TryGhost/Ghost free scan: 15 vulnerable dependencies, 0 committed secrets

TryGhost/Ghost ↗ · 81292b0 · Aug 21, 2026, 10:19 PM

Hard evidence: 8 issues need attention now.

Free scan · deterministic evidence only

8 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.

500 of 8541 files scanned (5%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.

What this means

Two scanners read 500 of 8541 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 8 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.

Read it:

Packages you ship with known vulnerabilities

8 found · 7 packages

cvenpm image-size2 in 1 version

1.2.1 — GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr

image-size: JXL and HEIF parsers allow denial of service through infinite loops — HIGH

image-size: ICNS parser allows denial of service through an infinite loop — HIGH

cvenpm html-minifier@4.0.0GHSA-pfq8-rq6v-vf5m

kangax html-minifier REDoS vulnerability — HIGH

cvenpm js-yaml@4.3.0GHSA-5p4m-2wfm-xmqj

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — HIGH

cvenpm jsonwebtoken@8.5.1GHSA-8cf7-32gw-wr33

jsonwebtoken unrestricted key type could lead to legacy keys usage — HIGH

cvenpm nodemailer@8.0.11GHSA-p6gq-j5cr-w38f

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message — HIGH

cvenpm react-router@7.18.1GHSA-qwww-vcr4-c8h2

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response — HIGH

cvenpm validator@13.12.0GHSA-vghf-hv5q-vc2g

Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements — HIGH

Worth knowing, not blocking

29 found · 5 files · 4 packages · 22 in tests

Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

test fixtureGeneric hardcoded secret20 in 4 files

apps/admin-x-framework/src/test/msw-utils.ts:127

:127 — token:…ing', — non-production path

apps/admin-x-framework/test/unit/api/tinybird.test.tsx:57, :64, :74, :86, :87, :97, :104, :120, :135, :143, :151, :160

:57 — json: { tinybird: { token:…123' } }, — non-production path

:64 — expect(result.current.data).toEqual({ tinybird: { token:…123' } }); — non-production path

:74 — json: { tinybird: { token:…ken' } }, — non-production path

:86 — expect(result1.current.data).toEqual({ tinybird: { token:…ken' } }); — non-production path

:87 — expect(result2.current.data).toEqual({ tinybird: { token:…ken' } }); — non-production path

:97 — json: { tinybird: { token:…ken' } }, — non-production path

:104 — expect(result.current.data).toEqual({ tinybird: { token:…ken' } }); — non-production path

:120 — json: { tinybird: { token:…ken' } }, — non-production path

:135 — expect(result2.current.data).toEqual({ tinybird: { token:…ken' } }); — non-production path

:143 — json: { tinybird: { token:…ken' } }, — non-production path

:151 — expect(result.current.data).toEqual({ tinybird: { token:…ken' } }); — non-production path

:160 — json: { tinybird: { token:…ken' } }, — non-production path

apps/admin-x-framework/test/unit/hooks/use-active-visitors.test.ts:451

:451 — token:…ken', — non-production path

apps/admin-x-framework/test/unit/hooks/use-tinybird-token.test.tsx:50, :80, :164, :189, :249, :281

:50 — data: { tinybird: { token:…123' } }, — non-production path

:80 — data: { tinybird: { token:…ken' } }, — non-production path

:164 — data: { tinybird: { token:…ken' } }, — non-production path

:189 — data: { tinybird: { token:…ken' } }, — non-production path

:249 — data: { tinybird: { token:…ken' } }, — non-production path

:281 — data: { tinybird: { token:…ken' } }, — non-production path

advisoryStripe Restricted Key.secretlintrc.json:19

"rk_liv…WXYZ", — non-production path

advisoryStripe Secret Key.secretlintrc.json:20

"sk_liv…WXYZ" — non-production path

moderate cvenpm hono3 in 1 version

4.12.18 — GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-54fx-42gc-7vw4

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths — MODERATE

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection — MODERATE

Hono: Algorithmic Complexity DoS in Language Middleware — MODERATE

moderate cvenpm jsonwebtoken2 in 1 version

8.5.1 — GHSA-hjrf-2m68-5959, GHSA-qwph-4952-7xr6

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC — MODERATE

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() — MODERATE

moderate cvenpm express-brute@1.0.1GHSA-984p-xq9m-4rjw

Rate Limiting Bypass in express-brute — MODERATE

moderate cvenpm validator@13.12.0GHSA-9965-vmph-33xx

validator.js has a URL validation bypass vulnerability in its isURL function — MODERATE

AI audit · TryGhost/Ghost · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inThe free scan stays unlimited

14 things unaudited

Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 500 of 8541 files (highest-priority subset) · TryGhost/Ghost
Dependency manifests: 57 package roots found, 13 scanned — package list truncated at the vulnerability-lookup limit.

README badge

[![nittim](https://nittim.com/api/badge/TryGhost/Ghost)](https://nittim.com/library/TryGhost/Ghost)