TavernKeeper Scan Report

Chechelpo/Simulith

Commit 7b8e3aa Reviewed

2 material concerns identified.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 high 2 material 1 low

What this review found

Dependency advisory GHSA-fxqj-rqcc-2cmp applies

Material concern · medium confidence

A third-party software component used by the application has a known security flaw with a medium severity rating. This could potentially be exploited by attackers depending on how the component is used.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-fxqj-rqcc-2cmp to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known medium-severity advisory (GHSA-fxqj-rqcc-2cmp) against a declared dependency in the production lockfile. While the specific package details were redacted in the scanner output, the presence of a known vulnerable dependency in a production frontend project introduces risk depending on the package's role and exploitability.

Impact: medium · Exploitability: plausible

Developer action: Run a dependency audit tool such as npm audit or osv-scanner to identify the specific package associated with GHSA-fxqj-rqcc-2cmp and update it to a patched version.

Scanner
osv-scanner 2.4.0
Rule
GHSA-fxqj-rqcc-2cmp
File role
production
Source
frontend/package-lock.json

Dependency advisory GHSA-r28c-9q8g-f849 applies

Material concern · medium confidence

A third-party software component used by the application has a known security flaw with a high severity rating. This is a significant risk that should be addressed promptly to prevent potential attacks.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-r28c-9q8g-f849 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known high-severity advisory (GHSA-r28c-9q8g-f849) against a declared dependency in the production lockfile. High-severity vulnerabilities in frontend dependencies can lead to issues such as cross-site scripting (XSS) or prototype pollution if the vulnerable code path is reachable by user input.

Impact: high · Exploitability: plausible

Developer action: Run a dependency audit tool such as npm audit or osv-scanner to identify the specific package associated with GHSA-r28c-9q8g-f849 and update it to a patched version immediately.

Scanner
osv-scanner 2.4.0
Rule
GHSA-r28c-9q8g-f849
File role
production
Source
frontend/package-lock.json

Minor cautions

Dependency advisory GHSA-c2j3-45gr-mqc4 applies

Minor caution · medium confidence

A third-party software component used by the application has a known security flaw with a low severity rating. The risk is minimal but it is good practice to update the component.

Technical evidence

Scanner reason: OSV-Scanner matched advisory GHSA-c2j3-45gr-mqc4 to a dependency declared by this repository.

Contextual assessment: OSV-Scanner matched a known low-severity advisory (GHSA-c2j3-45gr-mqc4) against a declared dependency in the production lockfile. Low-severity advisories typically represent edge-case vulnerabilities or issues with minimal practical impact, but should still be resolved during routine maintenance.

Impact: low · Exploitability: unlikely

Developer action: Run a dependency audit tool to identify the specific package associated with GHSA-c2j3-45gr-mqc4 and update it to a patched version when convenient.

Scanner
osv-scanner 2.4.0
Rule
GHSA-c2j3-45gr-mqc4
File role
production
Source
frontend/package-lock.json
Expected scanner matches (0)

None.

Coverage and limitations

Tools

Limitations

Technical scan identity