🚨 Security Alert Triage Report

## 🚨 Security Alert Triage Report

**Triage Date:** 2025-10-25 17:33:23 UTC  
**Repository:** austenstone/angular-codespace  
**Triaged By:** GitHub Security Triage Agent  
**Total Alerts Analyzed:** 26

---

## 📊 Executive Summary

This repository has **26 open security alerts** consisting of 23 Dependabot alerts and 3 Code Scanning alerts. No secret scanning alerts were found. The majority of alerts (18 out of 23 Dependabot alerts) are in development dependencies, reducing immediate production risk. However, **2 HIGH-severity Dependabot alerts** and **3 MEDIUM-severity Code Scanning alerts** require attention. All alerts are **TRUE POSITIVES** that should be addressed through dependency updates and workflow permission hardening.

---

## 🔑 Secret Scanning Alerts

No secret scanning alerts found.

---

## 🤖 Dependabot Alerts

### Alert #79: tmp - Symbolic Link Directory Write Vulnerability
- **Priority:** 🟢 LOW
- **Severity:** Low
- **Disposition:** ✅ True Positive
- **Package:** tmp (npm)
- **Vulnerable Version Range:** <= 0.2.3
- **Patched Version:** 0.2.4
- **Dependency Type:** Development
- **Risk Assessment:** Low severity vulnerability in development dependency. Allows arbitrary file/directory write via symbolic link `dir` parameter. Requires local access and specific exploitation conditions. Not used in production code paths.
- **Recommended Action:** Update to tmp@0.2.4 when convenient during next dependency maintenance cycle.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/79

### Alert #78: on-headers - HTTP Response Header Manipulation
- **Priority:** 🟢 LOW
- **Severity:** Low
- **Disposition:** ✅ True Positive
- **Package:** on-headers (npm)
- **Vulnerable Version Range:** < 1.1.0
- **Patched Version:** 1.1.0
- **Dependency Type:** Development
- **Risk Assessment:** Low severity issue in development dependency affecting HTTP header handling. Limited impact as it's only used in development server context.
- **Recommended Action:** Update to on-headers@1.1.0 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/78

### Alert #74: webpack-dev-server - Source Code Exposure via Malicious Website
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium (CVSS 5.3)
- **Disposition:** ✅ True Positive
- **Package:** webpack-dev-server (npm)
- **Vulnerable Version Range:** <= 5.2.0
- **Patched Version:** 5.2.1
- **Dependency Type:** Development
- **Risk Assessment:** Development-only vulnerability. Attacker can inject script tag to steal source code when developer visits malicious site. Requires knowing the port and output entrypoint path. Only affects developers during local development.
- **Recommended Action:** Update to webpack-dev-server@5.2.1 or later to protect developers from source code theft.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/74

### Alert #73: webpack-dev-server - WebSocket CORS Bypass (Non-Chromium Browsers)
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium (CVSS 6.5)
- **Disposition:** ✅ True Positive
- **Package:** webpack-dev-server (npm)
- **Vulnerable Version Range:** <= 5.2.0
- **Patched Version:** 5.2.1
- **Dependency Type:** Development
- **Risk Assessment:** Development server accepts IP address origins, allowing WebSocket connections from malicious sites to steal source code. Only affects non-Chromium browsers (Firefox, Safari). Development-only impact.
- **Recommended Action:** Update to webpack-dev-server@5.2.1 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/73

### Alert #71: http-proxy-middleware - Double writeBody Call
- **Priority:** 🟢 LOW
- **Severity:** Medium (CVSS 4.0)
- **Disposition:** ✅ True Positive
- **Package:** http-proxy-middleware (npm)
- **Vulnerable Version Range:** >= 1.3.0, < 2.0.8
- **Patched Version:** 2.0.8
- **Dependency Type:** Development
- **Risk Assessment:** Development dependency with control flow issue. Low actual risk in development context.
- **Recommended Action:** Update to http-proxy-middleware@2.0.8 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/71

