Repository navigation
Open source code package in a code repository causing multiple Critical/High exploitable vulnerabilities #12
Description
Activity
Snoozed for 45 days. The Wiz posture issue
793e181d-…resurfaces after 2026-11-22.Wiz doesn't say which package this finding flags, and its siblings #11 and #13 have identical text. On
main, the JWT chain (jsonwebtoken8.5.1,jws3.2.2) is the only high-severity issue in the shippeddist/bundle. #14 fixes it with a lockfile-only refresh. Every other high advisory is in dev-only lint and format tooling (xo, the eslint plugins,prettier-plugin-packagejson). Those are DoS/ReDoS-class bugs that only process the repo's own sources. #13 has the full breakdown, including why a blanketyarn upgradeisn't a clean fix.Re-evaluate once #14 has merged and Wiz has rescanned.
🔐 Security Remediation Task: Open source code package in a code repository causing multiple Critical/High exploitable vulnerabilities
stroeer/github-app-token/maingithub.com##stroeer/github-app-token##mainFinding
The following code branch contains an open source code package which is responsible for multiple Critical/ High vulnerabilities in code. Please review the relevant file path and relevant package for an update to resolve the vulnerabilities.
Code vulnerabilities with this severity should be addressed in the specific SLA below
🤖 Green Agent
View Wiz Issue
Wiz Issue ID: 793e181d-1e96-487e-9b7d-4bb37b66bb36
Source Workflow: Wiz Issues → GitHub (Green Agent)