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-g53w-52xc-2j85 (GHSA).
Upgrade react to 0.4.2 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.5) = 3.2
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 2146d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-g53w-52xc-2j85 for react
Mediumnpm
Update react-dom to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
3.2/10
Cross-Site Scripting in react-dom Affects react-dom (declared as "^19.1.0"), used as a production dependency of this repo. Severity: medium. Source: GHSA-mvjj-gqq2-p4hw (GHSA).
Upgrade react-dom to 16.0.1 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (5.0) + 0.40 × ecosystem value (0.5) = 3.2
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: production
Advisory age: 2755d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-mvjj-gqq2-p4hw for react-dom
Highnpm
Update @tauri-apps/cli to fix a high vulnerability
Medium effort SpIob/FlowState ⚠ low confidence
1.9/10
Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables Affects @tauri-apps/cli (declared as "^2"), used as a development dependency of this repo. Severity: high. Source: GHSA-2rcp-jvr4-r259 (GHSA).
Upgrade @tauri-apps/cli to 2.0.0-alpha.16 or later (version bump size unknown).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 1005d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: unknown
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-2rcp-jvr4-r259 for @tauri-apps/cli
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
vite: `server.fs.deny` bypass on Windows alternate paths Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-fx2h-pf6j-xcff (GHSA).
Upgrade vite to 8.0.16 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 36d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-fx2h-pf6j-xcff for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
launch-editor vulnerable to command injection via the crafted request on Windows Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-c27g-q93r-2cwf (GHSA).
Upgrade vite to 2.9.0 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 48d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-c27g-q93r-2cwf for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
Vite: `server.fs.deny` bypassed with queries Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-v2wj-q39q-566r (GHSA).
Upgrade vite to 8.0.5 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 106d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-v2wj-q39q-566r for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-p9ff-h696-f583 (GHSA).
Upgrade vite to 8.0.5 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 106d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-p9ff-h696-f583 for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-c24v-8rfc-w8vw (GHSA).
Upgrade vite to 2.9.17 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 914d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-c24v-8rfc-w8vw for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-353f-5xf4-qw67 (GHSA).
Upgrade vite to 2.9.16 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 1142d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-353f-5xf4-qw67 for vite
Highnpm
Update vite to fix a high vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.9/10
Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: high. Source: GHSA-mv48-hcvh-8jj8 (GHSA).
Upgrade vite to 2.9.13 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.8) + 0.40 × ecosystem value (0.5) = 1.9
Impact inputs
CVSS: unknown
Severity: high
Dependency type: development
Advisory age: 1433d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-mv48-hcvh-8jj8 for vite
Mediumnpm
Update postcss to fix a medium vulnerability
Trivial effort SpIob/FlowState ⚠ low confidence
1.4/10
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output Affects postcss (declared as "^8.5.15"), used as a development dependency of this repo. Severity: medium. Source: GHSA-qx2v-qp2m-jg93 (GHSA).
Upgrade postcss to 8.5.10 or later (patch version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 88d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: patch
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-qx2v-qp2m-jg93 for postcss
Mediumnpm
Update vite to fix a medium vulnerability
Low effort SpIob/FlowState ⚠ low confidence
1.4/10
vite allows server.fs.deny bypass via backslash on Windows Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-93m4-6634-74q7 (GHSA).
Upgrade vite to 7.1.11 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 274d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-93m4-6634-74q7 for vite
Mediumnpm
Update postcss to fix a medium vulnerability
Low effort SpIob/FlowState ⚠ low confidence
1.4/10
PostCSS line return parsing error Affects postcss (declared as "^8.5.15"), used as a development dependency of this repo. Severity: medium. Source: GHSA-7fh5-64p2-3v2j (GHSA).
Upgrade postcss to 8.4.31 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 1026d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-7fh5-64p2-3v2j for postcss
Mediumnpm
Update postcss to fix a medium vulnerability
Low effort SpIob/FlowState ⚠ low confidence
1.4/10
Regular Expression Denial of Service in postcss Affects postcss (declared as "^8.5.15"), used as a development dependency of this repo. Severity: medium. Source: GHSA-566m-qj78-rww5 (GHSA).
Upgrade postcss to 8.2.13 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 1657d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-566m-qj78-rww5 for postcss
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-v6wh-96g9-6wx3 (GHSA).
Upgrade vite to 2.14.1 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 36d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-v6wh-96g9-6wx3 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-4w7w-66w2-5vf9 (GHSA).
Upgrade vite to 8.0.5 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 106d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-4w7w-66w2-5vf9 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite's server.fs.deny bypassed with /. for files under project root Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-859w-5945-r5v3 (GHSA).
Upgrade vite to 6.3.4 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 447d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-859w-5945-r5v3 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite has an `server.fs.deny` bypass with an invalid `request-target` Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-356w-63v5-8wf4 (GHSA).
Upgrade vite to 6.2.6 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 466d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-356w-63v5-8wf4 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite allows server.fs.deny to be bypassed with .svg or relative paths Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-xcj6-pq6g-qj4x (GHSA).
Upgrade vite to 6.2.5 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 473d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-xcj6-pq6g-qj4x for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-4r4m-qw57-chr8 (GHSA).
Upgrade vite to 6.2.4 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 477d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-4r4m-qw57-chr8 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite bypasses server.fs.deny when using ?raw?? Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-x574-m823-4x7w (GHSA).
Upgrade vite to 6.2.3 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 483d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-x574-m823-4x7w for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Websites were able to send any requests to the development server and read the response in vite Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-vg6x-rcgg-rjx6 (GHSA).
Upgrade vite to 6.0.9 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 546d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-vg6x-rcgg-rjx6 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-64vr-g452-qvp3 (GHSA).
Upgrade vite to 5.4.6 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 672d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-64vr-g452-qvp3 for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite's `server.fs.deny` is bypassed when using `?import&raw` Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-9cwx-2883-4wfx (GHSA).
Upgrade vite to 5.4.6 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 672d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-9cwx-2883-4wfx for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite's `server.fs.deny` did not deny requests for patterns with directories. Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-8jhw-289h-jh2g (GHSA).
Upgrade vite to 2.9.18 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 839d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-8jhw-289h-jh2g for vite
Mediumnpm
Update vite to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: medium. Source: GHSA-92r3-m2mg-pj97 (GHSA).
Upgrade vite to 4.4.12 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 959d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-92r3-m2mg-pj97 for vite
Mediumnpm
Update postcss to fix a medium vulnerability
High effort SpIob/FlowState ⚠ low confidence
1.4/10
Regular Expression Denial of Service in postcss Affects postcss (declared as "^8.5.15"), used as a development dependency of this repo. Severity: medium. Source: GHSA-hwj9-h5mp-3pm3 (GHSA).
Upgrade postcss to 7.0.36 or later (major version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (2.0) + 0.40 × ecosystem value (0.5) = 1.4
Impact inputs
CVSS: unknown
Severity: medium
Dependency type: development
Advisory age: 1898d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: major
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-hwj9-h5mp-3pm3 for postcss
Lownpm
Update vite to fix a low vulnerability
Low effort SpIob/FlowState ⚠ low confidence
0.8/10
Vite middleware may serve files starting with the same name with the public directory Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: low. Source: GHSA-g4jq-h2w9-997c (GHSA).
Upgrade vite to 7.1.5 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: low
Dependency type: development
Advisory age: 315d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-g4jq-h2w9-997c for vite
Lownpm
Update vite to fix a low vulnerability
Low effort SpIob/FlowState ⚠ low confidence
0.8/10
Vite's `server.fs` settings were not applied to HTML files Affects vite (declared as "^7.0.4"), used as a development dependency of this repo. Severity: low. Source: GHSA-jqfw-vq24-v9c3 (GHSA).
Upgrade vite to 7.1.5 or later (minor version bump).
⚠ Low confidenceSpIob/FlowState
to claim this mission.
▸Why this score?
Formula
0.60 × impact (1.0) + 0.40 × ecosystem value (0.5) = 0.8
Impact inputs
CVSS: unknown
Severity: low
Dependency type: development
Advisory age: 315d
Ecosystem value inputs
Repo stars: 1
Open issues: 0
Downstream dependents: not tracked yet
Effort inputs
Semver bump: minor
Migration guide: not tracked yet
Why low confidence
· No lock file was parsed for this dependency, so the currently-installed version is estimated from its declared range rather than confirmed.
· No CVSS score was available for this advisory; the impact score falls back to a severity-based estimate.
· The number of packages that depend on this one isn't tracked yet, so ecosystem value is based on stars and issue activity only.
· Changelog and migration-guide data isn't ingested yet, so the effort estimate is based on the semver version bump alone.
Source
GHSA advisory GHSA-jqfw-vq24-v9c3 for vite

Update @tauri-apps/plugin-shell to fix a critical vulnerability

Update react to fix a high vulnerability

Update xterm to fix a high vulnerability

Update react to fix a medium vulnerability

Update react-dom to fix a medium vulnerability

Update @tauri-apps/cli to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update vite to fix a high vulnerability

Update postcss to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update postcss to fix a medium vulnerability

Update postcss to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update vite to fix a medium vulnerability

Update postcss to fix a medium vulnerability

Update vite to fix a low vulnerability

Update vite to fix a low vulnerability