Frontend dependencies: npm audit reports 6 critical (TanStack Start XSS) and 8 high

Found on 28 Oct 2026, during the #60 bundle build. Since #131, npm ci runs clean, and it reported:

17 vulnerabilities (3 moderate, 8 high, 6 critical)

Reproduced with npm audit --json on a clean install of main (csv-table-hub-main), Node 22.23.4 and npm 10.9.9.

Findings

Severity	Package	Direct?	What	Fix
critical	`@tanstack/react-start` (plus `-rsc`, `-server`, `start-plugin-core`, `start-server-core`)	yes	Unauthenticated reflected XSS in TanStack Start. It runs in the shipped frontend server (`.output/server`)	non-breaking
critical	`shell-quote`	no	Command injection via a line terminator in `quote()`	non-breaking
high	`vite`, `launch-editor`	`vite` yes	`escapeCmdArgs()` omits `%` escaping on Windows. Dev server only	non-breaking
high	`zod`	yes	Memory exhaustion when validating oversized constrained input	major: zod 4
high	`seroval`	no	Memory exhaustion via unchecked TypedArray length	non-breaking
high	`undici`	no	Denial of service via an unhandled error	non-breaking
high	`brace-expansion`, `js-yaml`, `source-map-js`	no	CPU or event-loop denial of service. Build tooling	non-breaking
moderate	`vitest`, `@vitest/ui`, `@vitest/mocker`	`vitest` yes	Path traversal / arbitrary file read. Tests only	non-breaking

Why it matters

The TanStack Start XSS is in code that ships in the offline bundle, which serves the frontend in production. Most of the rest is dev or build tooling.

Proposed (to be confirmed by the product owner)

Apply the non-breaking fixes (npm audit fix).
- Check: npm ci is clean, vitest passes, and the offline build works.
- Then rebuild the 2026-11-15: ship air-gapped install procedure or keep interim wording #60 bundle, so the clean-VM evidence covers patched code.
Move zod 3 to 4 separately, because it's a major version. It needs a check of every schema in src/lib/csv.functions.ts.
Add npm audit --audit-level=high to CI, so new findings surface.

Done when

npm audit reports no critical or high findings, or the remaining ones are accepted by the product owner with a reason.
vitest and the build pass.

Generated by Claude Code

Merge pull request #134 from amar-python/fix/132-npm-audit

Reopened. PR #134 (merged as 2f10940) fixed every finding except one: npm audit still reports 1 high, zod below 4.6.6. The fix needs a major upgrade (zod 3 to 4).

This issue stays open until that is done and a clean npm audit run is attached.

Generated by Claude Code

Merge pull request #135 from amar-python/fix/132-zod-4

Evidence: clean npm audit on main. PR #135 merged at the product owner's direction on 28 Oct. I then checked main at b21737b (#135, #136 and #137 merged) with npm 10.9.9 and Node 22.23.4, from a fresh clone of node_modules:

npm ci     added 503 packages, and audited 504 packages
npm audit  found 0 vulnerabilities
tsc        0 errors
vitest     13 files, 141 tests passed

The audit went from 17 vulnerabilities (6 critical, 8 high, 3 moderate) to 0 over PRs #134 and #135. Closing.

Generated by Claude Code

Navigation Menu

Repository navigation

Frontend dependencies: npm audit reports 6 critical (TanStack Start XSS) and 8 high #132

Findings

Why it matters

Proposed (to be confirmed by the product owner)

Done when

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Frontend dependencies: npm audit reports 6 critical (TanStack Start XSS) and 8 high #132

Description

Findings

Why it matters

Proposed (to be confirmed by the product owner)

Done when

Activity

amar-python commented on Oct 27, 2026

amar-python commented on Oct 28, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions