Repository navigation
apollon-3.3.5.tgz: 1 vulnerabilities (highest severity is: 9.8) #446
Description
Vulnerable Library - apollon-3.3.5.tgz
Sample Path to Dependency File: /playground/package.json
Path to vulnerable library: /playground/package.json
Found in HEAD commit: 2c2e4a13b710ceb8f65cd32664895e4278834389
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (apollon version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2026-41907 |  Critical |
9.8 | uuid-7.0.3.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-41907
Vulnerable Library - uuid-7.0.3.tgz
RFC4122 (v1, v4, and v5) UUIDs
Library home page: https://registry.npmjs.org/uuid/-/uuid-7.0.3.tgz
Sample Path to Dependency File: /playground/package.json
Path to vulnerable library: /playground/package.json
Dependency Hierarchy:
- apollon-3.3.5.tgz (Root Library)
- react-tooltip-4.5.1.tgz
- ❌ uuid-7.0.3.tgz (Vulnerable Library)
- react-tooltip-4.5.1.tgz
Found in HEAD commit: 2c2e4a13b710ceb8f65cd32664895e4278834389
Found in base branch: develop
Vulnerability Details
uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.
Publish Date: 2026-04-24
URL: CVE-2026-41907
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Step up your Open Source Security Game with Mend here
Activity
[-]apollon-3.3.5.tgz: 1 vulnerabilities (highest severity is: 9.8)[/-][+]apollon-3.3.5.tgz: 1 vulnerabilities (highest severity is: 9.8) - autoclosed[/+]mend-bolt-for-github commentedon May 19, 2026
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
[-]apollon-3.3.5.tgz: 1 vulnerabilities (highest severity is: 9.8) - autoclosed[/-][+]apollon-3.3.5.tgz: 1 vulnerabilities (highest severity is: 9.8)[/+]mend-bolt-for-github commentedon May 22, 2026
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.