KERN Chatbot

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

flatted vulnerable to unbounded recursion DoS in parse() revive phase

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

nanoid: non-secure generators can loop indefinitely with negative size

ajv has ReDoS when using `$data` option

nanoid: custom generators can loop indefinitely when size is zero

DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

mdast-util-to-hast has unsanitized class attribute

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

@babel/core: Arbitrary File Read via sourceMappingURL Comment

js-yaml: YAML merge-key chains can force quadratic CPU consumption

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

When Vitest UI server is listening, arbitrary file can be read and executed

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

esbuild enables any website to send any requests to the development server and read the response

source-map-js allows event-loop denial of service through indexed source-map section offsets

launch-editor: escapeCmdArgs() omits % escaping on Windows

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Tinypool: Prototype Pollution Gadget to RCE in run() options

vite allows server.fs.deny bypass via backslash on Windows

Vite: Cross origin script execution through Vite custom middleware

Picomatch has a ReDoS vulnerability via extglob quantifiers

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes

DOMPurify USE_PROFILES prototype pollution allows event handlers

DOMPurify ADD_ATTR predicate skips URI validation

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

vite: `server.fs.deny` bypass on Windows alternate paths

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Vite middleware may serve files starting with the same name with the public directory

DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases