Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#48659] - [5.4] NPM updates 2026-10-24

NPM Resource Changed PR-5.4-dev Pending

User tests: Successful: Unsuccessful:

avatar richard67
richard67
20 Oct 2026

Pull Request resolves # .

  • I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

This pull request (PR) fixes 6 moderate security vulnerabilities in development and 3 high severity security vulnerabilities in non-development dependencies reported by npm audit by using npm audit fix.

In addition, version requirements in the package.json file are updated to the versions in the package-lock.json file.

Testing Instructions

It needs a development environment with a git clone, composer and npm.

If not done before, run composer install and npm ci.

  1. Run npm audit to check all dependencies and check the result.
  2. Run npm audit --omit dev to check only non-development dependencies and check the result.

Actual result BEFORE applying this Pull Request

  1. npm audit
# npm audit report

@vue/server-renderer  <=3.5.41
Severity: high
@vue/server-renderer: XSS via missing CR in attribute-name blacklist - https://github.com/advisories/GHSA-g2v6-rqmx-r4w6
Depends on vulnerable versions of vue
fix available via `npm audit fix`
node_modules/@vue/server-renderer
  vue  3.2.13 - 3.5.41
  Depends on vulnerable versions of @vue/server-renderer
  node_modules/vue

extract-zip  *
Severity: high
extract-zip unvalidated symlink path traversal - https://github.com/advisories/GHSA-jmr9-qjv8-65gv
extract-zip allows arbitrary file writes through symlink archive entries - https://github.com/advisories/GHSA-7pqw-9j4j-h8q3
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/extract-zip
  cypress  0.9.1 - 15.15.0
  Depends on vulnerable versions of @cypress/request
  Depends on vulnerable versions of extract-zip
  node_modules/joomla-cypress/node_modules/cypress
    joomla-cypress  1.1.0 - 1.3.1
    Depends on vulnerable versions of cypress
    node_modules/joomla-cypress

fast-uri  3.0.0 - 3.1.8
Severity: moderate
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding - https://github.com/advisories/GHSA-w74x-v6f9-j3xg
fast-uri vulnerable to improper path equivalence in relative reference normalization - https://github.com/advisories/GHSA-xhq7-xmqj-769h
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization - https://github.com/advisories/GHSA-wjr9-j795-jxcr
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references - https://github.com/advisories/GHSA-333x-w4r6-6crp
fix available via `npm audit fix`
node_modules/fast-uri

nodemailer  3.0.0 - 10.1.3
Severity: moderate
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient - https://github.com/advisories/GHSA-8c8m-p3m8-cjg8
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient - https://github.com/advisories/GHSA-m943-m63m-w62w
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name - https://github.com/advisories/GHSA-85x2-q946-cp5h
fix available via `npm audit fix`
node_modules/nodemailer
  mailparser  2.3.1 - 3.9.42
  Depends on vulnerable versions of nodemailer
  node_modules/mailparser
  smtp-server  2.0.0 - 3.19.23
  Depends on vulnerable versions of nodemailer
  node_modules/smtp-server

postcss-selector-parser  <7.1.6
Severity: moderate
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion - https://github.com/advisories/GHSA-rj75-hqrm-r3gf
fix available via `npm audit fix`
node_modules/eslint-plugin-vue/node_modules/postcss-selector-parser
  eslint-plugin-vue  8.7.0 - 10.5.1
  Depends on vulnerable versions of postcss-selector-parser
  node_modules/eslint-plugin-vue

qs  2.2.5 - 6.15.3
Severity: moderate
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
qs array-limit bypass via bracket-key comma parsing - https://github.com/advisories/GHSA-x5fp-wj9c-mxmx
qs: Denial of Service via Attacker Controlled isBuffer - https://github.com/advisories/GHSA-4mjr-xmp4-gh2g
fix available via `npm audit fix`
node_modules/qs

source-map-js  1.0.0 - 1.2.1
Severity: high
source-map-js allows event-loop denial of service through indexed source-map section offsets - https://github.com/advisories/GHSA-68fv-2mgg-jv7q
fix available via `npm audit fix`
node_modules/source-map-js

tinymce  <=7.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - https://github.com/advisories/GHSA-mh5m-5hw4-5c69
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - https://github.com/advisories/GHSA-vg35-5wq7-3x7w
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - https://github.com/advisories/GHSA-q742-qvgc-gc2f
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - https://github.com/advisories/GHSA-v98h-vmpc-fpqv
fix available via `npm audit fix --force`
Will install tinymce@8.10.0, which is a breaking change
node_modules/tinymce

uuid  <11.1.1
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/uuid
  @cypress/request  <=3.0.10
  Depends on vulnerable versions of uuid
  node_modules/@cypress/request

16 vulnerabilities (9 moderate, 7 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force
  1. npm audit --omit dev
# npm audit report

@vue/server-renderer  <=3.5.41
Severity: high
@vue/server-renderer: XSS via missing CR in attribute-name blacklist - https://github.com/advisories/GHSA-g2v6-rqmx-r4w6
Depends on vulnerable versions of vue
fix available via `npm audit fix`
node_modules/@vue/server-renderer
  vue  3.2.13 - 3.5.41
  Depends on vulnerable versions of @vue/server-renderer
  node_modules/vue

source-map-js  1.0.0 - 1.2.1
Severity: high
source-map-js allows event-loop denial of service through indexed source-map section offsets - https://github.com/advisories/GHSA-68fv-2mgg-jv7q
fix available via `npm audit fix`
node_modules/source-map-js

tinymce  <=7.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - https://github.com/advisories/GHSA-mh5m-5hw4-5c69
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - https://github.com/advisories/GHSA-vg35-5wq7-3x7w
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - https://github.com/advisories/GHSA-q742-qvgc-gc2f
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - https://github.com/advisories/GHSA-v98h-vmpc-fpqv
fix available via `npm audit fix --force`
Will install tinymce@8.10.0, which is a breaking change
node_modules/tinymce

4 high severity vulnerabilities

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Expected result AFTER applying this Pull Request

  1. npm audit
# npm audit report

extract-zip  *
Severity: high
extract-zip unvalidated symlink path traversal - https://github.com/advisories/GHSA-jmr9-qjv8-65gv
extract-zip allows arbitrary file writes through symlink archive entries - https://github.com/advisories/GHSA-7pqw-9j4j-h8q3
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/extract-zip
  cypress  0.9.1 - 15.15.0
  Depends on vulnerable versions of @cypress/request
  Depends on vulnerable versions of extract-zip
  node_modules/joomla-cypress/node_modules/cypress
    joomla-cypress  1.1.0 - 1.3.1
    Depends on vulnerable versions of cypress
    node_modules/joomla-cypress

qs  2.2.5 - 6.15.3
Severity: moderate
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
qs array-limit bypass via bracket-key comma parsing - https://github.com/advisories/GHSA-x5fp-wj9c-mxmx
qs: Denial of Service via Attacker Controlled isBuffer - https://github.com/advisories/GHSA-4mjr-xmp4-gh2g
fix available via `npm audit fix`
node_modules/qs

tinymce  <=7.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - https://github.com/advisories/GHSA-mh5m-5hw4-5c69
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - https://github.com/advisories/GHSA-vg35-5wq7-3x7w
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - https://github.com/advisories/GHSA-q742-qvgc-gc2f
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - https://github.com/advisories/GHSA-v98h-vmpc-fpqv
fix available via `npm audit fix --force`
Will install tinymce@8.10.0, which is a breaking change
node_modules/tinymce

uuid  <11.1.1
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/uuid
  @cypress/request  <=3.0.10
  Depends on vulnerable versions of uuid
  node_modules/@cypress/request

7 vulnerabilities (3 moderate, 4 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force
  1. npm audit --omit dev
# npm audit report

tinymce  <=7.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - https://github.com/advisories/GHSA-mh5m-5hw4-5c69
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - https://github.com/advisories/GHSA-vg35-5wq7-3x7w
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - https://github.com/advisories/GHSA-q742-qvgc-gc2f
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - https://github.com/advisories/GHSA-v98h-vmpc-fpqv
fix available via `npm audit fix --force`
Will install tinymce@8.10.0, which is a breaking change
node_modules/tinymce

1 high severity vulnerability

To address all issues (including breaking changes), run:
  npm audit fix --force

Link to documentations

Please select:

  • Documentation link for guide.joomla.org:

  • No documentation changes for guide.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar richard67 richard67 - open - 20 Oct 2026
avatar richard67 richard67 - change - 20 Oct 2026
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 20 Oct 2026
Category ⇒ NPM Change
avatar richard67 richard67 - change - 20 Oct 2026
The description was changed
avatar richard67 richard67 - edited - 20 Oct 2026
avatar richard67 richard67 - change - 20 Oct 2026
The description was changed
avatar richard67 richard67 - edited - 20 Oct 2026
avatar richard67 richard67 - change - 20 Oct 2026
The description was changed
avatar richard67 richard67 - edited - 20 Oct 2026
avatar richard67 richard67 - change - 20 Oct 2026
The description was changed
avatar richard67 richard67 - edited - 20 Oct 2026
avatar richard67 richard67 - change - 24 Oct 2026
Labels Added: NPM Resource Changed PR-5.4-dev
avatar richard67 richard67 - change - 24 Oct 2026
The description was changed
avatar richard67 richard67 - edited - 24 Oct 2026
avatar richard67 richard67 - change - 24 Oct 2026
The description was changed
avatar richard67 richard67 - edited - 24 Oct 2026
avatar richard67 richard67 - change - 24 Oct 2026
Title
…
[5.4] [WiP] NPM updates 2026-10-20
[5.4] [WiP] NPM updates 2026-10-24
avatar richard67 richard67 - edited - 24 Oct 2026
avatar richard67 richard67 - change - 24 Oct 2026
Title
…
[5.4] [WiP] NPM updates 2026-10-24
[5.4] NPM updates 2026-10-24
avatar richard67 richard67 - edited - 24 Oct 2026
avatar richard67 richard67 - change - 24 Oct 2026
The description was changed
avatar richard67 richard67 - edited - 24 Oct 2026
avatar richard67 richard67 - change - 26 Oct 2026
The description was changed
avatar richard67 richard67 - edited - 26 Oct 2026
avatar muhme muhme - change - 27 Oct 2026
Status Pending ⇒ Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 ⇒ 2026-10-27 07:19:50
Closed_By ⇒ muhme
avatar muhme muhme - close - 27 Oct 2026
avatar muhme muhme - merge - 27 Oct 2026
avatar muhme
muhme - comment - 27 Oct 2026

Thank you very much @richard67 for your contribution.

Add a Comment

Login with GitHub to post a comment