This might be a false positive, but pnpm-lock.yaml around line 1 looked worth a second pair of eyes.
The uuid library versions prior to 14.0.0 do not validate buffer size or offset when external output buffers are supplied to v3, v5, and v6 UUID generation functions. This can cause out‑of‑range writes (partial buffer overflow) leading to memory corruption and possible remote code execution. Since the installed version (8.3.2) is well below the fixed versions, the vulnerability is present and should be addressed.
Something like this might fix it:
Upgrade the uuid package to a fixed version (≥14.0.0, e.g., 14.0.0) in your package manager manifest (package.json) and run `pnpm update uuid` to regenerate pnpm-lock.yaml.
For reference: rule CVE-2026-41907. Rated high.
I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
This might be a false positive, but
pnpm-lock.yamlaround line 1 looked worth a second pair of eyes.The uuid library versions prior to 14.0.0 do not validate buffer size or offset when external output buffers are supplied to v3, v5, and v6 UUID generation functions. This can cause out‑of‑range writes (partial buffer overflow) leading to memory corruption and possible remote code execution. Since the installed version (8.3.2) is well below the fixed versions, the vulnerability is present and should be addressed.
Something like this might fix it:
For reference: rule
CVE-2026-41907. Rated high.I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.