[SECURITY][MEDIUM] 12 vulnerable build/dev dependencies — vite path bypass, postcss XSS, serve used in production

[LucasMaupin]

Summary

Running pnpm audit in open-live-studio reports 12 vulnerabilities in build and dev dependencies. Critically, the serve package (flagged for multiple issues) is used in the production start script (pnpm start), not just in development, making several of these production-impacting rather than dev-only.

CVSS Score

5.0 (Medium) — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N (postcss XSS chain)

Category

OWASP A06 — Vulnerable and Outdated Components

Affected File(s)

• package.json (vite, postcss, serve, fast-uri, brace-expansion, js-yaml, @babel/core)
• pnpm-lock.yaml

Key Vulnerabilities

Package	CVE/Advisory	Severity	Production?	Impact
vite ≤6.4.2	—	High	Dev + serve fallback	fs.deny bypass; launch-editor NTLMv2 hash disclosure
postcss <8.5.10	CVE-2026-41305	Medium	Yes (CSS pipeline)	XSS via unescaped </style> in output
fast-uri ≤3.1.1	—	High	Transitive	Host confusion + path traversal (via serve>ajv)
brace-expansion	—	Low	Dev	Large-numeric-range ReDoS
js-yaml ≤4.1.1	—	Medium	Dev (eslint)	Quadratic-complexity DoS
@babel/core ≤7.29.0	—	Medium	Dev	Arbitrary file read via sourceMappingURL
serve	Multiple	High	Yes (start script)	Various — see pnpm audit output

The serve package being the production HTTP server (used in pnpm start) is the biggest concern: it has no security headers and multiple known vulnerabilities, and is listed as a devDependency. The production Docker image uses nginx, so pnpm start should be removed or clearly labelled as dev-only.

Steps to Reproduce

cd open-live-studio
pnpm audit
# 12 vulnerabilities found

Remediation

1. Add pnpm.overrides to package.json:

{
  "pnpm": {
    "overrides": {
      "vite": ">=6.4.3",
      "postcss": ">=8.5.10",
      "fast-uri": ">=3.1.2",
      "brace-expansion": ">=5.0.6",
      "js-yaml": ">=4.2.0",
      "@babel/core": ">=7.29.6"
    }
  }
}

2. Remove or rename the pnpm start script to make it clear it's dev-only (pnpm preview). Production deployments should use the Docker image with nginx.

3. Add pnpm audit --audit-level=high as a CI gate.

References

• OWASP A06:2021 – Vulnerable and Outdated Components
• CVE-2026-41305 (postcss)

[LucasMaupin]

The biggest issue here is serve being listed as a devDependency but powering the production pnpm start script — that brings its vulnerabilities into the runtime path, not just the build. The Docker image already uses nginx with proper headers, so the right fix is removing or renaming the start script to preview and making it obvious it's dev-only. The pnpm.overrides in the issue covers the rest. Labelled bug and ready-for-dev. The security-engineer will track the individual CVEs.

[LucasMaupin]

PR opened: #85

Changes:

• Adds pnpm.overrides pinning vite, postcss, fast-uri, brace-expansion, js-yaml, and @babel/core to patched versions
• Moves serve from dependencies to devDependencies (production uses Docker/nginx)
• Renames start → start:local to make the dev-only nature explicit
• Adds .github/workflows/audit.yml running pnpm audit --audit-level=high as a CI gate on every dependency-touching PR and weekly