@adobe/helix-docx2md (1.9.29), @adobe/helix-importer (>=3.4.141, <=3.4.143) +32 more potentially affected by CVE-2026-59868 via js-yaml (>=5.0.0, <=5.1.0)

js-yaml NPM version =5.0.0, =3.4.141, =2.2.62, =1.0.8, =0.2.12, =0.2.12, =0.2.12, =0.2.13, =0.2.12, =0.2.16, =0.2.14, =0.2.12, =0.2.17 and more Source cves: CVE-2026-59868 Source advisory: OSV:GHSA-G796-FGMG-93MV...

@adobe/helix-docx2md (1.9.29), @adobe/helix-importer (>=3.4.141, <=3.4.143) +32 more potentially affected by CVE-2026-59868 +1 more via js-yaml (>=5.0.0, <=5.1.0)

js-yaml NPM version =5.0.0, =3.4.141, =2.2.62, =1.0.8, =0.2.12, =0.2.12, =0.2.12, =0.2.13, =0.2.12, =0.2.16, =0.2.14, =0.2.12, =0.2.17 and more Source cves: CVE-2026-59868, CVE-2026-59869 Source advisory: SNYK:JS-JSYAML-17900092...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1103 more potentially affected by CVE-2026-25896 via fast-xml-parser (>=5.0.1, <=5.3.4)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-25896 Source advisory: OSV:GHSA-M7JM-9GC2-MPF2...

@adobe/helix-docx2md (>=1.4.16, <=1.9.7), @adobe/helix-html-pipeline (>=4.1.6, <=6.27.14) +37 more potentially affected by CVE-2025-66400 via mdast-util-to-hast (>=13.0.0, <=13.2.0)

mdast-util-to-hast NPM version =13.0.0, =1.4.16, =4.1.6, =1.0.0, =2.9.31, =7.0.0, =2.1.26, =1.0.0, =3.0.0, =2.0.0, =1.1.1, =1.0.0, =1.0.0-B001, =1.0.277, =0.40.5, =0.38.0, =2.9.0 and more Source cves: CVE-2025-66400 Source advisory: OSV:GHSA-4FH9-H7WG-Q85M...

@adobe/helix-docx2md (>=1.4.16, <=1.9.7), @adobe/helix-html-pipeline (>=4.1.6, <=6.27.14) +37 more potentially affected by CVE-2025-66400 via mdast-util-to-hast (>=13.0.0, <=13.2.0)

mdast-util-to-hast NPM version =13.0.0, =1.4.16, =4.1.6, =1.0.0, =2.9.31, =7.0.0, =2.1.26, =1.0.0, =3.0.0, =2.0.0, =1.1.1, =1.0.0, =1.0.0-B001, =1.0.277, =0.40.5, =0.38.0, =2.9.0 and more Source cves: CVE-2025-66400 Source advisory: SNYK:JS-MDASTUTILTOHAST-14157221...

MAL-2025-6873 Malicious code in adobe-helix-rum-enhancer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 47e5b1e8c964526ea266344bff394d02083744b3bcce422729b60b047c005157 The OpenSSF Package Analysis project identified 'adobe-helix-rum-enhancer' @ 99.99.100 npm as malicious. It is considered malicious because: - T...

@adobe/helix-importer (>=3.4.65, <=3.4.79), @adobe/helix-md2docx (>=2.2.0, <=2.2.7) +93 more potentially affected by CVE-2025-71319 via image-size (>=2.0.0, <=2.0.1)

image-size NPM version =2.0.0, =3.4.65, =2.2.0, =2.6.5, =1.3.47, =1.4.2, =1.0.1-alpha.1, =0.5.12-alpha-20241008130427, =0.5.12-alpha-20241008130427, =0.5.12-alpha-20241008130427, =0.5.12-alpha-20241008130427, =0.5.12-alpha-20241008130427, =0.5.12-alpha-20241008130427, =0.5.12-alpha-20241008130427...

@adobe/helix-importer (>=3.1.2, <=3.4.79), @adobe/helix-md2docx (>=2.1.38, <=2.1.107) +144 more potentially affected by CVE-2025-71319 via image-size (>=1.1.0, <=1.2.0)

image-size NPM version =1.1.0, =3.1.2, =2.1.38, =1.0.0, =2.4.3, =1.1.1, =1.0.0, =1.0.0-B001, =0.0.28, =2.17.13, =0.17.6, =1.16.10, =7.1.0, =0.0.1, =1.1.69, =5.0.0-alpha.27, =5.0.0-alpha.39 and more Source cves: CVE-2025-71319 Source advisory: OSV:GHSA-M5QC-5HW7-8VG7...

@adobe/helix-deploy (>=9.1.9, <=11.1.13), @adobe/helix-universal-devserver (>=1.0.0, <=1.0.1) potentially affected by CVE-2024-38375 via @fastly/js-compute (>=3.1.1, <=3.15.0)

@fastly/js-compute NPM version =3.1.1, =9.1.9, =1.0.0, =1.0.1 Source cves: CVE-2024-38375 Source advisory: OSV:GHSA-MP3G-VPM9-9VQV...

@2109-t5/server (>=1.0.0, <=1.0.9), @accounter/green-invoice-graphql (>=0.7.2-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, <=0.7.3-alpha-20250224164805-3a96c9f8d619656e3b6a8c0d26319b937adbafe6) +207 more potentially affected by CVE-2022-25881 via http-cache-semantics (>=4.0.3, <=4.1.0)

http-cache-semantics NPM version =4.0.3, =1.0.0, =0.7.2-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =0.2.3-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =0.2.3-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =1.1.3, =3.0.0, =1.9.19, =1.18.0,...

@adobe/helix-deploy (>=7.0.0, <=7.0.8) potentially affected by CVE-2022-39218 via @fastly/js-compute (>=0.4.0, <=0.5.2)

@fastly/js-compute NPM version =0.4.0, =7.0.0, =7.0.8 Source cves: CVE-2022-39218 Source advisory: OSV:GHSA-CMR8-5W4C-44V8...

@adobe/helix-google-support (>=1.3.4, <=2.0.3), @adobe/helix-html-pipeline (>=3.0.0, <=3.1.8) +64 more potentially affected by CVE-2022-36083 via jose (>=4.0.3, <=4.9.1)

jose NPM version =4.0.3, =1.3.4, =3.0.0, =1.11.39, =8.0.0, =0.0.1, =0.0.2-alpha.15, =2.2.2, =2022.2.6, =1.0.1, =2.7.3, =1.0.4-alpha.0, =2.2.9, =1.1.5, =1.1.9 and more Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

@adobe/git-server (>=1.3.6, <=1.3.18), @adobe/helix-cli (>=8.1.0, <=13.4.15) +12 more potentially affected by CVE-2021-30483 via isomorphic-git (>=1.1.4, <=1.8.1)

isomorphic-git NPM version =1.1.4, =1.3.6, =8.1.0, =1.0.0, =5.1.1, =2.9.0, =1.0.24, =2.4.1, =1.2.0, =0.1.0, =4.0.1-next.443, =2.3.1-beta.0, =2.10.4, =1.0.0, =1.0.1 Source cves: CVE-2021-30483 Source advisory: OSV:GHSA-FGXQ-P49F-QW99...