Spotted what might be an issue in vue/yarn.lock around line 4166.
The project includes form-data version 4.0.4, which is vulnerable to CVE‑2026‑12143. The library concatenates unescaped field names and filenames into the Content‑Disposition header, allowing CR/LF injection. An attacker controlling a field name or filename can inject arbitrary headers or multipart sections, potentially altering backend request data (e.g., setting is_admin=true). This is a high‑severity CWE‑93 vulnerability. Upgrading to a patched release (≥4.0.6) eliminates the flaw by properly escaping CR, LF, and double‑quote characters.
Something like this might fix it:
*** Begin Patch
*** Update File: package.json
@@
- "form-data": "4.0.4",
+ "form-data": "4.0.6",
*** End Patch
*** Begin Patch
*** Update File: yarn.lock
@@
-"form-data@^4.0.4":
- version "4.0.4"
- resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.4.tgz#..."
- integrity sha512-...
+"form-data@^4.0.6":
+ version "4.0.6"
+ resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.6.tgz#..."
+ integrity sha512-...
*** End Patch
For reference: rule CVE-2026-12143. Rated high.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
vue/yarn.lockaround line 4166.The project includes form-data version 4.0.4, which is vulnerable to CVE‑2026‑12143. The library concatenates unescaped field names and filenames into the Content‑Disposition header, allowing CR/LF injection. An attacker controlling a field name or filename can inject arbitrary headers or multipart sections, potentially altering backend request data (e.g., setting is_admin=true). This is a high‑severity CWE‑93 vulnerability. Upgrading to a patched release (≥4.0.6) eliminates the flaw by properly escaping CR, LF, and double‑quote characters.
Something like this might fix it:
For reference: rule
CVE-2026-12143. Rated high.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.