{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@babel/core": {
      "name": "@babel/core",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1123528,
          "name": "@babel/core",
          "dependency": "@babel/core",
          "title": "@babel/core: Arbitrary File Read via sourceMappingURL Comment",
          "url": "https://github.com/advisories/GHSA-4x5r-pxfx-6jf8",
          "severity": "low",
          "cwe": [
            "CWE-22",
            "CWE-200"
          ],
          "cvss": {
            "score": 3.2,
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N"
          },
          "range": "<=7.29.0"
        }
      ],
      "effects": [],
      "range": "<=7.29.0",
      "nodes": [
        "node_modules/@babel/core"
      ],
      "fixAvailable": true
    },
    "@craco/craco": {
      "name": "@craco/craco",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "react-scripts"
      ],
      "effects": [],
      "range": "<=2.2.3 || >=6.0.0",
      "nodes": [
        "node_modules/@craco/craco"
      ],
      "fixAvailable": {
        "name": "@craco/craco",
        "version": "5.9.0",
        "isSemVerMajor": true
      }
    },
    "@svgr/plugin-svgo": {
      "name": "@svgr/plugin-svgo",
      "severity": "high",
      "isDirect": false,
      "via": [
        "svgo"
      ],
      "effects": [
        "@svgr/webpack"
      ],
      "range": "<=5.5.0",
      "nodes": [
        "node_modules/@svgr/plugin-svgo"
      ],
      "fixAvailable": {
        "name": "react-scripts",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "@svgr/webpack": {
      "name": "@svgr/webpack",
      "severity": "high",
      "isDirect": false,
      "via": [
        "@svgr/plugin-svgo"
      ],
      "effects": [
        "react-scripts"
      ],
      "range": "4.0.0 - 5.5.0",
      "nodes": [
        "node_modules/@svgr/webpack"
      ],
      "fixAvailable": {
        "name": "react-scripts",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "axios": {
      "name": "axios",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1123882,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Excessive recursion in formDataToJSON can cause denial of service",
          "url": "https://github.com/advisories/GHSA-42h9-826w-cgv3",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-674"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.0.0 <1.18.0"
        },
        {
          "source": 1123884,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Prototype pollution auth subfields can inject Basic auth",
          "url": "https://github.com/advisories/GHSA-xj6q-8x83-jv6g",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.2 <1.18.0"
        },
        {
          "source": 1123885,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service",
          "url": "https://github.com/advisories/GHSA-pmv8-rq9r-6j72",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.0.0 <1.18.0"
        },
        {
          "source": 1123957,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`",
          "url": "https://github.com/advisories/GHSA-jqh4-m9w3-8hp9",
          "severity": "moderate",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.7.0 <1.18.0"
        },
        {
          "source": 1123959,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Prototype pollution gadgets can alter axios request construction",
          "url": "https://github.com/advisories/GHSA-mmx7-hfxf-jppx",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.0.0 <1.18.0"
        },
        {
          "source": 1123961,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios",
          "url": "https://github.com/advisories/GHSA-f4gw-2p7v-4548",
          "severity": "moderate",
          "cwe": [
            "CWE-183",
            "CWE-918"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.0 <1.18.0"
        },
        {
          "source": 1123967,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning",
          "url": "https://github.com/advisories/GHSA-gcfj-64vw-6mp9",
          "severity": "high",
          "cwe": [
            "CWE-200",
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.2 <1.18.0"
        },
        {
          "source": 1123969,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios form serializer maxDepth bypass via {} metatoken",
          "url": "https://github.com/advisories/GHSA-hcpx-6fm6-wx23",
          "severity": "moderate",
          "cwe": [
            "CWE-674"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.15.1 <1.18.0"
        },
        {
          "source": 1123971,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: Nested axios option objects can consume polluted prototype values",
          "url": "https://github.com/advisories/GHSA-7q8q-rj6j-mhjq",
          "severity": "moderate",
          "cwe": [
            "CWE-1321"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.0.0 <1.18.0"
        },
        {
          "source": 1123973,
          "name": "axios",
          "dependency": "axios",
          "title": "Axios: HTTP/2 streamed uploads bypass `maxBodyLength`",
          "url": "https://github.com/advisories/GHSA-mwf2-3pr3-8698",
          "severity": "moderate",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=1.13.0 <1.18.0"
        }
      ],
      "effects": [],
      "range": "1.0.0 - 1.17.0",
      "nodes": [
        "node_modules/axios"
      ],
      "fixAvailable": true
    },
    "body-parser": {
      "name": "body-parser",
      "severity": "low",
      "isDirect": false,
      "via": [
        {
          "source": 1123977,
          "name": "body-parser",
          "dependency": "body-parser",
          "title": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
          "url": "https://github.com/advisories/GHSA-v422-hmwv-36x6",
          "severity": "low",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 3.7,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<1.20.6"
        }
      ],
      "effects": [],
      "range": "<1.20.6",
      "nodes": [
        "node_modules/body-parser"
      ],
      "fixAvailable": true
    },
    "brace-expansion": {
      "name": "brace-expansion",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1123896,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
          "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=2.0.0 <2.1.2"
        },
        {
          "source": 1123897,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
          "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<1.1.16"
        },
        {
          "source": 1130588,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
          "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.17"
        },
        {
          "source": 1130589,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
          "url": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=2.0.0 <2.1.3"
        },
        {
          "source": 1130736,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=2.0.0 <2.1.4"
        },
        {
          "source": 1130737,
          "name": "brace-expansion",
          "dependency": "brace-expansion",
          "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "url": "https://github.com/advisories/GHSA-rgw5-rvv9-x895",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<1.1.18"
        }
      ],
      "effects": [],
      "range": "<=1.1.17 || 2.0.0 - 2.1.3",
      "nodes": [
        "node_modules/brace-expansion",
        "node_modules/filelist/node_modules/brace-expansion",
        "node_modules/rimraf/node_modules/brace-expansion"
      ],
      "fixAvailable": true
    },
    "echarts": {
      "name": "echarts",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        {
          "source": 1122144,
          "name": "echarts",
          "dependency": "echarts",
          "title": "Apache ECharts has a cross-site scripting (XSS) vulnerability",
          "url": "https://github.com/advisories/GHSA-fgmj-fm8m-jvvx",
          "severity": "moderate",
          "cwe": [
            "CWE-79"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": "<6.1.0"
        }
      ],
      "effects": [],
      "range": "<6.1.0",
      "nodes": [
        "node_modules/echarts"
      ],
      "fixAvailable": {
        "name": "echarts",
        "version": "6.1.0",
        "isSemVerMajor": true
      }
    },
    "fast-uri": {
      "name": "fast-uri",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1124064,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to host confusion via literal backslash authority delimiter",
          "url": "https://github.com/advisories/GHSA-v2hh-gcrm-f6hx",
          "severity": "high",
          "cwe": [
            "CWE-436"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=3.0.0 <=3.1.3"
        },
        {
          "source": 1130720,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to host confusion via backslash authority introducer",
          "url": "https://github.com/advisories/GHSA-7p8r-x3mc-p8w7",
          "severity": "high",
          "cwe": [
            "CWE-436"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=3.0.0 <3.1.5"
        },
        {
          "source": 1132817,
          "name": "fast-uri",
          "dependency": "fast-uri",
          "title": "fast-uri vulnerable to host confusion via failed IDN canonicalization",
          "url": "https://github.com/advisories/GHSA-4c8g-83qw-93j6",
          "severity": "high",
          "cwe": [
            "CWE-436",
            "CWE-551"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=3.0.0 <3.1.3"
        }
      ],
      "effects": [],
      "range": "3.0.0 - 3.1.4",
      "nodes": [
        "node_modules/fast-uri"
      ],
      "fixAvailable": true
    },
    "form-data": {
      "name": "form-data",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1120743,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
          "url": "https://github.com/advisories/GHSA-hmw2-7cc7-3qxx",
          "severity": "high",
          "cwe": [
            "CWE-93"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=4.0.0 <4.0.6"
        },
        {
          "source": 1120744,
          "name": "form-data",
          "dependency": "form-data",
          "title": "form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
          "url": "https://github.com/advisories/GHSA-hmw2-7cc7-3qxx",
          "severity": "high",
          "cwe": [
            "CWE-93"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
          },
          "range": ">=3.0.0 <3.0.5"
        }
      ],
      "effects": [],
      "range": "3.0.0 - 3.0.4 || 4.0.0 - 4.0.5",
      "nodes": [
        "node_modules/form-data",
        "node_modules/jsdom/node_modules/form-data"
      ],
      "fixAvailable": true
    },
    "http-proxy-middleware": {
      "name": "http-proxy-middleware",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        {
          "source": 1121360,
          "name": "http-proxy-middleware",
          "dependency": "http-proxy-middleware",
          "title": "http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",
          "url": "https://github.com/advisories/GHSA-64mm-vxmg-q3vj",
          "severity": "moderate",
          "cwe": [
            "CWE-20",
            "CWE-187"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=0.16.0 <2.0.10"
        }
      ],
      "effects": [],
      "range": ">=0.16.0 <2.0.10",
      "nodes": [
        "node_modules/http-proxy-middleware"
      ],
      "fixAvailable": true
    },
    "js-yaml": {
      "name": "js-yaml",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1121859,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
          "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68",
          "severity": "moderate",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<3.15.0"
        },
        {
          "source": 1121860,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",
          "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68",
          "severity": "moderate",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=4.0.0 <=4.1.1"
        },
        {
          "source": 1123911,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption",
          "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=4.0.0 <4.3.0"
        },
        {
          "source": 1123912,
          "name": "js-yaml",
          "dependency": "js-yaml",
          "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption",
          "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=3.0.0 <3.15.0"
        }
      ],
      "effects": [],
      "range": "<=3.14.2 || 4.0.0 - 4.2.0",
      "nodes": [
        "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml",
        "node_modules/js-yaml"
      ],
      "fixAvailable": true
    },
    "postcss": {
      "name": "postcss",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1124288,
          "name": "postcss",
          "dependency": "postcss",
          "title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",
          "url": "https://github.com/advisories/GHSA-r28c-9q8g-f849",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
          },
          "range": "<=8.5.17"
        },
        {
          "source": 1130709,
          "name": "postcss",
          "dependency": "postcss",
          "title": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q ΓÇö attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
          "url": "https://github.com/advisories/GHSA-fxqj-rqcc-2cmp",
          "severity": "moderate",
          "cwe": [
            "CWE-22",
            "CWE-200"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=8.5.22"
        }
      ],
      "effects": [
        "resolve-url-loader"
      ],
      "range": "<=8.5.22",
      "nodes": [
        "node_modules/postcss"
      ],
      "fixAvailable": {
        "name": "react-scripts",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "react-router": {
      "name": "react-router",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1124268,
          "name": "react-router",
          "dependency": "react-router",
          "title": "React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)",
          "url": "https://github.com/advisories/GHSA-wrjc-x8rr-h8h6",
          "severity": "moderate",
          "cwe": [
            "CWE-601"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": ">=6.0.0 <7.18.0"
        },
        {
          "source": 1124272,
          "name": "react-router",
          "dependency": "react-router",
          "title": "React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration",
          "url": "https://github.com/advisories/GHSA-337j-9hxr-rhxg",
          "severity": "moderate",
          "cwe": [
            "CWE-470"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
          },
          "range": ">=6.4.0 <7.18.0"
        }
      ],
      "effects": [
        "react-router-dom"
      ],
      "range": "6.0.0 - 7.17.0",
      "nodes": [
        "node_modules/react-router"
      ],
      "fixAvailable": true
    },
    "react-router-dom": {
      "name": "react-router-dom",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        {
          "source": 1124270,
          "name": "react-router-dom",
          "dependency": "react-router-dom",
          "title": "React Router: Open redirect leading to XSS",
          "url": "https://github.com/advisories/GHSA-jjmj-jmhj-qwj2",
          "severity": "moderate",
          "cwe": [
            "CWE-601"
          ],
          "cvss": {
            "score": 6.9,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N"
          },
          "range": ">=6.30.2 <=6.30.4"
        },
        "react-router"
      ],
      "effects": [],
      "range": "6.0.0-alpha.0 - 7.17.0",
      "nodes": [
        "node_modules/react-router-dom"
      ],
      "fixAvailable": true
    },
    "react-scripts": {
      "name": "react-scripts",
      "severity": "high",
      "isDirect": true,
      "via": [
        "@svgr/webpack",
        "resolve-url-loader",
        "webpack-dev-server"
      ],
      "effects": [
        "@craco/craco"
      ],
      "range": ">=0.1.0",
      "nodes": [
        "node_modules/react-scripts"
      ],
      "fixAvailable": {
        "name": "react-scripts",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "resolve-url-loader": {
      "name": "resolve-url-loader",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "postcss"
      ],
      "effects": [
