User tests: Successful: Unsuccessful:
Pull Request for Issue # .
This pull request (PR) fixes two high severity security vulnerability in NPM development dependencies reported by npm audit by using npm audit fix.
It needs a development environment with a git clone, composer and npm.
composer install and npm ci.npm audit.# npm audit report
systeminformation <5.27.14
Severity: high
systeminformation has a Command Injection vulnerability in fsSize() function on Windows - https://github.com/advisories/GHSA-wphj-fx3q-84ch
fix available via `npm audit fix`
node_modules/systeminformation
cypress 15.1.0 - 15.8.0
Depends on vulnerable versions of systeminformation
node_modules/cypress
tinymce <7.0.0
Severity: moderate
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
fix available via `npm audit fix --force`
Will install tinymce@8.3.1, which is a breaking change
node_modules/tinymce
3 vulnerabilities (1 moderate, 2 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
# npm audit report
tinymce <7.0.0
Severity: moderate
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
fix available via `npm audit fix --force`
Will install tinymce@8.3.1, which is a breaking change
node_modules/tinymce
1 moderate severity vulnerability
To address all issues (including breaking changes), run:
npm audit fix --force
Please select:
Documentation link for docs.joomla.org:
No documentation changes for docs.joomla.org needed
Pull Request link for manual.joomla.org:
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
| Category | ⇒ | NPM Change |
I have tested this item ✅ successfully on aef84ac
2 high vulnerabilities cleared
1 moderate remaining
| Status | Pending | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2025-12-19 13:37:04 |
| Closed_By | ⇒ | richard67 | |
| Labels |
Added:
NPM Resource Changed
bug
PR-5.4-dev
|
||
I have tested this item ✅ successfully on aef84ac
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46590.