{
 "arch": "amd64",
 "findings": [
  {
   "affects": [
    "minimatch"
   ],
   "cvss": 8.7,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "10.2.1"
   ],
   "id": "GHSA-3ppc-4f35-3m26",
   "severity": "high",
   "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
   "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26"
  },
  {
   "affects": [
    "minimatch"
   ],
   "cvss": 8.7,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "3.1.3"
   ],
   "id": "GHSA-3ppc-4f35-3m26",
   "severity": "high",
   "title": "minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
   "url": "https://github.com/advisories/GHSA-3ppc-4f35-3m26"
  },
  {
   "affects": [
    "@isaacs/brace-expansion"
   ],
   "cvss": 8.7,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "5.0.1"
   ],
   "id": "GHSA-7h2j-956f-4vf2",
   "severity": "high",
   "title": "@isaacs/brace-expansion has Uncontrolled Resource Consumption",
   "url": "https://github.com/advisories/GHSA-7h2j-956f-4vf2"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 8.2,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.11"
   ],
   "id": "GHSA-9ppj-qmqm-q256",
   "severity": "high",
   "title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
   "url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 8.2,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.10"
   ],
   "id": "GHSA-qffp-2rhf-9h96",
   "severity": "high",
   "title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
   "url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96"
  },
  {
   "affects": [
    "lodash"
   ],
   "cvss": 8.1,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "4.18.0"
   ],
   "id": "GHSA-r5fr-rjxr-66jc",
   "severity": "high",
   "title": "lodash vulnerable to Code Injection via `_.template` imports key names",
   "url": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc"
  },
  {
   "affects": [
    "shell-quote"
   ],
   "cvss": 8.1,
   "distro_severity": "critical",
   "fix_state": "fixed",
   "fixed_in": [
    "1.8.4"
   ],
   "id": "GHSA-w7jw-789q-3m8p",
   "severity": "high",
   "title": "shell-quote quote() does not escape newlines in object .op values",
   "url": "https://github.com/advisories/GHSA-w7jw-789q-3m8p"
  },
  {
   "affects": [
    "ip-address"
   ],
   "cvss": 7.7,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "10.3.1"
   ],
   "id": "GHSA-mwp4-54f8-5fhr",
   "severity": "high",
   "title": "ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass",
   "url": "https://github.com/advisories/GHSA-mwp4-54f8-5fhr"
  },
  {
   "affects": [
    "minimatch"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "10.2.3"
   ],
   "id": "GHSA-23c5-xmqv-rm74",
   "severity": "high",
   "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
   "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74"
  },
  {
   "affects": [
    "minimatch"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "3.1.4"
   ],
   "id": "GHSA-23c5-xmqv-rm74",
   "severity": "high",
   "title": "minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions",
   "url": "https://github.com/advisories/GHSA-23c5-xmqv-rm74"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 7.5,
   "distro_severity": "critical",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.19"
   ],
   "id": "GHSA-23hp-3jrh-7fpw",
   "severity": "high",
   "title": "node-tar: Decompression/parse DoS via unlimited input",
   "url": "https://github.com/advisories/GHSA-23hp-3jrh-7fpw"
  },
  {
   "affects": [
    "js-yaml"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "4.3.2"
   ],
   "id": "GHSA-2883-xcg3-v3hh",
   "severity": "high",
   "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
   "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh"
  },
  {
   "affects": [
    "shell-quote"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "1.9.0"
   ],
   "id": "GHSA-395f-4hp3-45gv",
   "severity": "high",
   "title": "shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)",
   "url": "https://github.com/advisories/GHSA-395f-4hp3-45gv"
  },
  {
   "affects": [
    "js-yaml"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "4.3.1"
   ],
   "id": "GHSA-5p4m-2wfm-xmqj",
   "severity": "high",
   "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported",
   "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj"
  },
  {
   "affects": [
    "minimatch"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "10.2.3"
   ],
   "id": "GHSA-7r86-cg39-jmmj",
   "severity": "high",
   "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
   "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj"
  },
  {
   "affects": [
    "minimatch"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "3.1.3"
   ],
   "id": "GHSA-7r86-cg39-jmmj",
   "severity": "high",
   "title": "minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
   "url": "https://github.com/advisories/GHSA-7r86-cg39-jmmj"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.18"
   ],
   "id": "GHSA-8x88-c5mf-7j5w",
   "severity": "high",
   "title": "node-tar: Negative tar entry size causes infinite loop in archive replace",
   "url": "https://github.com/advisories/GHSA-8x88-c5mf-7j5w"
  },
  {
   "affects": [
    "ws"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.11"
   ],
   "id": "GHSA-96hv-2xvq-fx4p",
   "severity": "high",
   "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks",
   "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p"
  },
  {
   "affects": [
    "picomatch"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "2.3.2"
   ],
   "id": "GHSA-c2c7-rcm5-vvqj",
   "severity": "high",
   "title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
   "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj"
  },
  {
   "affects": [
    "minimatch"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "3.0.5"
   ],
   "id": "GHSA-f8q6-p94x-37v3",
   "severity": "high",
   "title": "minimatch ReDoS vulnerability",
   "url": "https://github.com/advisories/GHSA-f8q6-p94x-37v3"
  },
  {
   "affects": [
    "braces"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "3.0.3"
   ],
   "id": "GHSA-grv7-fg5c-xmjg",
   "severity": "high",
   "title": "Uncontrolled resource consumption in braces",
   "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg"
  },
  {
   "affects": [
    "brace-expansion"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "1.1.17"
   ],
   "id": "GHSA-mh99-v99m-4gvg",
   "severity": "high",
   "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
   "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.21"
   ],
   "id": "GHSA-r292-9mhp-454m",
   "severity": "high",
   "title": "node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection",
   "url": "https://github.com/advisories/GHSA-r292-9mhp-454m"
  },
  {
   "affects": [
    "brace-expansion"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "1.1.18"
   ],
   "id": "GHSA-rgw5-rvv9-x895",
   "severity": "high",
   "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
   "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 6.9,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.16"
   ],
   "id": "GHSA-vmf3-w455-68vh",
   "severity": "medium",
   "title": "node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",
   "url": "https://github.com/advisories/GHSA-vmf3-w455-68vh"
  },
  {
   "affects": [
    "lodash"
   ],
   "cvss": 6.5,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "4.18.0"
   ],
   "id": "GHSA-f23m-r3pf-42rh",
   "severity": "medium",
   "title": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
   "url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh"
  },
  {
   "affects": [
    "brace-expansion"
   ],
   "cvss": 6.5,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "1.1.13"
   ],
   "id": "GHSA-f886-m6hf-6m8v",
   "severity": "medium",
   "title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
   "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v"
  },
  {
   "affects": [
    "lodash"
   ],
   "cvss": 6.5,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "4.17.23"
   ],
   "id": "GHSA-xxjr-mmjv-4gpg",
   "severity": "medium",
   "title": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
   "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg"
  },
  {
   "affects": [
    "brace-expansion"
   ],
   "cvss": 5.3,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "1.1.16"
   ],
   "id": "GHSA-3jxr-9vmj-r5cp",
   "severity": "medium",
   "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
   "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp"
  },
  {
   "affects": [
    "picomatch"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "2.3.2"
   ],
   "id": "GHSA-3v7f-55p6-f55p",
   "severity": "medium",
   "title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
   "url": "https://github.com/advisories/GHSA-3v7f-55p6-f55p"
  },
  {
   "affects": [
    "micromatch"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "4.0.8"
   ],
   "id": "GHSA-952p-6rrq-rcjv",
   "severity": "medium",
   "title": "Regular Expression Denial of Service (ReDoS) in micromatch",
   "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.17"
   ],
   "id": "GHSA-gvwx-54wh-qm9j",
   "severity": "medium",
   "title": "node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records",
   "url": "https://github.com/advisories/GHSA-gvwx-54wh-qm9j"
  },
  {
   "affects": [
    "got"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "11.8.5"
   ],
   "id": "GHSA-pfrx-2q88-qq97",
   "severity": "medium",
   "title": "Got allows a redirect to a UNIX socket",
   "url": "https://github.com/advisories/GHSA-pfrx-2q88-qq97"
  },
  {
   "affects": [
    "ip-address"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "10.1.1"
   ],
   "id": "GHSA-v2v4-37r5-5v8g",
   "severity": "medium",
   "title": "ip-address has XSS in Address6 HTML-emitting methods",
   "url": "https://github.com/advisories/GHSA-v2v4-37r5-5v8g"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.18"
   ],
   "id": "GHSA-w8wr-v893-vjvp",
   "severity": "medium",
   "title": "node-tar: Process crash via PAX numeric path type confusion",
   "url": "https://github.com/advisories/GHSA-w8wr-v893-vjvp"
  },
  {
   "affects": [
    "brace-expansion"
   ],
   "cvss": 3.1,
   "distro_severity": "low",
   "fix_state": "fixed",
   "fixed_in": [
    "1.1.12"
   ],
   "id": "GHSA-v6h2-p8h4-qcjw",
   "severity": "low",
   "title": "brace-expansion Regular Expression Denial of Service vulnerability",
   "url": "https://github.com/advisories/GHSA-v6h2-p8h4-qcjw"
  },
  {
   "affects": [
    "diff"
   ],
   "cvss": 2.7,
   "distro_severity": "low",
   "fix_state": "fixed",
   "fixed_in": [
    "5.2.2"
   ],
   "id": "GHSA-73rr-hh4g-fpgx",
   "severity": "low",
   "title": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
   "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx"
  }
 ],
 "findings_changed_at": "2026-09-16T13:22:27Z",
 "image": "yarn",
 "inputs": {
  "sbom_sha256": "7f38382618ba8f852ee5439219729284a4db0a95932858c74d898abbedb34331"
 },
 "platform_digest": "sha256:19c3e7e31e66ce05bba800ec53e742099afcac6791529e60888f0698672dbf21",
 "project": "yarn",
 "receipt_sha256": "fdebfe99bac61e284948d9e3b0801607d04522e6d13802bfe6c78bbcc10ded94",
 "scanner": "grype",
 "severity_counts": {
  "critical": 0,
  "high": 24,
  "low": 2,
  "medium": 11,
  "unknown": 0
 },
 "suppressed": [],
 "version": "4.18.0",
 "vex_applied": [
  "yarn-4.18.0-amd64.vex.json",
  "yarn-4.18.0-amd64.ubuntu-vex.json"
 ]
}