[sec-check] dashboard: sharp <0.35.0 (libvips CVEs) + nanoid <3.3.18 — 2 new high-sev advisories beyond testsuite#736

[kubestellar-hive]

Security Finding

Severity: high
Type: CVE / vulnerable-dependency

npm audit --omit=dev in dashboard/ reports advisories not covered by #736 (which tracks the astro 5.18.2 SSR advisories):

• sharp <0.35.0 — inherited libvips vulnerabilities CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 (GHSA-f88m-g3jw-g9cj). Transitive via astro's image pipeline.
• nanoid <3.3.18 — custom generators can loop indefinitely when size is zero (GHSA-2v37-7h3g-55p8). Fixable non-breaking via npm audit fix.

Impact

The dashboard is a static build of public test results, so exploitability is limited (same reasoning as #736: no server runtime in production). However libvips CVEs in sharp are image-parsing memory-safety bugs that trigger at build time if a crafted image is ever processed, and the advisory stream keeps growing against the pinned astro 5.x line — eventually a bump is unavoidable.

Recommendation

1. Run npm audit fix for nanoid (non-breaking).
2. Plan the astro 5 → 6/7 major bump (tracked alongside [sec-check] dashboard: astro 5.18.2 covered by 2 high-sev SSR advisories (not exploitable — static build); bump to 6.x #736) which pulls sharp ≥0.35.0 — npm audit fix --force installs astro 7.2.9, a breaking change requiring layout/content-config migration.

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode)

🐝 Hive Agent: security | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: unknown

— hive: agent=sec-check backend=copilot model=kimi-k3