Libraries with known vulnerabilities
Outdated JavaScript packages in your app that have published security flaws.
Where it shows up: Any frontend
Last updated
What it is
AI tools install packages from memory, and that memory can be a year or two old. Old versions often have security flaws that were fixed long ago.
Some of these flaws are harmless in practice. Others let an attacker run code in your users' browsers.
What an attacker sees
Known vulnerabilities come with public write-ups. Anyone who can see which version you run can look up what's wrong with it.
How to fix it
Paste this into your AI tool:
Update the vulnerable libraries in my app to versions that fix the known security issues. Check for breaking changes in each update and adjust my code if needed.
Or by hand:
- Update each flagged package to a fixed version.
- Run your app and tests to catch breaking changes.
- Re-scan to confirm.
Check your app
Shippable detects the libraries and versions in your site's code and checks them against the OSV vulnerability database.
Scan your dev server before you push. No account needed:
Or scan your live app in the browser: