# Security Audit Report **Repository**: `sendbird/sendbird-uikit-react` **Targets**: `samples/groupchannel` (npm), `samples/openchannel` (npm), `samples/router` (npm), `samples/typescript_sample` (npm), `.` (yarn-berry) **Date**: 2026-08-12 ## Summary | | Critical | High | Moderate | Low | Total | |---|---|---|---|---|---| | Before | 4 | 65 | 38 | 18 | 124 | | **Fixed** | 3 | 38 | 16 | 6 | **63** | | Remaining | 1 | 27 | 22 | 12 | 62 | ## Fixed Vulnerabilities | Package | Target | Severity | Detail | |---|---|---|---| | dompurify | samples/groupchannel | moderate | [DOMPurify contains a Cross-site Scripting vulnerability](GHSA-v2wj-7wpq-c8vv) | | nanoid | samples/groupchannel | high | [nanoid: non-secure generators can loop indefinitely with negative size](GHSA-28wg-ghj8-5hjv) | | postcss | samples/groupchannel | high | [PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure](GHSA-r28c-9q8g-f849) | | dompurify | samples/openchannel | moderate | [DOMPurify contains a Cross-site Scripting vulnerability](GHSA-v2wj-7wpq-c8vv) | | immutable | samples/openchannel | high | [Immutable is vulnerable to Prototype Pollution](GHSA-wf6x-7x77-mvgw) | | nanoid | samples/openchannel | high | [nanoid: non-secure generators can loop indefinitely with negative size](GHSA-28wg-ghj8-5hjv) | | picomatch | samples/openchannel | high | [Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching](GHSA-3v7f-55p6-f55p) | | postcss | samples/openchannel | high | [PostCSS has XSS via Unescaped </style> in its CSS Stringify Output](GHSA-qx2v-qp2m-jg93) | | @babel/runtime | samples/router | moderate | [Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups](GHSA-968p-4wvh-cqc8) | | @remix-run/router | samples/router | high | [React Router vulnerable to XSS via Open Redirects](GHSA-2w69-qvjg-hvjx) | | ajv | samples/router | moderate | [ajv has ReDoS when using `$data` option](GHSA-2g4f-4pwh-qvx6) | | brace-expansion | samples/router | high | [brace-expansion Regular Expression Denial of Service vulnerability](GHSA-v6h2-p8h4-qcjw) | | braces | samples/router | high | [Uncontrolled resource consumption in braces](GHSA-grv7-fg5c-xmjg) | | cross-spawn | samples/router | high | [Regular Expression Denial of Service (ReDoS) in cross-spawn](GHSA-3xgq-45jj-v275) | | dompurify | samples/router | high | [DOMPurify allows tampering by prototype pollution](GHSA-mmhx-hmjr-r674) | | flatted | samples/router | high | [flatted vulnerable to unbounded recursion DoS in parse() revive phase](GHSA-25h7-pfq9-p65f) | | js-yaml | samples/router | high | [js-yaml has prototype pollution in merge (<<)](GHSA-mh29-5h37-fv8m) | | micromatch | samples/router | moderate | [Regular Expression Denial of Service (ReDoS) in micromatch](GHSA-952p-6rrq-rcjv) | | minimatch | samples/router | high | [minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern](GHSA-3ppc-4f35-3m26) | | nanoid | samples/router | high | [nanoid: non-secure generators can loop indefinitely with negative size](GHSA-28wg-ghj8-5hjv) | | picomatch | samples/router | high | [Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching](GHSA-3v7f-55p6-f55p) | | postcss | samples/router | high | [PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure](GHSA-r28c-9q8g-f849) | | @babel/core | samples/typescript_sample | low | [@babel/core: Arbitrary File Read via sourceMappingURL Comment](GHSA-4x5r-pxfx-6jf8) | | @babel/helpers | samples/typescript_sample | moderate | [Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups](GHSA-968p-4wvh-cqc8) | | @babel/runtime | samples/typescript_sample | moderate | [Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups](GHSA-968p-4wvh-cqc8) | | @pmmmwh/react-refresh-webpack-plugin | samples/typescript_sample | moderate | - | | ajv | samples/typescript_sample | moderate | [ajv has ReDoS when using `$data` option](GHSA-2g4f-4pwh-qvx6) | | body-parser | samples/typescript_sample | high | [body-parser vulnerable to denial of service when url encoding is enabled](GHSA-qwcr-r2fm-qrc7) | | brace-expansion | samples/typescript_sample | high | [brace-expansion Regular Expression Denial of Service vulnerability](GHSA-v6h2-p8h4-qcjw) | | braces | samples/typescript_sample | high | [Uncontrolled resource consumption in braces](GHSA-grv7-fg5c-xmjg) | | compression | samples/typescript_sample | low | - | | cookie | samples/typescript_sample | low | [cookie accepts cookie name, path, and domain with out of bounds characters](GHSA-pxg6-pf52-xh8x) | | cross-spawn | samples/typescript_sample | high | [Regular Expression Denial of Service (ReDoS) in cross-spawn](GHSA-3xgq-45jj-v275) | | dompurify | samples/typescript_sample | high | [DOMPurify allows tampering by prototype pollution](GHSA-mmhx-hmjr-r674) | | ejs | samples/typescript_sample | moderate | [ejs lacks certain pollution protection](GHSA-ghr5-ch3p-vcr6) | | express | samples/typescript_sample | high | [express vulnerable to XSS via response.redirect()](GHSA-qw6h-vgh9-j6wx) | | flatted | samples/typescript_sample | high | [flatted vulnerable to unbounded recursion DoS in parse() revive phase](GHSA-25h7-pfq9-p65f) | | follow-redirects | samples/typescript_sample | moderate | [follow-redirects' Proxy-Authorization header kept across hosts](GHSA-cxjh-pqwp-8mfp) | | form-data | samples/typescript_sample | critical | [form-data uses unsafe random function in form-data for choosing boundary](GHSA-fjxv-7rqg-78g4) | | glob | samples/typescript_sample | high | [glob CLI: Command injection via -c/--cmd executes matches with shell:true](GHSA-5j98-mcp5-4vw2) | | http-proxy-middleware | samples/typescript_sample | high | [Denial of service in http-proxy-middleware](GHSA-c7qv-q95q-8v27) | | js-yaml | samples/typescript_sample | high | [js-yaml has prototype pollution in merge (<<)](GHSA-mh29-5h37-fv8m) | | launch-editor | samples/typescript_sample | high | [launch-editor vulnerable to command injection via the crafted request on Windows](GHSA-c27g-q93r-2cwf) | | lilconfig | samples/typescript_sample | high | [lilconfig Code Injection vulnerability](GHSA-fq9m-v26v-2m4f) | | lodash | samples/typescript_sample | high | [lodash vulnerable to Code Injection via `_.template` imports key names](GHSA-r5fr-rjxr-66jc) | | micromatch | samples/typescript_sample | moderate | [Regular Expression Denial of Service (ReDoS) in micromatch](GHSA-952p-6rrq-rcjv) | | minimatch | samples/typescript_sample | high | [minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern](GHSA-3ppc-4f35-3m26) | | nanoid | samples/typescript_sample | high | [Predictable results in nanoid generation when given non-integer values](GHSA-mwcw-c2x4-8c55) | | node-forge | samples/typescript_sample | high | [node-forge has ASN.1 Unbounded Recursion](GHSA-554w-wpv2-vw27) | | on-headers | samples/typescript_sample | low | [on-headers is vulnerable to http response header manipulation](GHSA-76c9-3jph-rj3q) | | path-to-regexp | samples/typescript_sample | high | [path-to-regexp outputs backtracking regular expressions](GHSA-9wv6-86v2-598j) | | picomatch | samples/typescript_sample | high | [Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching](GHSA-3v7f-55p6-f55p) | | qs | samples/typescript_sample | moderate | [qs's arrayLimit bypass in comma parsing allows denial of service](GHSA-w7fw-mjwx-w883) | | rollup | samples/typescript_sample | high | [DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS](GHSA-gcx4-mw62-g8wm) | | send | samples/typescript_sample | low | [send vulnerable to template injection that can lead to XSS](GHSA-m6fv-jmcg-4jfg) | | serve-static | samples/typescript_sample | low | [serve-static vulnerable to template injection that can lead to XSS](GHSA-cm22-4g7w-348p) | | shell-quote | samples/typescript_sample | critical | [shell-quote quote() does not escape newlines in object .op values](GHSA-w7jw-789q-3m8p) | | terser-webpack-plugin | samples/typescript_sample | moderate | - | | webpack | samples/typescript_sample | moderate | [Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS](GHSA-4vvj-4cpr-p986) | | webpack-dev-middleware | samples/typescript_sample | high | [Path traversal in webpack-dev-middleware](GHSA-wr3j-pwj9-hqq6) | | websocket-driver | samples/typescript_sample | critical | [websocket-driver: Resource limit bypass via message compression](GHSA-mp7j-qc5w-4988) | | ws | samples/typescript_sample | high | [ws affected by a DoS when handling a request with many HTTP headers](GHSA-3h5v-q93c-6h6q) | | yaml | samples/typescript_sample | moderate | [yaml is vulnerable to Stack Overflow via deeply nested YAML collections](GHSA-48c2-rrv3-qjmp) | ## Remaining Vulnerabilities (requires manual review) | Package | Target | Severity | Detail | |---|---|---|---| | react-router | samples/router | moderate | [React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)](GHSA-wrjc-x8rr-h8h6) | | react-router-dom | samples/router | moderate | [React Router: Open redirect leading to XSS](GHSA-jjmj-jmhj-qwj2) | | @jest/core | samples/typescript_sample | low | - | | @svgr/plugin-svgo | samples/typescript_sample | high | - | | @svgr/webpack | samples/typescript_sample | high | - | | @tootallnate/once | samples/typescript_sample | low | [@tootallnate/once vulnerable to Incorrect Control Flow Scoping](GHSA-vpq2-c234-7xj6) | | bfj | samples/typescript_sample | high | - | | css-minimizer-webpack-plugin | samples/typescript_sample | moderate | - | | css-select | samples/typescript_sample | high | - | | http-proxy-agent | samples/typescript_sample | low | - | | jest | samples/typescript_sample | low | - | | jest-cli | samples/typescript_sample | low | - | | jest-config | samples/typescript_sample | low | - | | jest-environment-jsdom | samples/typescript_sample | low | - | | jest-runner | samples/typescript_sample | low | - | | jsdom | samples/typescript_sample | low | - | | jsonpath | samples/typescript_sample | high | - | | nth-check | samples/typescript_sample | high | [Inefficient Regular Expression Complexity in nth-check](GHSA-rp65-9cf3-cjxr) | | postcss | samples/typescript_sample | high | [PostCSS line return parsing error](GHSA-7fh5-64p2-3v2j) | | react-scripts | samples/typescript_sample | high | - | | resolve-url-loader | samples/typescript_sample | moderate | - | | rollup-plugin-terser | samples/typescript_sample | high | - | | serialize-javascript | samples/typescript_sample | high | [Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()](GHSA-5c6j-r48x-rmvq) | | sockjs | samples/typescript_sample | moderate | - | | svgo | samples/typescript_sample | high | [SVGO removeScripts plugin leaves some executable scripts intact](GHSA-2p49-hgcm-8545) | | underscore | samples/typescript_sample | high | [Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack](GHSA-qpx9-hpmf-5gmw) | | uuid | samples/typescript_sample | moderate | [uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided](GHSA-w5hq-g745-h8pq) | | webpack-dev-server | samples/typescript_sample | moderate | [webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser](GHSA-9jgg-88mc-972h) | | workbox-build | samples/typescript_sample | high | - | | workbox-webpack-plugin | samples/typescript_sample | high | - | | braces | . | high | [Uncontrolled resource consumption in braces](GHSA-grv7-fg5c-xmjg) | | micromatch | . | moderate | [Regular Expression Denial of Service (ReDoS) in micromatch](GHSA-952p-6rrq-rcjv) | | @eslint/plugin-kit | . | low | [Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit](GHSA-7q7g-4xm8-89cq) | | @eslint/plugin-kit | . | low | [@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser](GHSA-xffm-g5w8-qvg7) | | tmp | . | low | [tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter](GHSA-52f5-9888-hmc6) | | postcss | . | moderate | [PostCSS line return parsing error](GHSA-7fh5-64p2-3v2j) | | @remix-run/router | . | high | [React Router vulnerable to XSS via Open Redirects](GHSA-2w69-qvjg-hvjx) | | react-router | . | moderate | [React Router has unexpected external redirect via untrusted paths](GHSA-9jcx-v3wj-wh4m) | | tar | . | high | [node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal](GHSA-34x7-hfp2-rc4v) | | tar | . | high | [node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization](GHSA-8qq5-rm4j-mr97) | | tar | . | high | [Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction](GHSA-83g3-92jg-28cx) | | tar | . | high | [tar has Hardlink Path Traversal via Drive-Relative Linkpath](GHSA-qffp-2rhf-9h96) | | tar | . | high | [node-tar Symlink Path Traversal via Drive-Relative Linkpath](GHSA-9ppj-qmqm-q256) | | tar | . | high | [Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS](GHSA-r6q2-hw4h-h46w) | | postcss | . | moderate | [PostCSS has XSS via Unescaped </style> in its CSS Stringify Output](GHSA-qx2v-qp2m-jg93) | | ip-address | . | moderate | [ip-address has XSS in Address6 HTML-emitting methods](GHSA-v2v4-37r5-5v8g) | | uuid | . | moderate | [uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided](GHSA-w5hq-g745-h8pq) | | tmp | . | high | [tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape](GHSA-ph9p-34f9-6g65) | | tar | . | moderate | [node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)](GHSA-vmf3-w455-68vh) | | tar | . | moderate | [node-tar: Process crash via PAX numeric path type confusion](GHSA-w8wr-v893-vjvp) | | tar | . | critical | [node-tar: Decompression/parse DoS via unlimited input](GHSA-23hp-3jrh-7fpw) | | tar | . | high | [node-tar: Negative tar entry size causes infinite loop in archive replace](GHSA-8x88-c5mf-7j5w) | | tar | . | moderate | [node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records](GHSA-gvwx-54wh-qm9j) | | postcss | . | high | [PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments](GHSA-6g55-p6wh-862q) | | react-router | . | moderate | [React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)](GHSA-wrjc-x8rr-h8h6) | | react-router | . | moderate | [React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration](GHSA-337j-9hxr-rhxg) | | tar | . | moderate | [node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection](GHSA-r292-9mhp-454m) | | postcss | . | high | [PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure](GHSA-r28c-9q8g-f849) | | postcss | . | moderate | [PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset](GHSA-fxqj-rqcc-2cmp) | | ip-address | . | high | [ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass](GHSA-mwp4-54f8-5fhr) | | @remix-run/router | . | moderate | [React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation](GHSA-2j2x-hqr9-3h42) | | react-router | . | moderate | [React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation](GHSA-2j2x-hqr9-3h42) | ## Changed files `samples/groupchannel/package-lock.json, samples/openchannel/package-lock.json, samples/router/package-lock.json, samples/typescript_sample/package-lock.json` ## Review checklist - [ ] Verify no breaking changes in updated dependencies - [ ] Confirm CI passes