[sendbird-sdk-deployment]

Security Audit Report

Repository: sendbird/sendbird-uikit-react
Targets: samples/groupchannel (npm), samples/openchannel (npm), samples/router (npm), samples/typescript_sample (npm), . (yarn-berry)
Date: 2026-11-09

Summary

	Critical	High	Moderate	Low	Total
Before	7	32	42	23	104
Fixed	5	4	9	3	21
Remaining	2	28	33	20	83

Fixed Vulnerabilities

Package	Target	Severity	Detail
dompurify	samples/groupchannel	critical	DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
dompurify	samples/openchannel	critical	DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
dompurify	samples/router	critical	DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
dompurify	samples/typescript_sample	critical	DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
fast-uri	samples/typescript_sample	moderate	fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
follow-redirects	samples/typescript_sample	high	follow-redirects array-form headers bypass cross-origin credential stripping
glob	samples/typescript_sample	moderate	Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
launch-editor	samples/typescript_sample	high	launch-editor: escapeCmdArgs() omits % escaping on Windows
minimatch	samples/typescript_sample	moderate	minimatch has potential denial of service via globparts amplification
postcss-selector-parser	samples/typescript_sample	moderate	PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
qs	samples/typescript_sample	moderate	qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
sucrase	samples/typescript_sample	moderate	-
brace-expansion	.	high	brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
dompurify	.	critical	DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
dompurify	.	high	DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
dompurify	.	low	DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
fast-uri	.	moderate	fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
fast-uri	.	low	fast-uri vulnerable to improper path equivalence in relative reference normalization
fast-uri	.	moderate	fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
fast-uri	.	low	fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
postcss-selector-parser	.	moderate	PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Remaining Vulnerabilities (requires manual review)

Package	Target	Severity	Detail
react-router	samples/router	moderate	React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)
react-router-dom	samples/router	moderate	-
@jest/core	samples/typescript_sample	low	-
@rollup/plugin-node-resolve	samples/typescript_sample	low	-
@svgr/plugin-svgo	samples/typescript_sample	high	-
@svgr/webpack	samples/typescript_sample	low	-
@tootallnate/once	samples/typescript_sample	low	@tootallnate/once vulnerable to Incorrect Control Flow Scoping
bfj	samples/typescript_sample	high	-
body-parser	samples/typescript_sample	high	body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
css-minimizer-webpack-plugin	samples/typescript_sample	moderate	-
css-select	samples/typescript_sample	high	-
deepmerge	samples/typescript_sample	low	deepmerge mergeObject() allows prototype poisoning of returned objects
fork-ts-checker-webpack-plugin	samples/typescript_sample	low	-
http-proxy-agent	samples/typescript_sample	low	-
jest	samples/typescript_sample	low	-
jest-cli	samples/typescript_sample	low	-
jest-config	samples/typescript_sample	low	-
jest-environment-jsdom	samples/typescript_sample	low	-
jest-runner	samples/typescript_sample	low	-
jest-watch-typeahead	samples/typescript_sample	low	-
jsdom	samples/typescript_sample	low	-
jsonpath	samples/typescript_sample	high	-
node-forge	samples/typescript_sample	high	node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements
nth-check	samples/typescript_sample	high	Inefficient Regular Expression Complexity in nth-check
postcss	samples/typescript_sample	high	PostCSS line return parsing error
proxy-addr	samples/typescript_sample	critical	proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
react-dev-utils	samples/typescript_sample	low	-
react-scripts	samples/typescript_sample	moderate	-
resolve-url-loader	samples/typescript_sample	moderate	-
rollup-plugin-terser	samples/typescript_sample	high	-
serialize-javascript	samples/typescript_sample	high	Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
sockjs	samples/typescript_sample	moderate	-
svgo	samples/typescript_sample	high	SVGO removeScripts plugin leaves some executable scripts intact
underscore	samples/typescript_sample	high	Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
uuid	samples/typescript_sample	moderate	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
webpack-dev-server	samples/typescript_sample	moderate	webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser
workbox-build	samples/typescript_sample	high	-
workbox-webpack-plugin	samples/typescript_sample	low	-
braces	.	high	Uncontrolled resource consumption in braces
micromatch	.	moderate	Regular Expression Denial of Service (ReDoS) in micromatch
@eslint/plugin-kit	.	low	Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit
@eslint/plugin-kit	.	low	@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
tmp	.	low	tmp allows arbitrary temporary file / directory write via symbolic link dir parameter
postcss	.	moderate	PostCSS line return parsing error
@remix-run/router	.	high	React Router vulnerable to XSS via Open Redirects
react-router	.	moderate	React Router has unexpected external redirect via untrusted paths
tar	.	high	node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
tar	.	high	node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
tar	.	high	Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
tar	.	high	tar has Hardlink Path Traversal via Drive-Relative Linkpath
tar	.	high	node-tar Symlink Path Traversal via Drive-Relative Linkpath
tar	.	high	Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
postcss	.	moderate	PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
ip-address	.	moderate	ip-address has XSS in Address6 HTML-emitting methods
uuid	.	moderate	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
tmp	.	high	tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
tar	.	moderate	node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
tar	.	moderate	node-tar: Process crash via PAX numeric path type confusion
tar	.	critical	node-tar: Decompression/parse DoS via unlimited input
tar	.	high	node-tar: Negative tar entry size causes infinite loop in archive replace
tar	.	moderate	node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
postcss	.	high	PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
react-router	.	moderate	React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass)
react-router	.	moderate	React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
postcss	.	moderate	PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset
ip-address	.	high	ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
@remix-run/router	.	moderate	React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
react-router	.	moderate	React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
postcss	.	high	PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
tar	.	high	node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
decode-uri-component	.	moderate	decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
vitest	.	moderate	Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
@vitest/mocker	.	moderate	Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
ip-address	.	moderate	ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
ip-address	.	moderate	ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
ip-address	.	moderate	ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
brace-expansion	.	moderate	brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service
@vitest/mocker	.	moderate	Vitest: Code injection via unauthenticated manual mock registration
ip-address	.	moderate	ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
deepmerge	.	low	deepmerge mergeObject() allows prototype poisoning of returned objects
decode-uri-component	.	high	decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
glob	.	moderate	Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
minimatch	.	moderate	minimatch has potential denial of service via globparts amplification

Changed files

samples/groupchannel/package-lock.json, samples/openchannel/package-lock.json, samples/router/package-lock.json, samples/typescript_sample/package-lock.json, yarn.lock

Review checklist

• Verify no breaking changes in updated dependencies
• Confirm CI passes

[netlify]

✅ Deploy Preview for sendbird-uikit-react ready!

Name	Link
🔨 Latest commit	e1dcc41
🔍 Latest deploy log	https://app.netlify.com/projects/sendbird-uikit-react/deploys/6af1ac289b88c2bc68d6e760
😎 Deploy Preview	https://deploy-preview-1483--sendbird-uikit-react.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T11:21:24.517736Z	e1dcc41	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[upwind-code-us]

Upwind Code Scan - ⚠️ Warn

1 newly introduced vulnerabilities · 0 resolved · 45 total in this PR vs main

Total breakdown: 🔴 2 Critical | 🔶 16 High | 🟡 22 Medium | 🟢 5 Low

---

🔶 High · 1 finding

CVE	Package	Version	Fix
CVE-2024-21539	@eslint/plugin-kit	0.2.0	0.2.3

View full analysis in Upwind Console

Scan completed in 20s

Scan history (1 scan)

Commit	Scanned at	New	Resolved	Net
e1dcc41 <	2026-11-09 11:19 UTC	+1	0	+1

Last scanned: e1dcc41 · 2026-11-09 11:19 UTC

[upwind-code-us]

Upwind IaC Scan - ✅ Passed

0 newly introduced misconfigurations · 0 resolved · 0 total in this PR vs main

View full analysis in Upwind Console →

Scan completed in 22s

Scan history (1 scan)

Commit	Scanned at	New	Resolved	Net
e1dcc41 <	2026-11-09 11:19 UTC	0	0	0

Last scanned: e1dcc41 · 2026-11-09 11:19 UTC

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e1dcc41f21

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Raise the manifest's DOMPurify minimum

When this release is installed into a consumer whose lockfile already resolves DOMPurify 3.4.13–3.4.16, the security fix is not guaranteed to reach them: package.json:83 still declares ^3.4.13, so the existing vulnerable resolution remains valid, and rollup.config.mjs:55 externalizes DOMPurify rather than bundling this newly locked copy. Update the dependency declaration to require the first fixed version so consumers cannot retain a vulnerable version while upgrading UIKit.

Useful? React with 👍 / 👎.