[VANTA] [VULNERABILITY] <CRITICAL> CVE-2024-21536, CVE-2024-21538, CVE-2024-4068 and others, fix before 2026-10-03

[marco-commercelayer]

Important

CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.

DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

FIXED npm-shell-quote >= 1.1.0, <= 1.8.3 CVE-2026-9277 CRITICAL

npm-shell-quote >= 1.1.0, <= 1.8.3 CODE_REPOSITORY/dato-plugin CVE-2026-9277 CRITICAL remediate by: 2026-10-03T14:38:12.386Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/313

Related URLs

• GHSA-w7jw-789q-3m8p
• https://nvd.nist.gov/vuln/detail/CVE-2026-9277
• ljharb/shell-quote@1518179
• https://github.com/ljharb/shell-quote
• https://www.npmjs.com/package/shell-quote
• http://www.openwall.com/lists/oss-security/2026/05/23/2
• GHSA-w7jw-789q-3m8p

FIXED npm-form-data >= 3.0.0, < 3.0.4 CVE-2025-7783 CRITICAL

npm-form-data >= 3.0.0, < 3.0.4 CODE_REPOSITORY/dato-plugin CVE-2025-7783 CRITICAL remediate by: 2026-10-03T14:38:12.386Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/130

Related URLs

• GHSA-fjxv-7rqg-78g4
• https://nvd.nist.gov/vuln/detail/CVE-2025-7783
• form-data/form-data@3d17230
• https://github.com/benweissmann/CVE-2025-7783-poc
• https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html
• GHSA-fjxv-7rqg-78g4

FIXED npm-websocket-driver < 0.7.5 CVE-2026-54466 CRITICAL

npm-websocket-driver < 0.7.5 CODE_REPOSITORY/dato-plugin CVE-2026-54466 CRITICAL remediate by: 2026-10-03T14:38:12.386Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/345

Related URLs

• GHSA-xv26-6w52-cph6
• https://github.com/faye/websocket-driver-node/releases/tag/0.7.5
• GHSA-xv26-6w52-cph6

FIXED npm-websocket-driver < 0.7.5 CVE-2026-54490 MEDIUM

npm-websocket-driver < 0.7.5 CODE_REPOSITORY/dato-plugin CVE-2026-54490 MEDIUM remediate by: 2026-11-02T14:38:13.746Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/343

Related URLs

• GHSA-mp7j-qc5w-4988
• https://github.com/faye/websocket-driver-node/releases/tag/0.7.5
• GHSA-mp7j-qc5w-4988

FIXED npm-jsonpath <= 1.2.1 CVE-2026-1615 HIGH

npm-jsonpath <= 1.2.1 CODE_REPOSITORY/dato-plugin CVE-2026-1615 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/182

Related URLs

• https://nvd.nist.gov/vuln/detail/CVE-2026-1615
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15141219
• https://security.snyk.io/vuln/SNYK-JS-JSONPATH-13645034
• https://github.com/dchester/jsonpath/blob/c1dd8ec74034fb0375233abb5fdbec51ac317b4b/lib/handlers.js#L243
• Attempt to fix CVE-2026-1615 vulnerability dchester/jsonpath#197
• dchester/jsonpath@491e2e0
• dchester/jsonpath@b61111f
• GHSA-87r5-mp6g-5w5j

FIXED npm-node-forge < 1.3.2 CVE-2025-12816 HIGH

npm-node-forge < 1.3.2 CODE_REPOSITORY/dato-plugin CVE-2025-12816 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/151

Related URLs

• GHSA-5gfm-wpxj-wjgq
• Pre-release updates. digitalbazaar/forge#1124
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/asn1.js#L1153
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/ed25519.js#L81
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pbe.js#L363
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs12.js#L328
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/pkcs7.js#L90
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/rsa.js#L1167
• https://github.com/digitalbazaar/forge/blob/2bb97afb5058285ef09bcf1d04d6bd6b87cffd58/lib/x509.js#L667
• https://kb.cert.org/vuls/id/521113
• https://www.kb.cert.org/vuls/id/521113
• https://www.npmjs.com/package/node-forge
• GHSA-5gfm-wpxj-wjgq

FIXED npm-node-forge < 1.3.2 CVE-2025-66031 HIGH

npm-node-forge < 1.3.2 CODE_REPOSITORY/dato-plugin CVE-2025-66031 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/153

Related URLs

• GHSA-554w-wpv2-vw27
• digitalbazaar/forge@260425c
• GHSA-554w-wpv2-vw27

FIXED npm-node-forge < 1.3.2 CVE-2025-66030 MEDIUM

npm-node-forge < 1.3.2 CODE_REPOSITORY/dato-plugin CVE-2025-66030 MEDIUM remediate by: 2026-11-02T14:38:13.746Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/149

Related URLs

• GHSA-65ch-62r8-g69g
• digitalbazaar/forge@3e0c35a
• https://nvd.nist.gov/vuln/detail/CVE-2025-66030
• GHSA-65ch-62r8-g69g

FIXED npm-@babel/plugin-transform-modules-systemjs >= 7.12.0, <= 7.29.3 CVE-2026-44728 HIGH

npm-@babel/plugin-transform-modules-systemjs >= 7.12.0, <= 7.29.3 CODE_REPOSITORY/dato-plugin CVE-2026-44728 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/286

Related URLs

• GHSA-fv7c-fp4j-7gwp
• https://nvd.nist.gov/vuln/detail/CVE-2026-44728
• GHSA-fv7c-fp4j-7gwp

FIXED npm-svgo >= 1.0.0, < 2.8.3 CVE-2026-73650 HIGH

npm-svgo >= 1.0.0, < 2.8.3 CODE_REPOSITORY/dato-plugin CVE-2026-73650 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/368

Related URLs

• GHSA-2p49-hgcm-8545
• svg/svgo@628e3bc
• svg/svgo@72a2388
• svg/svgo@f529cfc
• https://github.com/svg/svgo/releases/tag/v2.8.3
• https://github.com/svg/svgo/releases/tag/v3.3.4
• https://github.com/svg/svgo/releases/tag/v4.0.2
• GHSA-2p49-hgcm-8545

FIXED npm-serialize-javascript <= 7.0.2 GHSA-5c6j-r48x-rmvq HIGH

npm-serialize-javascript <= 7.0.2 CODE_REPOSITORY/dato-plugin GHSA-5c6j-r48x-rmvq HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/215

Related URLs

• GHSA-5c6j-r48x-rmvq
• https://nvd.nist.gov/vuln/detail/CVE-2020-7660
• yahoo/serialize-javascript@2e609d0
• GHSA-hxcc-f52p-wc94
• https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3
• GHSA-5c6j-r48x-rmvq

FIXED npm-lodash-es >= 4.0.0, <= 4.17.23 CVE-2026-4800 HIGH

npm-lodash-es >= 4.0.0, <= 4.17.23 CODE_REPOSITORY/dato-plugin CVE-2026-4800 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/259

Related URLs

• GHSA-r5fr-rjxr-66jc
• https://nvd.nist.gov/vuln/detail/CVE-2026-4800
• lodash/lodash@3469357
• https://cna.openjsf.org/security-advisories.html
• GHSA-35jh-r3h4-6jhm
• GHSA-r5fr-rjxr-66jc

FIXED npm-lodash >= 4.0.0, <= 4.17.23 CVE-2026-4800 HIGH

npm-lodash >= 4.0.0, <= 4.17.23 CODE_REPOSITORY/dato-plugin CVE-2026-4800 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/265

Related URLs

• GHSA-r5fr-rjxr-66jc
• https://nvd.nist.gov/vuln/detail/CVE-2026-4800
• lodash/lodash@3469357
• https://cna.openjsf.org/security-advisories.html
• GHSA-35jh-r3h4-6jhm
• GHSA-r5fr-rjxr-66jc

FIXED npm-body-parser < 1.20.3 CVE-2024-45590 HIGH

npm-body-parser < 1.20.3 CODE_REPOSITORY/dato-plugin CVE-2024-45590 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/80

Related URLs

• GHSA-qwcr-r2fm-qrc7
• expressjs/body-parser@b2695c4
• https://nvd.nist.gov/vuln/detail/CVE-2024-45590
• GHSA-qwcr-r2fm-qrc7

FIXED npm-http-proxy-middleware < 2.0.7 CVE-2024-21536 HIGH

npm-http-proxy-middleware < 2.0.7 CODE_REPOSITORY/dato-plugin CVE-2024-21536 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/94

Related URLs

• https://nvd.nist.gov/vuln/detail/CVE-2024-21536
• chimurai/http-proxy-middleware@0b4274e
• chimurai/http-proxy-middleware@788b21e
• https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a
• https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906
• GHSA-c7qv-q95q-8v27

FIXED npm-cross-spawn >= 7.0.0, < 7.0.5 CVE-2024-21538 HIGH

npm-cross-spawn >= 7.0.0, < 7.0.5 CODE_REPOSITORY/dato-plugin CVE-2024-21538 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/96

Related URLs

• https://nvd.nist.gov/vuln/detail/CVE-2024-21538
• fix: disable regexp backtracking moxystudio/node-cross-spawn#160
• moxystudio/node-cross-spawn@5ff3a07
• moxystudio/node-cross-spawn@640d391
• https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230
• Backport GHSA-3xgq-45jj-v275 moxystudio/node-cross-spawn#165
• moxystudio/node-cross-spawn@d35c865
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349
• GHSA-3xgq-45jj-v275

FIXED npm-braces < 3.0.3 CVE-2024-4068 HIGH

npm-braces < 3.0.3 CODE_REPOSITORY/dato-plugin CVE-2024-4068 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/100

Related URLs

• https://nvd.nist.gov/vuln/detail/CVE-2024-4068
• CWE-400 | Uncontrolled resource consumption micromatch/braces#35
• https://devhub.checkmarx.com/cve-details/CVE-2024-4068
• https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308
• fix: vulnerability micromatch/braces#37
• Reduce maxLength default to 10,000 and revert maxSymbols change micromatch/braces#40
• micromatch/braces@415d660
• GHSA-grv7-fg5c-xmjg

FIXED npm-path-to-regexp < 0.1.10 CVE-2024-45296 HIGH

npm-path-to-regexp < 0.1.10 CODE_REPOSITORY/dato-plugin CVE-2024-45296 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/101

Related URLs

• GHSA-9wv6-86v2-598j
• pillarjs/path-to-regexp@29b96b4
• pillarjs/path-to-regexp@60f2121
• https://nvd.nist.gov/vuln/detail/CVE-2024-45296
• pillarjs/path-to-regexp@925ac8e
• pillarjs/path-to-regexp@d31670a
• pillarjs/path-to-regexp@f1253b4
• https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0
• https://security.netapp.com/advisory/ntap-20250124-0001
• GHSA-9wv6-86v2-598j

FIXED npm-path-to-regexp < 0.1.12 CVE-2024-52798 HIGH

npm-path-to-regexp < 0.1.12 CODE_REPOSITORY/dato-plugin CVE-2024-52798 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/102

Related URLs

• GHSA-rhx6-c78j-4q9w
• https://blakeembrey.com/posts/2024-09-web-redos
• https://nvd.nist.gov/vuln/detail/CVE-2024-52798
• pillarjs/path-to-regexp@f01c26a
• https://security.netapp.com/advisory/ntap-20250124-0002
• GHSA-rhx6-c78j-4q9w

FIXED npm-glob >= 10.2.0, < 10.5.0 CVE-2025-64756 HIGH

npm-glob >= 10.2.0, < 10.5.0 CODE_REPOSITORY/dato-plugin CVE-2025-64756 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/146

Related URLs

• GHSA-5j98-mcp5-4vw2
• isaacs/node-glob@47473c0
• https://nvd.nist.gov/vuln/detail/CVE-2025-64756
• isaacs/node-glob@1e4e297
• GHSA-5j98-mcp5-4vw2

FIXED npm-minimatch >= 5.0.0, < 5.1.8 CVE-2026-27904 HIGH

npm-minimatch >= 5.0.0, < 5.1.8 CODE_REPOSITORY/dato-plugin CVE-2026-27904 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/203

Related URLs

• GHSA-23c5-xmqv-rm74
• https://nvd.nist.gov/vuln/detail/CVE-2026-27904
• isaacs/minimatch@11d0df6
• GHSA-23c5-xmqv-rm74

FIXED npm-minimatch >= 5.0.0, < 5.1.8 CVE-2026-27903 HIGH

npm-minimatch >= 5.0.0, < 5.1.8 CODE_REPOSITORY/dato-plugin CVE-2026-27903 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/205

Related URLs

• GHSA-7r86-cg39-jmmj
• https://nvd.nist.gov/vuln/detail/CVE-2026-27903
• isaacs/minimatch@0bf499a
• GHSA-7r86-cg39-jmmj

FIXED npm-minimatch < 3.1.3 CVE-2026-27903 HIGH

npm-minimatch < 3.1.3 CODE_REPOSITORY/dato-plugin CVE-2026-27903 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/207

Related URLs

• GHSA-7r86-cg39-jmmj
• https://nvd.nist.gov/vuln/detail/CVE-2026-27903
• isaacs/minimatch@0bf499a
• GHSA-7r86-cg39-jmmj

FIXED npm-minimatch < 3.1.3 CVE-2026-26996 HIGH

npm-minimatch < 3.1.3 CODE_REPOSITORY/dato-plugin CVE-2026-26996 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/195

Related URLs

• GHSA-3ppc-4f35-3m26
• isaacs/minimatch@2e111f3
• https://nvd.nist.gov/vuln/detail/CVE-2026-26996
• GHSA-3ppc-4f35-3m26

FIXED npm-minimatch < 3.1.4 CVE-2026-27904 HIGH

npm-minimatch < 3.1.4 CODE_REPOSITORY/dato-plugin CVE-2026-27904 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/209

Related URLs

• GHSA-23c5-xmqv-rm74
• https://nvd.nist.gov/vuln/detail/CVE-2026-27904
• isaacs/minimatch@11d0df6
• GHSA-23c5-xmqv-rm74

FIXED npm-minimatch >= 9.0.0, < 9.0.7 CVE-2026-27903 HIGH

npm-minimatch >= 9.0.0, < 9.0.7 CODE_REPOSITORY/dato-plugin CVE-2026-27903 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/211

Related URLs

• GHSA-7r86-cg39-jmmj
• https://nvd.nist.gov/vuln/detail/CVE-2026-27903
• isaacs/minimatch@0bf499a
• GHSA-7r86-cg39-jmmj

FIXED npm-minimatch >= 9.0.0, < 9.0.7 CVE-2026-27904 HIGH

npm-minimatch >= 9.0.0, < 9.0.7 CODE_REPOSITORY/dato-plugin CVE-2026-27904 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/213

Related URLs

• GHSA-23c5-xmqv-rm74
• https://nvd.nist.gov/vuln/detail/CVE-2026-27904
• isaacs/minimatch@11d0df6
• GHSA-23c5-xmqv-rm74

FIXED npm-svgo >= 2.1.0, < 2.8.1 CVE-2026-29074 HIGH

npm-svgo >= 2.1.0, < 2.8.1 CODE_REPOSITORY/dato-plugin CVE-2026-29074 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/221

Related URLs

• GHSA-xpqw-6gx7-v673
• https://nvd.nist.gov/vuln/detail/CVE-2026-29074
• GHSA-xpqw-6gx7-v673

FIXED npm-flatted < 3.4.0 CVE-2026-32141 HIGH

npm-flatted < 3.4.0 CODE_REPOSITORY/dato-plugin CVE-2026-32141 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/224

Related URLs

• GHSA-25h7-pfq9-p65f
• https://nvd.nist.gov/vuln/detail/CVE-2026-32141
• Avoid recursion on parse due possible shenanigans WebReflection/flatted#88
• WebReflection/flatted@7eb65d8
• GHSA-25h7-pfq9-p65f

FIXED npm-picomatch < 2.3.2 CVE-2026-33671 HIGH

npm-picomatch < 2.3.2 CODE_REPOSITORY/dato-plugin CVE-2026-33671 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/233

Related URLs

• GHSA-c2c7-rcm5-vvqj
• micromatch/picomatch@5eceecd
• https://nvd.nist.gov/vuln/detail/CVE-2026-33671
• GHSA-c2c7-rcm5-vvqj

FIXED npm-picomatch < 2.3.2 CVE-2026-33672 MEDIUM

npm-picomatch < 2.3.2 CODE_REPOSITORY/dato-plugin CVE-2026-33672 MEDIUM remediate by: 2026-11-02T14:38:13.746Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/231

Related URLs

• GHSA-3v7f-55p6-f55p
• micromatch/picomatch@4516eb5
• https://nvd.nist.gov/vuln/detail/CVE-2026-33672
• GHSA-3v7f-55p6-f55p

FIXED npm-node-forge < 1.4.0 CVE-2026-33891 HIGH

npm-node-forge < 1.4.0 CODE_REPOSITORY/dato-plugin CVE-2026-33891 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/237

Related URLs

• GHSA-5m6q-g25r-mvwx
• digitalbazaar/forge@9bb8d67
• https://nvd.nist.gov/vuln/detail/CVE-2026-33891
• GHSA-5m6q-g25r-mvwx

FIXED npm-node-forge < 1.4.0 CVE-2026-33894 HIGH

npm-node-forge < 1.4.0 CODE_REPOSITORY/dato-plugin CVE-2026-33894 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/239

Related URLs

• GHSA-cfm4-qjh2-4765
• GHSA-ppp5-5v6c-4jwp
• https://datatracker.ietf.org/doc/html/rfc2313#section-8
• https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE
• https://www.rfc-editor.org/rfc/rfc8017.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-33894
• GHSA-ppp5-5v6c-4jwp

FIXED npm-node-forge < 1.4.0 CVE-2026-33895 HIGH

npm-node-forge < 1.4.0 CODE_REPOSITORY/dato-plugin CVE-2026-33895 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/241

Related URLs

• GHSA-q67f-28xg-22rw
• https://nvd.nist.gov/vuln/detail/CVE-2022-35961
• https://nvd.nist.gov/vuln/detail/CVE-2026-25793
• digitalbazaar/forge@bdecf11
• https://datatracker.ietf.org/doc/html/rfc8032#section-8.4
• https://nvd.nist.gov/vuln/detail/CVE-2026-33895
• GHSA-q67f-28xg-22rw

FIXED npm-path-to-regexp < 0.1.13 CVE-2026-4867 HIGH

npm-path-to-regexp < 0.1.13 CODE_REPOSITORY/dato-plugin CVE-2026-4867 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/254

Related URLs

• GHSA-37ch-88jc-xwx2
• https://nvd.nist.gov/vuln/detail/CVE-2026-4867
• https://blakeembrey.com/posts/2024-09-web-redos
• https://cna.openjsf.org/security-advisories.html
• GHSA-9wv6-86v2-598j
• https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13
• GHSA-37ch-88jc-xwx2

FIXED npm-ws >= 7.0.0, < 7.5.11 CVE-2026-48779 HIGH

npm-ws >= 7.0.0, < 7.5.11 CODE_REPOSITORY/dato-plugin CVE-2026-48779 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/317

Related URLs

• GHSA-96hv-2xvq-fx4p
• websockets/ws@86d3e8a
• websockets/ws@b5372ac
• websockets/ws@bca91ad
• websockets/ws@fd36cd8
• https://nvd.nist.gov/vuln/detail/CVE-2026-48779
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json
• https://bugzilla.redhat.com/show_bug.cgi?id=2489661
• https://access.redhat.com/security/cve/CVE-2026-48779
• https://access.redhat.com/errata/RHSA-2026:34342
• https://access.redhat.com/errata/RHSA-2026:33574
• https://access.redhat.com/errata/RHSA-2026:33183
• https://access.redhat.com/errata/RHSA-2026:33173
• https://access.redhat.com/errata/RHSA-2026:33163
• https://access.redhat.com/errata/RHSA-2026:33160
• https://access.redhat.com/errata/RHSA-2026:33155
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:36820
• https://access.redhat.com/errata/RHSA-2026:36754
• https://access.redhat.com/errata/RHSA-2026:37272
• https://access.redhat.com/errata/RHSA-2026:27171
• https://access.redhat.com/errata/RHSA-2026:26638
• GHSA-96hv-2xvq-fx4p

FIXED npm-form-data >= 3.0.0, < 3.0.5 CVE-2026-12143 HIGH

npm-form-data >= 3.0.0, < 3.0.5 CODE_REPOSITORY/dato-plugin CVE-2026-12143 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/320

Related URLs

• GHSA-hmw2-7cc7-3qxx
• https://nvd.nist.gov/vuln/detail/CVE-2026-12143
• form-data/form-data@64190db
• form-data/form-data@be3f3cf
• form-data/form-data@c713349
• https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data
• https://www.npmjs.com/package/form-data
• GHSA-hmw2-7cc7-3qxx

FIXED npm-ws >= 8.0.0, < 8.21.0 CVE-2026-48779 HIGH

npm-ws >= 8.0.0, < 8.21.0 CODE_REPOSITORY/dato-plugin CVE-2026-48779 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/323

Related URLs

• GHSA-96hv-2xvq-fx4p
• websockets/ws@86d3e8a
• websockets/ws@b5372ac
• websockets/ws@bca91ad
• websockets/ws@fd36cd8
• https://nvd.nist.gov/vuln/detail/CVE-2026-48779
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48779.json
• https://bugzilla.redhat.com/show_bug.cgi?id=2489661
• https://access.redhat.com/security/cve/CVE-2026-48779
• https://access.redhat.com/errata/RHSA-2026:34342
• https://access.redhat.com/errata/RHSA-2026:33574
• https://access.redhat.com/errata/RHSA-2026:33183
• https://access.redhat.com/errata/RHSA-2026:33173
• https://access.redhat.com/errata/RHSA-2026:33163
• https://access.redhat.com/errata/RHSA-2026:33160
• https://access.redhat.com/errata/RHSA-2026:33155
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:36820
• https://access.redhat.com/errata/RHSA-2026:36754
• https://access.redhat.com/errata/RHSA-2026:37272
• https://access.redhat.com/errata/RHSA-2026:27171
• https://access.redhat.com/errata/RHSA-2026:26638
• GHSA-96hv-2xvq-fx4p

FIXED npm-shell-quote <= 1.8.4 CVE-2026-13311 HIGH

npm-shell-quote <= 1.8.4 CODE_REPOSITORY/dato-plugin CVE-2026-13311 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/348

Related URLs

• GHSA-395f-4hp3-45gv
• https://nvd.nist.gov/vuln/detail/CVE-2026-13311
• ljharb/shell-quote@7ff5488
• https://github.com/ljharb/shell-quote/releases/tag/v1.9.0
• https://www.npmjs.com/package/shell-quote
• GHSA-395f-4hp3-45gv

FIXED npm-js-yaml >= 4.0.0, < 4.3.0 CVE-2026-59869 HIGH

npm-js-yaml >= 4.0.0, < 4.3.0 CODE_REPOSITORY/dato-plugin CVE-2026-59869 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/356

Related URLs

• GHSA-52cp-r559-cp3m
• https://nvd.nist.gov/vuln/detail/CVE-2026-59869
• nodeca/js-yaml@24f13e7
• nodeca/js-yaml@59423c6
• https://github.com/nodeca/js-yaml/releases/tag/3.15.0
• https://github.com/nodeca/js-yaml/releases/tag/4.3.0
• GHSA-52cp-r559-cp3m

FIXED npm-js-yaml >= 3.0.0, < 3.15.0 CVE-2026-59869 HIGH

npm-js-yaml >= 3.0.0, < 3.15.0 CODE_REPOSITORY/dato-plugin CVE-2026-59869 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/358

Related URLs

• GHSA-52cp-r559-cp3m
• https://nvd.nist.gov/vuln/detail/CVE-2026-59869
• nodeca/js-yaml@24f13e7
• nodeca/js-yaml@59423c6
• https://github.com/nodeca/js-yaml/releases/tag/3.15.0
• https://github.com/nodeca/js-yaml/releases/tag/4.3.0
• GHSA-52cp-r559-cp3m

FIXED npm-postcss <= 8.5.11 CVE-2026-45623 HIGH

npm-postcss <= 8.5.11 CODE_REPOSITORY/dato-plugin CVE-2026-45623 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/376

Related URLs

• GHSA-6g55-p6wh-862q
• postcss/postcss@aaec7b7
• postcss/postcss@c64b748
• https://github.com/postcss/postcss/releases/tag/8.5.12
• GHSA-6g55-p6wh-862q

FIXED npm-postcss <= 8.5.17 CVE-2026-73646 HIGH

npm-postcss <= 8.5.17 CODE_REPOSITORY/dato-plugin CVE-2026-73646 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/379

Related URLs

• GHSA-r28c-9q8g-f849
• postcss/postcss@95663d3
• https://github.com/postcss/postcss/releases/tag/8.5.18
• GHSA-r28c-9q8g-f849

FIXED npm-brace-expansion >= 2.0.0, < 2.1.3 CVE-2026-14257 HIGH

npm-brace-expansion >= 2.0.0, < 2.1.3 CODE_REPOSITORY/dato-plugin CVE-2026-14257 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/384

Related URLs

• GHSA-mh99-v99m-4gvg
• https://nvd.nist.gov/vuln/detail/CVE-2026-14257
• juliangruber/brace-expansion@a1bd339
• https://github.com/juliangruber/brace-expansion
• https://www.npmjs.com/package/brace-expansion
• fix: backport GHSA-mh99-v99m-4gvg juliangruber/brace-expansion#129
• fix: backport GHSA-mh99-v99m-4gvg juliangruber/brace-expansion#130
• fix: backport GHSA-mh99-v99m-4gvg to v3 juliangruber/brace-expansion#136
• juliangruber/brace-expansion@139d015
• juliangruber/brace-expansion@cb4b9e4
• juliangruber/brace-expansion@d13ff45
• GHSA-mh99-v99m-4gvg

FIXED npm-brace-expansion >= 2.0.0, < 2.1.4 CVE-2026-69152 HIGH

npm-brace-expansion >= 2.0.0, < 2.1.4 CODE_REPOSITORY/dato-plugin CVE-2026-69152 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/386

Related URLs

• GHSA-rgw5-rvv9-x895
• juliangruber/brace-expansion@139d015
• juliangruber/brace-expansion@1e30c93
• juliangruber/brace-expansion@688a99e
• juliangruber/brace-expansion@cb4b9e4
• https://nvd.nist.gov/vuln/detail/CVE-2026-69152
• GHSA-rgw5-rvv9-x895

FIXED npm-brace-expansion < 1.1.17 CVE-2026-14257 HIGH

npm-brace-expansion < 1.1.17 CODE_REPOSITORY/dato-plugin CVE-2026-14257 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/390

Related URLs

• GHSA-mh99-v99m-4gvg
• https://nvd.nist.gov/vuln/detail/CVE-2026-14257
• juliangruber/brace-expansion@a1bd339
• https://github.com/juliangruber/brace-expansion
• https://www.npmjs.com/package/brace-expansion
• fix: backport GHSA-mh99-v99m-4gvg juliangruber/brace-expansion#129
• fix: backport GHSA-mh99-v99m-4gvg juliangruber/brace-expansion#130
• fix: backport GHSA-mh99-v99m-4gvg to v3 juliangruber/brace-expansion#136
• juliangruber/brace-expansion@139d015
• juliangruber/brace-expansion@cb4b9e4
• juliangruber/brace-expansion@d13ff45
• GHSA-mh99-v99m-4gvg

FIXED npm-js-yaml >= 3.0.0, < 3.15.1 GHSA-5p4m-2wfm-xmqj HIGH

npm-js-yaml >= 3.0.0, < 3.15.1 CODE_REPOSITORY/dato-plugin GHSA-5p4m-2wfm-xmqj HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/393

Related URLs

• GHSA-5p4m-2wfm-xmqj
• GHSA-5p4m-2wfm-xmqj

FIXED npm-js-yaml >= 4.0.0, < 4.3.1 GHSA-5p4m-2wfm-xmqj HIGH

npm-js-yaml >= 4.0.0, < 4.3.1 CODE_REPOSITORY/dato-plugin GHSA-5p4m-2wfm-xmqj HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/397

Related URLs

• GHSA-5p4m-2wfm-xmqj
• GHSA-5p4m-2wfm-xmqj

FIXED npm-brace-expansion < 1.1.18 CVE-2026-69152 HIGH

npm-brace-expansion < 1.1.18 CODE_REPOSITORY/dato-plugin CVE-2026-69152 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/407

Related URLs

• GHSA-rgw5-rvv9-x895
• juliangruber/brace-expansion@139d015
• juliangruber/brace-expansion@1e30c93
• juliangruber/brace-expansion@688a99e
• juliangruber/brace-expansion@cb4b9e4
• https://nvd.nist.gov/vuln/detail/CVE-2026-69152
• GHSA-rgw5-rvv9-x895

FIXED npm-browserslist <= 4.28.6 CVE-2026-73088 HIGH

npm-browserslist <= 4.28.6 CODE_REPOSITORY/dato-plugin CVE-2026-73088 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/420

Related URLs

• GHSA-73wf-gq98-2v4g
• https://nvd.nist.gov/vuln/detail/CVE-2026-73088
• browserslist/browserslist@f9914ad
• https://github.com/browserslist/browserslist/releases/tag/4.28.7
• GHSA-73wf-gq98-2v4g

FIXED npm-browserslist <= 4.28.6 CVE-2026-73089 HIGH

npm-browserslist <= 4.28.6 CODE_REPOSITORY/dato-plugin CVE-2026-73089 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/421

Related URLs

• GHSA-c83g-rgw3-j3cx
• https://nvd.nist.gov/vuln/detail/CVE-2026-73089
• browserslist/browserslist@f2931a3
• https://github.com/browserslist/browserslist/releases/tag/4.28.7
• GHSA-c83g-rgw3-j3cx

FIXED npm-node-forge <= 1.3.3 CVE-2026-33896 HIGH

npm-node-forge <= 1.3.3 CODE_REPOSITORY/dato-plugin CVE-2026-33896 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/243

Related URLs

• GHSA-2328-f5f3-gj25
• digitalbazaar/forge@2e49283
• https://nvd.nist.gov/vuln/detail/CVE-2026-33896
• GHSA-2328-f5f3-gj25

FIXED npm-nanoid < 3.3.12 CVE-2026-73086 HIGH

npm-nanoid < 3.3.12 CODE_REPOSITORY/dato-plugin CVE-2026-73086 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/419

Related URLs

• GHSA-xwg4-73v4-xw9w
• https://nvd.nist.gov/vuln/detail/CVE-2026-73086
• ai/nanoid@7087969
• ai/nanoid@821dfed
• ai/nanoid@b0036ed
• https://github.com/ai/nanoid/releases/tag/3.3.12
• https://github.com/ai/nanoid/releases/tag/5.1.11
• GHSA-xwg4-73v4-xw9w

FIXED npm-rollup < 2.79.2 CVE-2024-47068 HIGH

npm-rollup < 2.79.2 CODE_REPOSITORY/dato-plugin CVE-2024-47068 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/90

Related URLs

• GHSA-gcx4-mw62-g8wm
• https://nvd.nist.gov/vuln/detail/CVE-2024-47068
• rollup/rollup@2ef77c0
• rollup/rollup@e2552c9
• https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L157-L162
• https://github.com/rollup/rollup/blob/b86ffd776cfa906573d36c3f019316d02445d9ef/src/ast/nodes/MetaProperty.ts#L180-L185
• GHSA-gcx4-mw62-g8wm

FIXED npm-underscore <= 1.13.7 CVE-2026-27601 HIGH

npm-underscore <= 1.13.7 CODE_REPOSITORY/dato-plugin CVE-2026-27601 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/217

Related URLs

• GHSA-qpx9-hpmf-5gmw
• Security leak in _.flatten and _.isEqual, please update (1.13.8 tag will be pushed later) jashkenas/underscore#3011
• https://underscorejs.org/#1.13.8
• https://underscorejs.org/#flatten
• https://underscorejs.org/#isEqual
• https://nvd.nist.gov/vuln/detail/CVE-2026-27601
• jashkenas/underscore@411e222
• jashkenas/underscore@a6e23ae
• GHSA-qpx9-hpmf-5gmw

FIXED npm-nanoid < 3.3.16 CVE-2026-67214 HIGH

npm-nanoid < 3.3.16 CODE_REPOSITORY/dato-plugin CVE-2026-67214 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/395

Related URLs

• https://nvd.nist.gov/vuln/detail/CVE-2026-67214
• ai/nanoid@6ccc67b
• https://github.com/ai/nanoid/releases/tag/5.1.16
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
• fix(non-secure): clamp a negative size instead of looping forever ai/nanoid#600
• fix(non-secure): clamp negative size to prevent infinite loop ai/nanoid#601
• ai/nanoid@e835c9b
• GHSA-28wg-ghj8-5hjv

FIXED npm-nanoid < 3.3.18 CVE-2026-67213 HIGH

npm-nanoid < 3.3.18 CODE_REPOSITORY/dato-plugin CVE-2026-67213 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/403

Related URLs

• https://nvd.nist.gov/vuln/detail/CVE-2026-67213
• ai/nanoid@cb3626d
• https://github.com/ai/nanoid/releases/tag/5.1.6
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom
• ai/nanoid@f9d13f1
• https://github.com/ai/nanoid/releases/tag/3.3.17
• ai/nanoid@e10f8d4
• https://github.com/ai/nanoid/releases/tag/3.3.18
• GHSA-2v37-7h3g-55p8

FIXED npm-brace-expansion >= 2.0.0, < 2.1.2 CVE-2026-13149 HIGH

npm-brace-expansion >= 2.0.0, < 2.1.2 CODE_REPOSITORY/dato-plugin CVE-2026-13149 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/347

Related URLs

• GHSA-3jxr-9vmj-r5cp
• https://nvd.nist.gov/vuln/detail/CVE-2026-13149
• fix: v1 backport for CVE-2026-13149 juliangruber/brace-expansion#122
• fix: v2 backport for CVE-2026-13149 juliangruber/brace-expansion#123
• juliangruber/brace-expansion@835d6be
• juliangruber/brace-expansion@c7e33ec
• juliangruber/brace-expansion@d74e630
• https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16
• https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2
• https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7
• https://www.npmjs.com/package/brace-expansion
• GHSA-3jxr-9vmj-r5cp

FIXED npm-brace-expansion < 1.1.16 CVE-2026-13149 HIGH

npm-brace-expansion < 1.1.16 CODE_REPOSITORY/dato-plugin CVE-2026-13149 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/364

Related URLs

• GHSA-3jxr-9vmj-r5cp
• https://nvd.nist.gov/vuln/detail/CVE-2026-13149
• fix: v1 backport for CVE-2026-13149 juliangruber/brace-expansion#122
• fix: v2 backport for CVE-2026-13149 juliangruber/brace-expansion#123
• juliangruber/brace-expansion@835d6be
• juliangruber/brace-expansion@c7e33ec
• juliangruber/brace-expansion@d74e630
• https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16
• https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2
• https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7
• https://www.npmjs.com/package/brace-expansion
• GHSA-3jxr-9vmj-r5cp

FIXED npm-minimatch >= 5.0.0, < 5.1.7 CVE-2026-26996 HIGH

npm-minimatch >= 5.0.0, < 5.1.7 CODE_REPOSITORY/dato-plugin CVE-2026-26996 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/193

Related URLs

• GHSA-3ppc-4f35-3m26
• isaacs/minimatch@2e111f3
• https://nvd.nist.gov/vuln/detail/CVE-2026-26996
• GHSA-3ppc-4f35-3m26

FIXED npm-minimatch >= 9.0.0, < 9.0.6 CVE-2026-26996 HIGH

npm-minimatch >= 9.0.0, < 9.0.6 CODE_REPOSITORY/dato-plugin CVE-2026-26996 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/197

Related URLs

• GHSA-3ppc-4f35-3m26
• isaacs/minimatch@2e111f3
• https://nvd.nist.gov/vuln/detail/CVE-2026-26996
• GHSA-3ppc-4f35-3m26

FIXED npm-rollup < 2.80.0 CVE-2026-27606 HIGH

npm-rollup < 2.80.0 CODE_REPOSITORY/dato-plugin CVE-2026-27606 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/198

Related URLs

• GHSA-mw96-cpmx-2vgc
• https://nvd.nist.gov/vuln/detail/CVE-2026-27606
• rollup/rollup@c60770d
• rollup/rollup@c8cf1f9
• rollup/rollup@d6dee5e
• https://github.com/rollup/rollup/releases/tag/v2.80.0
• https://github.com/rollup/rollup/releases/tag/v3.30.0
• https://github.com/rollup/rollup/releases/tag/v4.59.0
• GHSA-mw96-cpmx-2vgc

FIXED npm-flatted <= 3.4.1 CVE-2026-33228 HIGH

npm-flatted <= 3.4.1 CODE_REPOSITORY/dato-plugin CVE-2026-33228 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/226

Related URLs

• GHSA-rf6f-7fwh-wjgh
• https://nvd.nist.gov/vuln/detail/CVE-2026-33228
• WebReflection/flatted@885ddcc
• https://github.com/WebReflection/flatted/releases/tag/v3.4.2
• GHSA-rf6f-7fwh-wjgh

FIXED npm-launch-editor <= 2.8.2 CVE-2024-52011 HIGH

npm-launch-editor <= 2.8.2 CODE_REPOSITORY/dato-plugin CVE-2024-52011 HIGH remediate by: 2026-10-03T14:38:12.943Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/307

Related URLs

• GHSA-c27g-q93r-2cwf
• GHSA-c27g-q93r-2cwf
• https://nvd.nist.gov/vuln/detail/CVE-2024-52011
• vitejs/launch-editor@971291e
• GHSA-c27g-q93r-2cwf

FIXED npm-js-yaml >= 4.0.0, < 4.3.2 CVE-2026-84375 HIGH

npm-js-yaml >= 4.0.0, < 4.3.2 CODE_REPOSITORY/dato-plugin CVE-2026-84375 HIGH remediate by: 2026-10-09T19:45:28.746Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/424

Related URLs

• GHSA-2883-xcg3-v3hh
• https://nvd.nist.gov/vuln/detail/CVE-2026-84375
• fix: count empty merge sources against maxTotalMergeKeys nodeca/js-yaml#797
• nodeca/js-yaml@3485bc0
• nodeca/js-yaml@6a8e05f
• nodeca/js-yaml@d90b661
• https://github.com/nodeca/js-yaml/releases/tag/3.15.2
• https://github.com/nodeca/js-yaml/releases/tag/4.3.2
• GHSA-2883-xcg3-v3hh

FIXED npm-js-yaml >= 3.0.0, < 3.15.2 CVE-2026-84375 HIGH

npm-js-yaml >= 3.0.0, < 3.15.2 CODE_REPOSITORY/dato-plugin CVE-2026-84375 HIGH remediate by: 2026-10-10T03:49:03.628Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/425

Related URLs

• GHSA-2883-xcg3-v3hh
• https://nvd.nist.gov/vuln/detail/CVE-2026-84375
• fix: count empty merge sources against maxTotalMergeKeys nodeca/js-yaml#797
• nodeca/js-yaml@3485bc0
• nodeca/js-yaml@6a8e05f
• nodeca/js-yaml@d90b661
• https://github.com/nodeca/js-yaml/releases/tag/3.15.2
• https://github.com/nodeca/js-yaml/releases/tag/4.3.2
• GHSA-2883-xcg3-v3hh

FIXED npm-svgo >= 1.0.0, < 2.8.4 CVE-2026-84370 HIGH

npm-svgo >= 1.0.0, < 2.8.4 CODE_REPOSITORY/dato-plugin CVE-2026-84370 HIGH remediate by: 2026-10-11T03:51:02.018Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/426

Related URLs

• GHSA-w27v-7q3p-w38r
• https://nvd.nist.gov/vuln/detail/CVE-2026-84370
• fix(removeScripts): handle anchor URL bypasses svg/svgo#2268
• fix(removeScriptElement): backport security hardening to v3 svg/svgo#2269
• fix(removeScriptElement): backport security hardening to v2 svg/svgo#2272
• svg/svgo@0557385
• svg/svgo@3db3ef3
• svg/svgo@994a9f0
• https://github.com/svg/svgo/releases/tag/v2.8.4
• https://github.com/svg/svgo/releases/tag/v3.3.5
• https://github.com/svg/svgo/releases/tag/v4.1.0
• GHSA-w27v-7q3p-w38r

FIXED npm-svgo >= 1.0.0, < 2.8.4 CVE-2026-84369 MEDIUM

npm-svgo >= 1.0.0, < 2.8.4 CODE_REPOSITORY/dato-plugin CVE-2026-84369 MEDIUM remediate by: 2026-11-10T03:51:02.681Z

• https://github.com/commercelayer/dato-plugin/security/dependabot/427

Related URLs

• GHSA-4vpr-x523-8j87
• https://nvd.nist.gov/vuln/detail/CVE-2026-84369
• fix(removeScripts): sanitize foreignObject content svg/svgo#2264
• fix(removeScriptElement): backport security hardening to v3 svg/svgo#2269
• fix(removeScriptElement): backport security hardening to v2 svg/svgo#2272
• svg/svgo@0557385
• svg/svgo@994a9f0
• svg/svgo@fd51e47
• https://github.com/svg/svgo/releases/tag/v2.8.4
• https://github.com/svg/svgo/releases/tag/v3.3.5
• https://github.com/svg/svgo/releases/tag/v4.1.0
• GHSA-4vpr-x523-8j87

[commercelayer-ci]

CODE_REPOSITORY/dato-plugin

All the listed vulnerabilities are still detected.
Please resolve within 7 days.

[commercelayer-ci]

CODE_REPOSITORY/dato-plugin

All the listed vulnerabilities are still detected.
Please resolve within 6 days.

[commercelayer-ci]

CODE_REPOSITORY/dato-plugin

All the listed vulnerabilities are still detected.
Please resolve within 5 days.

[commercelayer-ci]

No vulnerability is detected anymore.