Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#48847] - [5.4] NPM updates 2026-11-12

NPM Resource Changed PR-5.4-dev Pending

User tests: Successful: Unsuccessful:

avatar richard67
richard67
12 Nov 2026

Pull Request resolves # .

  • I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

This pull request (PR) fixes 2 low, 3 moderate and 1 high severity security vulnerabilities in development dependencies reported by npm audit by using npm audit fix.

In addition, version requirements in the package.json file are updated to the versions in the package-lock.json file.

Testing Instructions

It needs a development environment with a git clone, composer and npm.

If not done before, run composer install and npm ci.

  1. Run npm audit to check all dependencies and check the result.
  2. Run npm audit --omit dev to check only non-development dependencies and check the result.

Actual result BEFORE applying this Pull Request

  1. npm audit
# npm audit report

deepmerge  >=4.2.0
deepmerge mergeObject() allows prototype poisoning of returned objects - https://github.com/advisories/GHSA-gcqx-w48m-w2h4
fix available via `npm audit fix --force`
Will install @rollup/plugin-node-resolve@7.1.3, which is a breaking change
node_modules/deepmerge
  @rollup/plugin-node-resolve  >=8.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/@rollup/plugin-node-resolve
  choices.js  7.1.3 - 10.2.0
  Depends on vulnerable versions of deepmerge
  node_modules/choices.js
  shepherd.js  7.2.0 - 12.0.0-alpha.13
  Depends on vulnerable versions of deepmerge
  node_modules/shepherd.js
  vuex-persist  >=3.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/vuex-persist

extract-zip  *
Severity: high
extract-zip unvalidated symlink path traversal - https://github.com/advisories/GHSA-jmr9-qjv8-65gv
extract-zip allows arbitrary file writes through symlink archive entries - https://github.com/advisories/GHSA-7pqw-9j4j-h8q3
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/extract-zip
  cypress  0.9.1 - 15.15.0
  Depends on vulnerable versions of @cypress/request
  Depends on vulnerable versions of extract-zip
  node_modules/joomla-cypress/node_modules/cypress
    joomla-cypress  1.1.0 - 1.3.1
    Depends on vulnerable versions of cypress
    node_modules/joomla-cypress

fast-xml-parser  <=5.11.2
fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags - https://github.com/advisories/GHSA-474x-hrwr-fgx4
fix available via `npm audit fix`
node_modules/fast-xml-parser
  @aws-sdk/xml-builder  3.894.0 - 3.972.30
  Depends on vulnerable versions of fast-xml-parser
  node_modules/@aws-sdk/xml-builder

glob  9.0.0 - 14.0.1
Severity: moderate
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal - https://github.com/advisories/GHSA-3g3m-2fjr-6pw4
Depends on vulnerable versions of minimatch
fix available via `npm audit fix`
node_modules/glob
  rimraf  4.2.0 - 6.1.3
  Depends on vulnerable versions of glob
  node_modules/rimraf

minimatch  7.0.0 - 11.0.0
Severity: moderate
minimatch has potential denial of service via globparts amplification - https://github.com/advisories/GHSA-g3hv-75wg-m249
fix available via `npm audit fix`
node_modules/glob/node_modules/minimatch

qs  2.2.5 - 6.16.0
Severity: moderate
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
qs array-limit bypass via bracket-key comma parsing - https://github.com/advisories/GHSA-x5fp-wj9c-mxmx
qs: Denial of Service via Attacker Controlled isBuffer - https://github.com/advisories/GHSA-4mjr-xmp4-gh2g
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) - https://github.com/advisories/GHSA-6pq8-jhm2-2vcw
fix available via `npm audit fix`
node_modules/cypress/node_modules/qs
node_modules/qs

systeminformation  <=5.33.15
Severity: high
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net - https://github.com/advisories/GHSA-4vjg-vx72-qq4g
systeminformation has prototype pollution in `networkStats()` via the interface name - https://github.com/advisories/GHSA-7648-jmwf-vw7j
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks - https://github.com/advisories/GHSA-3f7j-7jwc-fxfj
fix available via `npm audit fix`
node_modules/systeminformation

tinymce  <=7.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - https://github.com/advisories/GHSA-mh5m-5hw4-5c69
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - https://github.com/advisories/GHSA-vg35-5wq7-3x7w
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - https://github.com/advisories/GHSA-q742-qvgc-gc2f
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - https://github.com/advisories/GHSA-v98h-vmpc-fpqv
fix available via `npm audit fix --force`
Will install tinymce@8.10.2, which is a breaking change
node_modules/tinymce

uuid  <11.1.1
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/uuid
  @cypress/request  <=3.0.10
  Depends on vulnerable versions of uuid
  node_modules/@cypress/request

18 vulnerabilities (7 low, 6 moderate, 5 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force
  1. npm audit --omit dev
# npm audit report

deepmerge  >=4.2.0
deepmerge mergeObject() allows prototype poisoning of returned objects - https://github.com/advisories/GHSA-gcqx-w48m-w2h4
fix available via `npm audit fix --force`
Will install vuex-persist@2.3.0, which is a breaking change
node_modules/deepmerge
  choices.js  7.1.3 - 10.2.0
  Depends on vulnerable versions of deepmerge
  node_modules/choices.js
  shepherd.js  7.2.0 - 12.0.0-alpha.13
  Depends on vulnerable versions of deepmerge
  node_modules/shepherd.js
  vuex-persist  >=3.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/vuex-persist

tinymce  <=7.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - https://github.com/advisories/GHSA-mh5m-5hw4-5c69
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - https://github.com/advisories/GHSA-vg35-5wq7-3x7w
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - https://github.com/advisories/GHSA-q742-qvgc-gc2f
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - https://github.com/advisories/GHSA-v98h-vmpc-fpqv
fix available via `npm audit fix --force`
Will install tinymce@8.10.2, which is a breaking change
node_modules/tinymce

5 vulnerabilities (4 low, 1 high)

To address all issues (including breaking changes), run:
  npm audit fix --force

Expected result AFTER applying this Pull Request

  1. npm audit
# npm audit report

deepmerge  >=4.2.0
deepmerge mergeObject() allows prototype poisoning of returned objects - https://github.com/advisories/GHSA-gcqx-w48m-w2h4
fix available via `npm audit fix --force`
Will install @rollup/plugin-node-resolve@7.1.3, which is a breaking change
node_modules/deepmerge
  @rollup/plugin-node-resolve  >=8.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/@rollup/plugin-node-resolve
  choices.js  7.1.3 - 10.2.0
  Depends on vulnerable versions of deepmerge
  node_modules/choices.js
  shepherd.js  7.2.0 - 12.0.0-alpha.13
  Depends on vulnerable versions of deepmerge
  node_modules/shepherd.js
  vuex-persist  >=3.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/vuex-persist

extract-zip  *
Severity: high
extract-zip unvalidated symlink path traversal - https://github.com/advisories/GHSA-jmr9-qjv8-65gv
extract-zip allows arbitrary file writes through symlink archive entries - https://github.com/advisories/GHSA-7pqw-9j4j-h8q3
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/extract-zip
  cypress  0.9.1 - 15.15.0
  Depends on vulnerable versions of @cypress/request
  Depends on vulnerable versions of extract-zip
  node_modules/joomla-cypress/node_modules/cypress
    joomla-cypress  1.1.0 - 1.3.1
    Depends on vulnerable versions of cypress
    node_modules/joomla-cypress

qs  2.2.5 - 6.16.0
Severity: moderate
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set - https://github.com/advisories/GHSA-q8mj-m7cp-5q26
qs array-limit bypass via bracket-key comma parsing - https://github.com/advisories/GHSA-x5fp-wj9c-mxmx
qs: Denial of Service via Attacker Controlled isBuffer - https://github.com/advisories/GHSA-4mjr-xmp4-gh2g
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) - https://github.com/advisories/GHSA-6pq8-jhm2-2vcw
fix available via `npm audit fix`
node_modules/qs

tinymce  <=7.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - https://github.com/advisories/GHSA-mh5m-5hw4-5c69
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - https://github.com/advisories/GHSA-vg35-5wq7-3x7w
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - https://github.com/advisories/GHSA-q742-qvgc-gc2f
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - https://github.com/advisories/GHSA-v98h-vmpc-fpqv
fix available via `npm audit fix --force`
Will install tinymce@8.10.2, which is a breaking change
node_modules/tinymce

uuid  <11.1.1
Severity: moderate
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq
fix available via `npm audit fix --force`
Will install joomla-cypress@2.0.0, which is a breaking change
node_modules/uuid
  @cypress/request  <=3.0.10
  Depends on vulnerable versions of uuid
  node_modules/@cypress/request

12 vulnerabilities (5 low, 3 moderate, 4 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force
  1. npm audit --omit dev
# npm audit report

deepmerge  >=4.2.0
deepmerge mergeObject() allows prototype poisoning of returned objects - https://github.com/advisories/GHSA-gcqx-w48m-w2h4
fix available via `npm audit fix --force`
Will install shepherd.js@16.0.0, which is a breaking change
node_modules/deepmerge
  choices.js  7.1.3 - 10.2.0
  Depends on vulnerable versions of deepmerge
  node_modules/choices.js
  shepherd.js  7.2.0 - 12.0.0-alpha.13
  Depends on vulnerable versions of deepmerge
  node_modules/shepherd.js
  vuex-persist  >=3.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/vuex-persist

tinymce  <=7.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - https://github.com/advisories/GHSA-mh5m-5hw4-5c69
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - https://github.com/advisories/GHSA-vg35-5wq7-3x7w
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - https://github.com/advisories/GHSA-q742-qvgc-gc2f
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments - https://github.com/advisories/GHSA-v98h-vmpc-fpqv
fix available via `npm audit fix --force`
Will install tinymce@8.10.2, which is a breaking change
node_modules/tinymce

5 vulnerabilities (4 low, 1 high)

To address all issues (including breaking changes), run:
  npm audit fix --force

Link to documentations

Please select:

  • Documentation link for guide.joomla.org:

  • No documentation changes for guide.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar richard67 richard67 - open - 12 Nov 2026
avatar richard67 richard67 - change - 12 Nov 2026
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 12 Nov 2026
Category ⇒ NPM Change
avatar richard67 richard67 - change - 12 Nov 2026
Labels Added: NPM Resource Changed PR-5.4-dev
avatar muhme muhme - close - 13 Nov 2026
avatar muhme muhme - merge - 13 Nov 2026
avatar muhme muhme - change - 13 Nov 2026
Status Pending ⇒ Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 ⇒ 2026-11-13 07:02:14
Closed_By ⇒ muhme
avatar muhme
muhme - comment - 13 Nov 2026

Thank you very much @richard67 for your contribution.

Add a Comment

Login with GitHub to post a comment