xiaoshu-app/docs/qa/launch-audit-2026-10-13/dependency-summary.json

{
  "source": "npm audit --registry=https://registry.npmjs.org --json",
  "scope": "full dependency tree including build/test tooling; not an exploitability count",
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 8,
      "moderate": 22,
      "high": 49,
      "critical": 6,
      "total": 85
    },
    "dependencies": {
      "prod": 39,
      "dev": 1009,
      "optional": 105,
      "peer": 0,
      "peerOptional": 0,
      "total": 1058
    }
  },
  "direct": [
    {
      "name": "@angular-devkit/build-angular",
      "version": "18.2.21",
      "severity": "high",
      "advisories": []
    },
    {
      "name": "@angular/animations",
      "version": "18.2.14",
      "severity": "moderate",
      "advisories": []
    },
    {
      "name": "@angular/cli",
      "version": "18.2.21",
      "severity": "high",
      "advisories": []
    },
    {
      "name": "@angular/common",
      "version": "18.2.14",
      "severity": "high",
      "advisories": [
        {
          "title": "Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client",
          "url": "https://github.com/advisories/GHSA-58c5-g7wp-6w37"
        },
        {
          "title": "@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)",
          "url": "https://github.com/advisories/GHSA-48r7-hpm6-gfxm"
        },
        {
          "title": "@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning",
          "url": "https://github.com/advisories/GHSA-39pv-4j6c-2g6v"
        },
        {
          "title": "@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)",
          "url": "https://github.com/advisories/GHSA-p3vc-36g9-x9gr"
        },
        {
          "title": "@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache",
          "url": "https://github.com/advisories/GHSA-q6f4-qqrg-jv6x"
        },
        {
          "title": "Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning",
          "url": "https://github.com/advisories/GHSA-jhpw-976m-542j"
        },
        {
          "title": "Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`",
          "url": "https://github.com/advisories/GHSA-p297-fm68-3q8c"
        }
      ]
    },
    {
      "name": "@angular/compiler",
      "version": "18.2.14",
      "severity": "high",
      "advisories": [
        {
          "title": "Angular vulnerable to XSS in i18n attribute bindings",
          "url": "https://github.com/advisories/GHSA-g93w-mfhg-p222"
        },
        {
          "title": "Angular has XSS Vulnerability via Unsanitized SVG Script Attributes",
          "url": "https://github.com/advisories/GHSA-jrmj-c5cx-3cw6"
        },
        {
          "title": "Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes",
          "url": "https://github.com/advisories/GHSA-v4hv-rgfq-gp49"
        },
        {
          "title": "@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)",
          "url": "https://github.com/advisories/GHSA-58w9-8g37-x9v5"
        },
        {
          "title": "Angular: Template and Attribute Namespace Sanitization Bypass (XSS)",
          "url": "https://github.com/advisories/GHSA-f3m7-gqxr-g87x"
        },
        {
          "title": "Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes",
          "url": "https://github.com/advisories/GHSA-jj27-h5hq-8x99"
        },
        {
          "title": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
          "url": "https://github.com/advisories/GHSA-hh8m-fm6v-7cvg"
        }
      ]
    },
    {
      "name": "@angular/compiler-cli",
      "version": "18.2.14",
      "severity": "moderate",
      "advisories": []
    },
    {
      "name": "@angular/core",
      "version": "18.2.14",
      "severity": "high",
      "advisories": [
        {
          "title": "Angular i18n vulnerable to Cross-Site Scripting",
          "url": "https://github.com/advisories/GHSA-prjf-86w9-mfqv"
        },
        {
          "title": "Angular vulnerable to XSS in i18n attribute bindings",
          "url": "https://github.com/advisories/GHSA-g93w-mfhg-p222"
        },
        {
          "title": "Angular has XSS Vulnerability via Unsanitized SVG Script Attributes",
          "url": "https://github.com/advisories/GHSA-jrmj-c5cx-3cw6"
        },
        {
          "title": "Angular: Template and Attribute Namespace Sanitization Bypass (XSS)",
          "url": "https://github.com/advisories/GHSA-f3m7-gqxr-g87x"
        },
        {
          "title": "@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)",
          "url": "https://github.com/advisories/GHSA-692r-grfm-v8x7"
        },
        {
          "title": "Angular Client Hydration DOM Clobbering & Response-Cache Poisoning",
          "url": "https://github.com/advisories/GHSA-rgjc-h3x7-9mwg"
        },
        {
          "title": "Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes",
          "url": "https://github.com/advisories/GHSA-jj27-h5hq-8x99"
        },
        {
          "title": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
          "url": "https://github.com/advisories/GHSA-hh8m-fm6v-7cvg"
        }
      ]
    },
    {
      "name": "@angular/forms",
      "version": "18.2.14",
      "severity": "moderate",
      "advisories": []
    },
    {
      "name": "@angular/platform-browser",
      "version": "18.2.14",
      "severity": "moderate",
      "advisories": []
    },
    {
      "name": "@angular/platform-browser-dynamic",
      "version": "18.2.14",
      "severity": "moderate",
      "advisories": []
    },
    {
      "name": "@angular/router",
      "version": "18.2.14",
      "severity": "high",
      "advisories": [
        {
          "title": "Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters",
          "url": "https://github.com/advisories/GHSA-ff3f-86qr-9cv3"
        }
      ]
    },
    {
      "name": "html2pdf.js",
      "version": "0.10.3",
      "severity": "critical",
      "advisories": [
        {
          "title": "html2pdf.js contains a cross-site scripting vulnerability",
          "url": "https://github.com/advisories/GHSA-w8x4-x68c-m6fc"
        }
      ]
    },
    {
      "name": "jspdf",
      "version": "3.0.4",
      "severity": "critical",
      "advisories": [
        {
          "title": "jsPDF has Local File Inclusion/Path Traversal vulnerability",
          "url": "https://github.com/advisories/GHSA-f8cm-6447-x5h2"
        },
        {
          "title": "jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution",
          "url": "https://github.com/advisories/GHSA-pqxr-3g65-p328"
        },
        {
          "title": "jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder",
          "url": "https://github.com/advisories/GHSA-95fx-jjr5-f39c"
        },
        {
          "title": "jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)",
          "url": "https://github.com/advisories/GHSA-vm32-vv63-w422"
        },
        {
          "title": "jsPDF has Shared State Race Condition in addJS Plugin",
          "url": "https://github.com/advisories/GHSA-cjw8-79x6-5cj4"
        },
        {
          "title": "jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method",
          "url": "https://github.com/advisories/GHSA-9vjf-qc39-jprp"
        },
        {
          "title": "jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions",
          "url": "https://github.com/advisories/GHSA-67pg-wm7f-q7fj"
        },
        {
          "title": "jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and \"AS\" property)",
          "url": "https://github.com/advisories/GHSA-p5xg-68wr-hm3m"
        },
        {
          "title": "jsPDF has a PDF Object Injection via FreeText color",
          "url": "https://github.com/advisories/GHSA-7x6v-j9x4-qf24"
        },
        {
          "title": "jsPDF has HTML Injection in New Window paths",
          "url": "https://github.com/advisories/GHSA-wfv2-pwc8-crg5"
        }
      ]
    },
    {
      "name": "karma",
      "version": "6.4.4",
      "severity": "high",
      "advisories": []
    },
    {
      "name": "karma-jasmine",
      "version": "5.1.0",
      "severity": "high",
      "advisories": []
    },
    {
      "name": "karma-jasmine-html-reporter",
      "version": "2.1.0",
      "severity": "high",
      "advisories": []
    },
    {
      "name": "lucide-angular",
      "version": "0.468.0",
      "severity": "moderate",
      "advisories": []
    },
    {
      "name": "xlsx",
      "version": "0.18.5",
      "severity": "high",
      "advisories": [
        {
          "title": "Prototype Pollution in sheetJS",
          "url": "https://github.com/advisories/GHSA-4r6h-8v6p-xvw6"
        },
        {
          "title": "SheetJS Regular Expression Denial of Service (ReDoS)",
          "url": "https://github.com/advisories/GHSA-5pgg-2g8v-p4x9"
        }
      ]
    }
  ]
}