Skip to content

Dependabot 보안 알림 77건 정리 및 해결 계획 #584

Closed
Closed
Dependabot 보안 알림 77건 정리 및 해결 계획#584

Description

@manNomi
manNomi
opened on Jun 26, 2026

배경

GitHub Security 탭의 Dependabot open alert가 77건으로 쌓여 있어, 수정 전에 현재 상태와 처리 계획을 한 이슈에 정리합니다.

많아 보이는 이유는 실제 패키지 77개가 아니라 advisory 단위로 alert가 쪼개지기 때문입니다. 예를 들어 axios 하나가 24건, protobufjs가 7건, vite가 7건으로 집계됩니다. 또한 pnpm-lock.yaml과 packages/bruno-api-typescript/package-lock.json처럼 manifest가 나뉘어 같은 계열 취약점이 중복 집계되는 케이스가 있습니다.

  • 스냅샷 기준: 2026-06-26 15:09 KST
  • 대상: solid-connection/solid-connect-web Dependabot open alerts
  • 총계: 77건
  • 목표: critical/high를 우선 처리하고, 최종적으로 medium/low까지 Dependabot open alert를 0건으로 정리

Severity 요약

Severity Count
critical 2
high 38
medium 32
low 5

패키지별 집계

Package Total Critical High Medium Low Manifest
axios 24 0 12 11 1 pnpm-lock.yaml
protobufjs 7 1 3 3 0 pnpm-lock.yaml
vite 7 0 4 3 0 pnpm-lock.yaml
minimatch 6 0 6 0 0 packages/bruno-api-typescript/package-lock.json, pnpm-lock.yaml
picomatch 4 0 2 2 0 pnpm-lock.yaml
ws 3 0 2 1 0 pnpm-lock.yaml
brace-expansion 2 0 0 2 0 packages/bruno-api-typescript/package-lock.json, pnpm-lock.yaml
fast-uri 2 0 2 0 0 pnpm-lock.yaml
form-data 2 0 2 0 0 pnpm-lock.yaml
turbo 2 0 0 1 1 pnpm-lock.yaml
yaml 2 0 0 2 0 pnpm-lock.yaml, packages/bruno-api-typescript/package-lock.json
@babel/core 1 0 0 0 1 pnpm-lock.yaml
@babel/plugin-transform-modules-systemjs 1 0 1 0 0 pnpm-lock.yaml
@opentelemetry/core 1 0 0 1 0 pnpm-lock.yaml
@protobufjs/utf8 1 0 0 1 0 pnpm-lock.yaml
@tootallnate/once 1 0 0 0 1 pnpm-lock.yaml
esbuild 1 0 0 0 1 pnpm-lock.yaml
fast-xml-builder 1 0 1 0 0 pnpm-lock.yaml
fast-xml-parser 1 0 0 1 0 pnpm-lock.yaml
follow-redirects 1 0 0 1 0 pnpm-lock.yaml
glob 1 0 1 0 0 packages/bruno-api-typescript/package-lock.json
js-yaml 1 0 0 1 0 pnpm-lock.yaml
postcss 1 0 0 1 0 pnpm-lock.yaml
rollup 1 0 1 0 0 pnpm-lock.yaml
svgo 1 0 1 0 0 pnpm-lock.yaml
uuid 1 0 0 1 0 pnpm-lock.yaml
vitest 1 1 0 0 0 pnpm-lock.yaml

Critical / High 상세

Severity Alert Package Manifest Vulnerable range Patched version Advisory Summary
critical #145 protobufjs pnpm-lock.yaml < 7.5.5 7.5.5 GHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjs
critical #212 vitest pnpm-lock.yaml < 3.2.6 3.2.6 GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed
high #162 @babel/plugin-transform-modules-systemjs pnpm-lock.yaml >= 7.12.0, <= 7.29.3 7.29.4 GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
high #95 axios pnpm-lock.yaml >= 1.0.0, <= 1.13.4 1.13.5 GHSA-43fc-jf86-j433 Axios is Vulnerable to Denial of Service via proto Key in mergeConfig
high #152 axios pnpm-lock.yaml >= 1.0.0, < 1.15.1 1.15.1 GHSA-6chq-wfr3-2hj9 Axios: Header Injection via Prototype Pollution
high #155 axios pnpm-lock.yaml >= 1.0.0, < 1.15.1 1.15.1 GHSA-pf86-5x62-jrwf Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
high #185 axios pnpm-lock.yaml >= 1.0.0, < 1.15.2 1.15.2 GHSA-q8qp-cvcw-x6jj Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
high #194 axios pnpm-lock.yaml >= 1.0.0, < 1.15.1 1.15.1 GHSA-pmwg-cvhr-8vh7 Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
high #203 axios pnpm-lock.yaml >= 1.0.0, < 1.16.0 1.16.0 GHSA-pjwm-pj3p-43mv axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
high #204 axios pnpm-lock.yaml >= 1.0.0, < 1.16.0 1.16.0 GHSA-35jp-ww65-95wh axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in config.proxy
high #205 axios pnpm-lock.yaml >= 1.0.0, < 1.15.2 1.15.2 GHSA-3g43-6gmg-66jw axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
high #208 axios pnpm-lock.yaml >= 1.7.0, < 1.16.0 1.16.0 GHSA-777c-7fjr-54vf Allocation of Resources Without Limits or Throttling in Axios
high #209 axios pnpm-lock.yaml >= 1.0.0, < 1.16.0 1.16.0 GHSA-hfxv-24rg-xrqf Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
high #210 axios pnpm-lock.yaml >= 1.0.0, < 1.16.0 1.16.0 GHSA-j5f8-grm9-p9fc Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
high #211 axios pnpm-lock.yaml >= 1.0.0, < 1.16.0 1.16.0 GHSA-p92q-9vqr-4j8v Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
high #160 fast-uri pnpm-lock.yaml <= 3.1.0 3.1.1 GHSA-q3j6-qgpj-74h6 fast-uri vulnerable to path traversal via percent-encoded dot segments
high #161 fast-uri pnpm-lock.yaml <= 3.1.1 3.1.2 GHSA-v39h-62p7-jpjc fast-uri vulnerable to host confusion via percent-encoded authority delimiters
high #159 fast-xml-builder pnpm-lock.yaml <= 1.1.6 1.1.7 GHSA-5wm8-gmm8-39j9 fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes
high #226 form-data pnpm-lock.yaml < 2.5.6 2.5.6 GHSA-hmw2-7cc7-3qxx form-data: CRLF injection in form-data via unescaped multipart field names and filenames
high #227 form-data pnpm-lock.yaml >= 4.0.0, < 4.0.6 4.0.6 GHSA-hmw2-7cc7-3qxx form-data: CRLF injection in form-data via unescaped multipart field names and filenames
high #92 glob packages/bruno-api-typescript/package-lock.json >= 10.2.0, < 10.5.0 10.5.0 GHSA-5j98-mcp5-4vw2 glob CLI: Command injection via -c/--cmd executes matches with shell:true
high #98 minimatch pnpm-lock.yaml >= 9.0.0, < 9.0.6 9.0.6 GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
high #99 minimatch packages/bruno-api-typescript/package-lock.json >= 9.0.0, < 9.0.6 9.0.6 GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
high #101 minimatch pnpm-lock.yaml >= 9.0.0, < 9.0.7 9.0.7 GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
high #102 minimatch packages/bruno-api-typescript/package-lock.json >= 9.0.0, < 9.0.7 9.0.7 GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
high #103 minimatch pnpm-lock.yaml >= 9.0.0, < 9.0.7 9.0.7 GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
high #104 minimatch packages/bruno-api-typescript/package-lock.json >= 9.0.0, < 9.0.7 9.0.7 GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
high #124 picomatch pnpm-lock.yaml >= 4.0.0, < 4.0.4 4.0.4 GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers
high #130 picomatch pnpm-lock.yaml < 2.3.2 2.3.2 GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers
high #165 protobufjs pnpm-lock.yaml <= 7.5.5 7.5.6 GHSA-75px-5xx7-5xc7 protobuf.js: Code generation gadget after prototype pollution
high #166 protobufjs pnpm-lock.yaml <= 7.5.5 7.5.6 GHSA-jvwf-75h9-cwgg protobuf.js: Process-wide denial of service through unsafe option paths
high #169 protobufjs pnpm-lock.yaml <= 7.5.5 7.5.6 GHSA-66ff-xgx4-vchm protobuf.js: Code injection through bytes field defaults in generated toObject code
high #100 rollup pnpm-lock.yaml >= 4.0.0, < 4.59.0 4.59.0 GHSA-mw96-cpmx-2vgc Rollup 4 has Arbitrary File Write via Path Traversal
high #106 svgo pnpm-lock.yaml >= 3.0.0, < 3.3.3 3.3.3 GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
high #136 vite pnpm-lock.yaml >= 7.1.0, <= 7.3.1 7.3.2 GHSA-v2wj-q39q-566r Vite: server.fs.deny bypassed with queries
high #138 vite pnpm-lock.yaml >= 7.0.0, <= 7.3.1 7.3.2 GHSA-p9ff-h696-f583 Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
high #216 vite pnpm-lock.yaml >= 8.0.0, <= 8.0.15 8.0.16 GHSA-fx2h-pf6j-xcff vite: server.fs.deny bypass on Windows alternate paths
high #224 vite pnpm-lock.yaml >= 7.0.0, <= 7.3.4 7.3.5 GHSA-fx2h-pf6j-xcff vite: server.fs.deny bypass on Windows alternate paths
high #220 ws pnpm-lock.yaml >= 7.0.0, < 7.5.11 7.5.11 GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks
high #221 ws pnpm-lock.yaml >= 8.0.0, < 8.21.0 8.21.0 GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks
Medium / Low 상세 목록
Severity Alert Package Manifest Vulnerable range Patched version Advisory Summary
medium #218 @opentelemetry/core pnpm-lock.yaml < 2.8.0 2.8.0 GHSA-8988-4f7v-96qf OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
medium #163 @protobufjs/utf8 pnpm-lock.yaml <= 1.1.0 1.1.1 GHSA-q6x5-8v7m-xcrf protobufjs has overlong UTF-8 decoding
medium #144 axios pnpm-lock.yaml >= 1.0.0, < 1.15.0 1.15.0 GHSA-fvcv-3m26-pcqx Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
medium #146 axios pnpm-lock.yaml >= 1.0.0, < 1.15.0 1.15.0 GHSA-3p68-rc4w-qgx5 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
medium #151 axios pnpm-lock.yaml >= 1.0.0, < 1.15.1 1.15.1 GHSA-vf2m-468p-8v99 Axios: HTTP adapter streamed responses bypass maxContentLength
medium #154 axios pnpm-lock.yaml >= 1.0.0, < 1.15.2 1.15.2 GHSA-3w6x-2g7m-8v23 Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in parseReviver
medium #156 axios pnpm-lock.yaml >= 1.0.0, < 1.15.1 1.15.1 GHSA-m7pr-hjqh-92cm Axios: no_proxy bypass via IP alias allows SSRF
medium #157 axios pnpm-lock.yaml >= 1.0.0, < 1.15.1 1.15.1 GHSA-445q-vr5w-6q77 Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
medium #158 axios pnpm-lock.yaml >= 1.0.0, < 1.15.1 1.15.1 GHSA-5c9x-8gcm-mpgx Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
medium #174 axios pnpm-lock.yaml >= 1.0.0, < 1.15.1 1.15.1 GHSA-xx6v-rp6x-q39c Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in withXSRFToken Boolean Coercion
medium #195 axios pnpm-lock.yaml >= 1.0.0, < 1.15.1 1.15.1 GHSA-w9j2-pvgh-6h63 Axios: Authentication Bypass via Prototype Pollution Gadget in validateStatus Merge Strategy
medium #196 axios pnpm-lock.yaml >= 1.0.0, < 1.15.1 1.15.1 GHSA-62hf-57xw-28j9 Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
medium #202 axios pnpm-lock.yaml >= 1.0.0, < 1.16.0 1.16.0 GHSA-898c-q2cr-xwhg axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
medium #134 brace-expansion pnpm-lock.yaml >= 2.0.0, < 2.0.3 2.0.3 GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
medium #135 brace-expansion packages/bruno-api-typescript/package-lock.json >= 2.0.0, < 2.0.3 2.0.3 GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
medium #147 fast-xml-parser pnpm-lock.yaml < 5.7.0 5.7.0 GHSA-gh4j-gqv2-49f6 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
medium #143 follow-redirects pnpm-lock.yaml <= 1.15.11 1.16.0 GHSA-r4q5-vmmm-2653 follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
medium #223 js-yaml pnpm-lock.yaml <= 4.1.1 4.2.0 GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
medium #123 picomatch pnpm-lock.yaml >= 4.0.0, < 4.0.4 4.0.4 GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
medium #131 picomatch pnpm-lock.yaml < 2.3.2 2.3.2 GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
medium #149 postcss pnpm-lock.yaml < 8.5.10 8.5.10 GHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
medium #164 protobufjs pnpm-lock.yaml <= 7.5.5 7.5.6 GHSA-q6x5-8v7m-xcrf protobufjs has overlong UTF-8 decoding
medium #167 protobufjs pnpm-lock.yaml <= 7.5.5 7.5.6 GHSA-fx83-v9x8-x52w protobuf.js: Prototype injection in generated message constructors
medium #168 protobufjs pnpm-lock.yaml <= 7.5.5 7.5.6 GHSA-2pr8-phx7-x9h3 protobuf.js: Denial of service from crafted field names in generated code
medium #201 turbo pnpm-lock.yaml <= 2.9.13 2.9.14 GHSA-hcf7-66rw-9f5r Trubo: Login callback CSRF/session fixation
medium #192 uuid pnpm-lock.yaml < 11.1.1 11.1.1 GHSA-w5hq-g745-h8pq uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
medium #137 vite pnpm-lock.yaml >= 7.0.0, <= 7.3.1 7.3.2 GHSA-4w7w-66w2-5vf9 Vite Vulnerable to Path Traversal in Optimized Deps .map Handling
medium #217 vite pnpm-lock.yaml >= 8.0.0, <= 8.0.15 8.0.16 GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
medium #225 vite pnpm-lock.yaml >= 7.0.0, <= 7.3.4 7.3.5 GHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
medium #198 ws pnpm-lock.yaml >= 8.0.0, < 8.20.1 8.20.1 GHSA-58qx-3vcg-4xpx ws: Uninitialized memory disclosure
medium #126 yaml packages/bruno-api-typescript/package-lock.json >= 2.0.0, < 2.8.3 2.8.3 GHSA-48c2-rrv3-qjmp yaml is vulnerable to Stack Overflow via deeply nested YAML collections
medium #127 yaml pnpm-lock.yaml >= 2.0.0, < 2.8.3 2.8.3 GHSA-48c2-rrv3-qjmp yaml is vulnerable to Stack Overflow via deeply nested YAML collections
low #222 @babel/core pnpm-lock.yaml <= 7.29.0 7.29.6 GHSA-4x5r-pxfx-6jf8 @babel/core: Arbitrary File Read via sourceMappingURL Comment
low #190 @tootallnate/once pnpm-lock.yaml < 2.0.1 2.0.1 GHSA-vpq2-c234-7xj6 @tootallnate/once vulnerable to Incorrect Control Flow Scoping
low #153 axios pnpm-lock.yaml >= 1.0.0, < 1.15.1 1.15.1 GHSA-xhjh-pmcv-23jw Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
low #219 esbuild pnpm-lock.yaml >= 0.27.3, < 0.28.1 0.28.1 GHSA-g7r4-m6w7-qqqr esbuild allows arbitrary file read when running the development server on Windows
low #200 turbo pnpm-lock.yaml >= 1.1.0, < 2.9.14 2.9.14 GHSA-3qcw-2rhx-2726 Turbo: Unexpected local code execution during Yarn Berry detection

1차 처리 계획

  1. Node 22.x 환경에서 별도 브랜치를 만들고 lockfile 기준으로 재현 가능한 상태를 만든다.
  2. 직접 의존성을 먼저 업데이트한다.
    • axios: workspace 직접 의존성 전체를 patched range인 >=1.16.0 기준으로 갱신한다.
    • apps/admin의 vite: >=8.0.16 기준으로 갱신한다.
    • apps/admin의 vitest: >=3.2.6 기준으로 갱신한다.
    • root turbo: >=2.9.14 기준으로 갱신한다.
  3. 직접 업데이트로 닫히지 않는 transitive dependency는 upstream minor update를 먼저 시도하고, 필요하면 pnpm.overrides를 최소 범위로 추가한다.
    • firebase-admin/Google Cloud 계열: protobufjs, form-data, fast-xml-parser, fast-xml-builder 확인
    • @commitlint/ajv 계열: fast-uri 확인
    • Vite/Vitest toolchain 계열: rollup, picomatch, ws, svgo, postcss, @babel/* 확인
  4. packages/bruno-api-typescript/package-lock.json는 별도 npm lockfile이므로, glob, minimatch, brace-expansion, yaml을 npm lockfile 기준으로 별도 갱신한다.
  5. 로컬 검증을 통과시킨다.
    • pnpm install --frozen-lockfile
    • pnpm --filter @solid-connect/web run ci:check
    • pnpm --filter @solid-connect/university-web run ci:check
    • pnpm --filter @solid-connect/admin run ci:check
    • 필요 시 web/university-web/admin production build
  6. PR 생성 후 GitHub Security 탭에서 Dependabot re-scan 결과를 확인하고, 남은 alert를 같은 이슈에 체크리스트로 업데이트한다.

작업 순서 제안

  • PR 1: axios, vite, vitest, turbo처럼 직접 의존성 위주로 큰 덩어리 제거
  • PR 2: firebase-admin/Google Cloud transitive 취약점과 pnpm.overrides 필요 여부 정리
  • PR 3: packages/bruno-api-typescript/package-lock.json 별도 lockfile 취약점 정리
  • PR 4: Security 탭 re-scan 후 잔여 medium/low alert 마무리

완료 조건

  • Dependabot open alert의 critical/high가 0건
  • medium/low까지 포함해 Dependabot open alert가 0건
  • lockfile 변경이 의도한 dependency update 범위 안에 있음
  • 세 앱의 ci:check와 필요한 production build 통과

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions