added vulnerablility dep

[arsalanendor]

No description provided.

[endor-labs-pro]

Warning

Endor Labs detected 1 policy violations associated with this pull request.

Please review the findings that caused the policy violations.

📋 Policy: Block PR vulnerabilities (4 findings)

📥 Package npm://@og-pro/custom-form-service@1.0.0

⤵️ Dependency: npm://jsonwebtoken@8.5.1

🚩 GHSA-hjrf-2m68-5959: jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

Details

• Severity: Medium
• Tags: Direct Normal Potentially Reachable Function Potentially Reachable Dependency Fix Available Blocker
• Categories: Security Vulnerability
• Summary: jsonwebtoken@8.5.1 has a medium severity vulnerability identified by GHSA-hjrf-2m68-5959: jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC. This vulnerability was fixed in version 9.0.0.
  jsonwebtoken@8.5.1 is a direct dependency of @og-pro/custom-form-service@1.0.0.
• Remediation: Update @og-pro/custom-form-service@1.0.0 to use jsonwebtoken version 9.0.0 (current: 8.5.1, latest: 9.0.2).

🚩 GHSA-8cf7-32gw-wr33: jsonwebtoken unrestricted key type could lead to legacy keys usage

Details

• Severity: High
• Tags: Direct Normal Potentially Reachable Function Potentially Reachable Dependency Fix Available Blocker
• Categories: Security Vulnerability
• Summary: jsonwebtoken@8.5.1 has a high severity vulnerability identified by GHSA-8cf7-32gw-wr33: jsonwebtoken unrestricted key type could lead to legacy keys usage . This vulnerability was fixed in version 9.0.0.
  jsonwebtoken@8.5.1 is a direct dependency of @og-pro/custom-form-service@1.0.0.
• Remediation: Update @og-pro/custom-form-service@1.0.0 to use jsonwebtoken version 9.0.0 (current: 8.5.1, latest: 9.0.2).

🚩 GHSA-qwph-4952-7xr6: jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Details

• Severity: High
• Tags: Direct Normal Potentially Reachable Function Potentially Reachable Dependency Fix Available Blocker
• Categories: Security Vulnerability
• Summary: jsonwebtoken@8.5.1 has a high severity vulnerability identified by GHSA-qwph-4952-7xr6: jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify(). This vulnerability was fixed in version 9.0.0.
  jsonwebtoken@8.5.1 is a direct dependency of @og-pro/custom-form-service@1.0.0.
• Remediation: Update @og-pro/custom-form-service@1.0.0 to use jsonwebtoken version 9.0.0 (current: 8.5.1, latest: 9.0.2).

⤵️ Dependency: npm://validator@10.11.0

🚩 GHSA-qgmg-gppg-76g5: Inefficient Regular Expression Complexity in validator.js

Details

• Severity: High
• Tags: Transitive Normal Potentially Reachable Function Reachable Dependency Fix Available Blocker
• Categories: Security Vulnerability
• Summary: validator@10.11.0 has a high severity vulnerability identified by GHSA-qgmg-gppg-76g5: Inefficient Regular Expression Complexity in validator.js. This vulnerability was fixed in version 13.7.0.
  2 packages import validator@10.11.0 directly. See the list of all dependency paths for details.
• Remediation: Upgrade validator to version 13.7.0 (current: 10.11.0, latest: 13.15.0).

---

This comment was automatically generated by Endor Labs.
Scanned @ 04-10-2025 20:36:53 UTC

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.