        "react-scripts"
      ],
      "range": "0.0.1-experiment-postcss || 3.0.0-alpha.1 - 4.0.0",
      "nodes": [
        "node_modules/resolve-url-loader"
      ],
      "fixAvailable": {
        "name": "react-scripts",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "shell-quote": {
      "name": "shell-quote",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1123944,
          "name": "shell-quote",
          "dependency": "shell-quote",
          "title": "shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)",
          "url": "https://github.com/advisories/GHSA-395f-4hp3-45gv",
          "severity": "high",
          "cwe": [
            "CWE-407"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": "<=1.8.4"
        }
      ],
      "effects": [],
      "range": "<=1.8.4",
      "nodes": [
        "node_modules/shell-quote"
      ],
      "fixAvailable": true
    },
    "svgo": {
      "name": "svgo",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1124021,
          "name": "svgo",
          "dependency": "svgo",
          "title": "SVGO removeScripts plugin leaves some executable scripts intact",
          "url": "https://github.com/advisories/GHSA-2p49-hgcm-8545",
          "severity": "high",
          "cwe": [
            "CWE-79",
            "CWE-184"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
          },
          "range": ">=1.0.0 <2.8.3"
        }
      ],
      "effects": [
        "@svgr/plugin-svgo"
      ],
      "range": "1.0.0 - 2.8.2",
      "nodes": [
        "node_modules/svgo"
      ],
      "fixAvailable": {
        "name": "react-scripts",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "webpack-dev-server": {
      "name": "webpack-dev-server",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1121087,
          "name": "webpack-dev-server",
          "dependency": "webpack-dev-server",
          "title": "webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies",
          "url": "https://github.com/advisories/GHSA-mx8g-39q3-5c79",
          "severity": "moderate",
          "cwe": [
            "CWE-346",
            "CWE-441"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<5.2.5"
        },
        {
          "source": 1123965,
          "name": "webpack-dev-server",
          "dependency": "webpack-dev-server",
          "title": "webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints",
          "url": "https://github.com/advisories/GHSA-f5vj-f2hx-8m93",
          "severity": "moderate",
          "cwe": [
            "CWE-352",
            "CWE-749"
          ],
          "cvss": {
            "score": 4.7,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L"
          },
          "range": "<=5.2.5"
        },
        {
          "source": 1123966,
          "name": "webpack-dev-server",
          "dependency": "webpack-dev-server",
          "title": "webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header",
          "url": "https://github.com/advisories/GHSA-m28w-2pqf-7qgj",
          "severity": "moderate",
          "cwe": [
            "CWE-20",
            "CWE-248"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": "<=5.2.5"
        }
      ],
      "effects": [
        "react-scripts"
      ],
      "range": "<=5.2.5",
      "nodes": [
        "node_modules/webpack-dev-server"
      ],
      "fixAvailable": {
        "name": "react-scripts",
        "version": "0.0.0",
        "isSemVerMajor": true
      }
    },
    "websocket-driver": {
      "name": "websocket-driver",
      "severity": "critical",
      "isDirect": false,
      "via": [
        {
          "source": 1123482,
          "name": "websocket-driver",
          "dependency": "websocket-driver",
          "title": "websocket-driver: Resource limit bypass via message compression",
          "url": "https://github.com/advisories/GHSA-mp7j-qc5w-4988",
          "severity": "moderate",
          "cwe": [
            "CWE-770"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<0.7.5"
        },
        {
          "source": 1123483,
          "name": "websocket-driver",
          "dependency": "websocket-driver",
          "title": "websocket-driver: Message corruption via abuse of protocol length headers",
          "url": "https://github.com/advisories/GHSA-xv26-6w52-cph6",
          "severity": "critical",
          "cwe": [
            "CWE-130"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<0.7.5"
        }
      ],
      "effects": [],
      "range": "<=0.7.4",
      "nodes": [
        "node_modules/websocket-driver"
      ],
      "fixAvailable": true
    },
    "ws": {
      "name": "ws",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1123260,
          "name": "ws",
          "dependency": "ws",
          "title": "ws: Memory exhaustion DoS from tiny fragments and data chunks",
          "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p",
          "severity": "high",
          "cwe": [
            "CWE-400",
            "CWE-770",
            "CWE-1050"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=7.0.0 <7.5.11"
        }
      ],
      "effects": [],
      "range": "7.0.0 - 7.5.10",
      "nodes": [
        "node_modules/ws"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 2,
      "moderate": 7,
      "high": 12,
      "critical": 1,
      "total": 22
    },
    "dependencies": {
      "prod": 1686,
      "dev": 35,
      "optional": 4,
      "peer": 2,
      "peerOptional": 0,
      "total": 1725
    }
  }
}