### Alert #66: serialize-javascript - Cross-site Scripting (XSS)
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium (CVSS 5.4)
- **Disposition:** ✅ True Positive
- **Package:** serialize-javascript (npm)
- **Vulnerable Version Range:** >= 6.0.0, < 6.0.2
- **Patched Version:** 6.0.2
- **Dependency Type:** Development
- **Risk Assessment:** XSS vulnerability when serializing untrusted inputs (regex, JavaScript objects). Development dependency used in build tooling. Medium risk if serialized data is sent to web clients.
- **Recommended Action:** Update to serialize-javascript@6.0.2 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/66

### Alert #65: esbuild - CORS Misconfiguration Allows Source Code Access
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium (CVSS 5.3)
- **Disposition:** ✅ True Positive
- **Package:** esbuild (npm)
- **Vulnerable Version Range:** <= 0.24.2
- **Patched Version:** 0.25.0
- **Dependency Type:** Development
- **Risk Assessment:** Development server sets `Access-Control-Allow-Origin: *` allowing any website to read responses including source code. Only affects developers using esbuild serve feature.
- **Recommended Action:** Update to esbuild@0.25.0 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/65

### Alert #59: cookie - Path, Name, Domain Injection
- **Priority:** 🟢 LOW
- **Severity:** Low (CVSS 0)
- **Disposition:** ✅ True Positive
- **Package:** cookie (npm)
- **Vulnerable Version Range:** < 0.7.0
- **Patched Version:** 0.7.0
- **Dependency Type:** Development
- **Risk Assessment:** Cookie field injection via out-of-bounds characters. Development dependency with minimal actual risk.
- **Recommended Action:** Update to cookie@0.7.0 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/59

### Alert #58: express - XSS via response.redirect()
- **Priority:** 🟢 LOW
- **Severity:** Low (CVSS 5.0)
- **Disposition:** ✅ True Positive
- **Package:** express (npm)
- **Vulnerable Version Range:** < 4.20.0
- **Patched Version:** 4.20.0
- **Dependency Type:** Development
- **Risk Assessment:** XSS vulnerability when passing unsanitized user input to response.redirect(). Requires specific exploitation conditions. Development dependency.
- **Recommended Action:** Update to express@4.20.0 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/58

### Alert #57: body-parser - Denial of Service
- **Priority:** 🟠 HIGH
- **Severity:** High (CVSS 7.5)
- **Disposition:** ✅ True Positive
- **Package:** body-parser (npm)
- **Vulnerable Version Range:** < 1.20.3
- **Patched Version:** 1.20.3
- **Dependency Type:** Development
- **Risk Assessment:** DoS vulnerability when URL encoding is enabled. Malicious payload can flood server with requests. Development dependency but HIGH severity warrants update.
- **Recommended Action:** Update to body-parser@1.20.3 immediately to prevent potential DoS attacks during development.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/57

### Alert #56: send - Template Injection Leading to XSS
- **Priority:** 🟢 LOW
- **Severity:** Low (CVSS 5.0)
- **Disposition:** ✅ True Positive
- **Package:** send (npm)
- **Vulnerable Version Range:** < 0.19.0
- **Patched Version:** 0.19.0
- **Dependency Type:** Development
- **Risk Assessment:** Template injection in SendStream.redirect(). Requires specific exploitation conditions. Development dependency.
- **Recommended Action:** Update to send@0.19.0 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/56

### Alert #55: serve-static - Template Injection Leading to XSS
- **Priority:** 🟢 LOW
- **Severity:** Low (CVSS 5.0)
- **Disposition:** ✅ True Positive
- **Package:** serve-static (npm)
- **Vulnerable Version Range:** < 1.16.0
- **Patched Version:** 1.16.0
- **Dependency Type:** Development
- **Risk Assessment:** Similar to send package, template injection vulnerability. Development dependency with limited impact.
- **Recommended Action:** Update to serve-static@1.16.0 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/55

### Alert #53: webpack - DOM Clobbering Leading to XSS
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium (CVSS 6.4)
- **Disposition:** ✅ True Positive
- **Package:** webpack (npm)
- **Vulnerable Version Range:** >= 5.0.0-alpha.0, < 5.94.0
- **Patched Version:** 5.94.0
- **Dependency Type:** Development
- **Risk Assessment:** DOM Clobbering vulnerability in AutoPublicPathRuntimeModule when output.publicPath is set to 'auto'. Can lead to XSS if attacker-controlled HTML elements are present. Development dependency but affects compiled output.
- **Recommended Action:** Update to webpack@5.94.0 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/53

### Alert #46: socket.io - Unhandled Error Event
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium (CVSS 7.3)
- **Disposition:** ✅ True Positive
- **Package:** socket.io (npm)
- **Vulnerable Version Range:** >= 3.0.0, < 4.6.2
- **Patched Version:** 4.6.2
- **Dependency Type:** Development
- **Risk Assessment:** Specially crafted Socket.IO packet can trigger uncaught exception, killing Node.js process. Development dependency used for real-time features.
- **Recommended Action:** Update to socket.io@4.6.2 or later to prevent DoS.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/46

### Alert #45: braces - Uncontrolled Resource Consumption
- **Priority:** 🟠 HIGH
- **Severity:** High (CVSS 7.5)
- **Disposition:** ✅ True Positive
- **Package:** braces (npm)
- **Vulnerable Version Range:** < 3.0.3
- **Patched Version:** 3.0.3
- **Dependency Type:** Development
- **Risk Assessment:** Memory exhaustion vulnerability when handling imbalanced braces. Can cause DoS by allocating heap memory without freeing it. Development dependency but HIGH severity.
- **Recommended Action:** Update to braces@3.0.3 immediately to prevent memory exhaustion attacks.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/45

### Alert #44: ws - DoS via Excessive HTTP Headers
- **Priority:** 🟠 HIGH
- **Severity:** High (CVSS 7.5)
- **Disposition:** ✅ True Positive
- **Package:** ws (npm)
- **Vulnerable Version Range:** >= 8.0.0, < 8.17.1
- **Patched Version:** 8.17.1
- **Dependency Type:** Development
- **Risk Assessment:** Request with excessive headers can crash ws server. Development dependency used for WebSocket connections. HIGH severity DoS vulnerability.
- **Recommended Action:** Update to ws@8.17.1 immediately to prevent DoS attacks.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/44

### Alert #43: ip - SSRF via Improper IP Categorization
- **Priority:** 🟠 HIGH
- **Severity:** High (CVSS 8.1)
- **Disposition:** ✅ True Positive
- **Package:** ip (npm)
- **Vulnerable Version Range:** <= 2.0.1
- **Patched Version:** No patch available
- **Dependency Type:** Development
- **Risk Assessment:** SSRF vulnerability - certain IP addresses improperly categorized as public. No patch available as package is unmaintained. Development dependency but HIGH severity.
- **Recommended Action:** Consider replacing with alternative package or implementing custom IP validation. Monitor for updates or use workarounds to validate IP addresses before trusting isPublic().
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/43

### Alert #41: express - Open Redirect in Malformed URLs
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium (CVSS 6.1)
- **Disposition:** ✅ True Positive
- **Package:** express (npm)
- **Vulnerable Version Range:** < 4.19.2
- **Patched Version:** 4.19.2
- **Dependency Type:** Development
- **Risk Assessment:** Open redirect vulnerability using malformed URLs. Development dependency with medium risk.
- **Recommended Action:** Update to express@4.19.2 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/41

### Alert #40: webpack-dev-middleware - Path Traversal
- **Priority:** 🟠 HIGH
- **Severity:** High (CVSS 7.4)
- **Disposition:** ✅ True Positive
- **Package:** webpack-dev-middleware (npm)
- **Vulnerable Version Range:** <= 5.3.3
- **Patched Version:** 5.3.4
- **Dependency Type:** Development
- **Risk Assessment:** Path traversal vulnerability allows accessing any file on developer's machine. HIGH severity but development-only impact. If writeToDisk is true, attackers can read arbitrary files.
- **Recommended Action:** Update to webpack-dev-middleware@5.3.4 immediately to prevent file disclosure.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/40

### Alert #39: webpack-dev-middleware - Path Traversal (duplicate)
- **Priority:** 🟠 HIGH
- **Severity:** High (CVSS 7.4)
- **Disposition:** ✅ True Positive
- **Package:** webpack-dev-middleware (npm)
- **Vulnerable Version Range:** >= 6.0.0, < 6.1.2
- **Patched Version:** 6.1.2
- **Dependency Type:** Development
- **Risk Assessment:** Same vulnerability as #40, different version range. Path traversal allowing arbitrary file access.
- **Recommended Action:** Update to webpack-dev-middleware@6.1.2 or later immediately.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/39

### Alert #38: follow-redirects - Proxy-Authorization Header Leak
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium (CVSS 6.5)
- **Disposition:** ✅ True Positive
- **Package:** follow-redirects (npm)
- **Vulnerable Version Range:** <= 1.15.5
- **Patched Version:** 1.15.6
- **Dependency Type:** Development
- **Risk Assessment:** Proxy-Authorization header kept across cross-domain redirects, potentially leaking credentials. Development dependency.
- **Recommended Action:** Update to follow-redirects@1.15.6 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/38

### Alert #37: ip - SSRF via Improper IP Categorization
- **Priority:** 🟢 LOW
- **Severity:** Low
- **Disposition:** ✅ True Positive
- **Package:** ip (npm)
- **Vulnerable Version Range:** = 2.0.0
- **Patched Version:** 2.0.1
- **Dependency Type:** Development
- **Risk Assessment:** Earlier version of ip SSRF issue. Development dependency.
- **Recommended Action:** Update to ip@2.0.1 or later, but note that 2.0.1 has subsequent vulnerabilities (see alert #43).
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/37

### Alert #35: follow-redirects - Improper URL Handling
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium (CVSS 6.1)
- **Disposition:** ✅ True Positive
- **Package:** follow-redirects (npm)
- **Vulnerable Version Range:** < 1.15.4
- **Patched Version:** 1.15.4
- **Dependency Type:** Development
- **Risk Assessment:** Improper input validation in URL parsing can lead to hostname misinterpretation and open redirects. Development dependency.
- **Recommended Action:** Update to follow-redirects@1.15.4 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/35

### Alert #34: @babel/traverse - Arbitrary Code Execution
- **Priority:** 🔴 CRITICAL
- **Severity:** Critical (CVSS 9.4)
- **Disposition:** ✅ True Positive
- **Package:** @babel/traverse (npm)
- **Vulnerable Version Range:** < 7.23.2
- **Patched Version:** 7.23.2
- **Dependency Type:** Development
- **Risk Assessment:** **CRITICAL** - Specially crafted code can lead to arbitrary code execution during compilation when using certain Babel plugins. While this is a development dependency, code execution during build is a severe risk. Only affects compilation of untrusted code.
- **Recommended Action:** **IMMEDIATE ACTION REQUIRED** - Update to @babel/traverse@7.23.2 or later immediately. Ensure only trusted code is compiled.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/34

### Alert #33: postcss - Line Return Parsing Error
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium (CVSS 5.3)
- **Disposition:** ✅ True Positive
- **Package:** postcss (npm)
- **Vulnerable Version Range:** < 8.4.31
- **Patched Version:** 8.4.31
- **Dependency Type:** Development
- **Risk Assessment:** CSS comment parsing issue that can include malicious content in output. Affects linters parsing untrusted CSS. Development dependency.
- **Recommended Action:** Update to postcss@8.4.31 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/33

### Alert #26: socket.io-parser - Insufficient Input Validation
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium (CVSS 7.3)
- **Disposition:** ✅ True Positive
- **Package:** socket.io-parser (npm)
- **Vulnerable Version Range:** >= 4.0.4, < 4.2.3
- **Patched Version:** 4.2.3
- **Dependency Type:** Development
- **Risk Assessment:** Specially crafted Socket.IO packet can kill Node.js process. Development dependency.
- **Recommended Action:** Update to socket.io-parser@4.2.3 or later.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/26

### Alert #9: loader-utils - Prototype Pollution
- **Priority:** 🔴 CRITICAL
- **Severity:** Critical (CVSS 9.8)
- **Disposition:** ✅ True Positive
- **Package:** loader-utils (npm)
- **Vulnerable Version Range:** >= 2.0.0, < 2.0.3
- **Patched Version:** 2.0.3
- **Dependency Type:** Development
- **Risk Assessment:** **CRITICAL** - Prototype pollution vulnerability in parseQuery function. Can lead to remote code execution. Development dependency used by webpack loaders but still critical severity.
- **Recommended Action:** **IMMEDIATE ACTION REQUIRED** - Update to loader-utils@2.0.3 or later immediately.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/dependabot/9

---

## 🔍 Code Scanning Alerts

### Alert #23: Workflow Missing Permissions (copilot-security-triage.yml)
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium
- **Disposition:** ✅ True Positive
- **Rule:** actions/missing-workflow-permissions (CWE-275)
- **Location:** .github/workflows/copilot-security-triage.yml (lines 6-286)
- **Branch:** main
- **Risk Assessment:** Workflow does not explicitly limit GITHUB_TOKEN permissions. Without explicit permissions, workflow inherits repository-level permissions which may violate principle of least privilege. Medium risk for over-permissioned workflows.
- **Recommended Action:** Add explicit permissions block to workflow. Minimal starting point: `permissions: {contents: read, issues: write}` for security triage workflow that needs to create issues.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/code-scanning/23

### Alert #21: Workflow Missing Permissions (dependabot-copilot.yml)
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium
- **Disposition:** ✅ True Positive
- **Rule:** actions/missing-workflow-permissions (CWE-275)
- **Location:** .github/workflows/dependabot-copilot.yml (lines 9-11)
- **Branch:** main
- **Risk Assessment:** Workflow lacks explicit GITHUB_TOKEN permissions. Inherits repository permissions which may be overly broad.
- **Recommended Action:** Add explicit permissions block with minimal required permissions. Review what actions this workflow performs and grant only necessary permissions.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/code-scanning/21

### Alert #7: Workflow Missing Permissions (angular.test.yml)
- **Priority:** 🟡 MEDIUM
- **Severity:** Medium
- **Disposition:** ✅ True Positive
- **Rule:** actions/missing-workflow-permissions (CWE-275)
- **Location:** .github/workflows/angular.test.yml (lines 13-25)
- **Branch:** main
- **Risk Assessment:** Test workflow missing explicit permissions. Should have minimal permissions for testing. Medium risk.
- **Recommended Action:** Add explicit permissions block. Minimal starting point: `permissions: {contents: read}` for basic test workflow.
- **Alert URL:** https://github.com/austenstone/angular-codespace/security/code-scanning/7

---

## 📋 Summary Statistics

**By Alert Type:**
- **Secret Scanning:** 0
- **Dependabot:** 23 (2 Critical, 5 High, 10 Medium, 6 Low)
- **Code Scanning:** 3 (0 Critical, 0 High, 3 Medium, 0 Low)

**By Priority:**
- **Critical (🔴):** 2
- **High (🟠):** 5
- **Medium (🟡):** 13
- **Low (🟢):** 6

**By Disposition:**
- **True Positives (✅):** 26
- **False Positives (❌):** 0
- **Informational (ℹ️):** 0

---

## 🎯 Immediate Action Items

1. **CRITICAL PRIORITY** - Update @babel/traverse to 7.23.2+ immediately to prevent arbitrary code execution during build (Alert #34)
2. **CRITICAL PRIORITY** - Update loader-utils to 2.0.3+ immediately to prevent prototype pollution RCE (Alert #9)
3. **HIGH PRIORITY** - Update webpack-dev-middleware to 5.3.4+ or 6.1.2+ to prevent path traversal file disclosure (Alerts #40, #39)
4. **HIGH PRIORITY** - Update braces to 3.0.3+ to prevent memory exhaustion DoS (Alert #45)
5. **HIGH PRIORITY** - Update ws to 8.17.1+ to prevent DoS via excessive headers (Alert #44)
6. **HIGH PRIORITY** - Update body-parser to 1.20.3+ to prevent DoS (Alert #57)
7. **HIGH PRIORITY** - Replace or mitigate ip package vulnerability - no patch available (Alert #43)
8. **MEDIUM PRIORITY** - Add explicit permissions to all GitHub Actions workflows (Alerts #23, #21, #7)
9. **ROUTINE MAINTENANCE** - Update remaining medium and low severity dependencies during next maintenance cycle

---

## Additional Context

**Patterns Observed:**
- All Dependabot alerts are in **development dependencies**, significantly reducing production risk
- Multiple alerts affect webpack ecosystem (webpack, webpack-dev-server, webpack-dev-middleware, loader-utils)
- Common vulnerability types: DoS, path traversal, XSS, prototype pollution, SSRF
- Code scanning alerts all relate to GitHub Actions workflow security hardening

**Systemic Recommendations:**
1. Implement automated dependency updates (e.g., Dependabot auto-merge for development dependencies)
2. Add workflow permission hardening as standard practice for all new workflows
3. Consider implementing security scanning in CI/CD pipeline
4. Evaluate replacing unmaintained packages (ip package has no patch for HIGH severity SSRF)
5. Since this is a template repository, fixing these issues will improve security for all derived repositories

**Development vs Production Context:**
This appears to be an Angular development template repository. All Dependabot vulnerabilities affect development dependencies used for local development and build processes. While this reduces immediate production risk, developers using this template are still vulnerable during development (source code theft, local file access, DoS). The template nature of this repository amplifies the importance of fixes, as vulnerabilities will propagate to all projects created from this template.


🚨 Security Alert Triage Report - 26 Alerts Analyzed #42

Description

📊 Executive Summary

🔑 Secret Scanning Alerts

🤖 Dependabot Alerts

Alert #79: tmp - Symbolic Link Directory Write Vulnerability

Alert #78: on-headers - HTTP Response Header Manipulation

Alert #74: webpack-dev-server - Source Code Exposure via Malicious Website

Alert #73: webpack-dev-server - WebSocket CORS Bypass (Non-Chromium Browsers)

Alert #71: http-proxy-middleware - Double writeBody Call

Alert #66: serialize-javascript - Cross-site Scripting (XSS)

Alert #65: esbuild - CORS Misconfiguration Allows Source Code Access

Alert #59: cookie - Path, Name, Domain Injection

Alert #58: express - XSS via response.redirect()

Alert #57: body-parser - Denial of Service

Alert #56: send - Template Injection Leading to XSS

Alert #55: serve-static - Template Injection Leading to XSS

Alert #53: webpack - DOM Clobbering Leading to XSS

Alert #46: socket.io - Unhandled Error Event

Alert #45: braces - Uncontrolled Resource Consumption

Alert #44: ws - DoS via Excessive HTTP Headers

Alert #43: ip - SSRF via Improper IP Categorization

Alert #41: express - Open Redirect in Malformed URLs

Alert #40: webpack-dev-middleware - Path Traversal

Alert #39: webpack-dev-middleware - Path Traversal (duplicate)

Alert #38: follow-redirects - Proxy-Authorization Header Leak

Alert #37: ip - SSRF via Improper IP Categorization

Alert #35: follow-redirects - Improper URL Handling

Alert #34: @babel/traverse - Arbitrary Code Execution

Alert #33: postcss - Line Return Parsing Error

Alert #26: socket.io-parser - Insufficient Input Validation

Alert #9: loader-utils - Prototype Pollution

🔍 Code Scanning Alerts

Alert #23: Workflow Missing Permissions (copilot-security-triage.yml)

Alert #21: Workflow Missing Permissions (dependabot-copilot.yml)

Alert #7: Workflow Missing Permissions (angular.test.yml)

📋 Summary Statistics

🎯 Immediate Action Items

Additional Context

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions