KERN Chatbot

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

flatted vulnerable to unbounded recursion DoS in parse() revive phase

ajv has ReDoS when using `$data` option

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

@babel/core: Arbitrary File Read via sourceMappingURL Comment

js-yaml: YAML merge-key chains can force quadratic CPU consumption

When Vitest UI server is listening, arbitrary file can be read and executed

esbuild enables any website to send any requests to the development server and read the response

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

vite allows server.fs.deny bypass via backslash on Windows

Picomatch has a ReDoS vulnerability via extglob quantifiers

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

vite: `server.fs.deny` bypass on Windows alternate paths

Vite middleware may serve files starting with the same name with the public directory

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

form-data: CRLF injection in form-data via unescaped multipart field names and filenames

Vite's `server.fs` settings were not applied to HTML files

brace-expansion: Large numeric range defeats documented `max` DoS protection

js-yaml has prototype pollution in merge (<<)

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

Rollup 4 has Arbitrary File Write via Path Traversal

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Prototype Pollution via parse() in NodeJS flatted

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided