Dependency with a known vulnerability

ExplainWhat it is

OSV (osv.dev) is an open database of published vulnerabilities that gathers advisories from GitHub, npm and other sources, keyed by package and version. PL-023 means a package version pinned in your lockfile appears in one of those advisories. The report shows the package, the installed version, the advisory and, where the advisory names one, the version that fixes it.

A match means the version is affected. It doesn't prove your app reaches the vulnerable code. A cross-site scripting bug in a Markdown library matters if you render user content with it; a bug in a build tool's development server rarely matters in production. The advisory text usually says which conditions apply.

CauseWhy AI builders produce it

AI builders start from templates and pin whatever versions the template or the model knew, which can be well behind the current release. Nobody runs an audit on a project that works, and the lockfile quietly keeps old versions of packages you never installed directly.

ExploitExample of vulnerable code

Simplified from the patterns we see in AI-built apps. Synthetic: not taken from any real app.

// package.json
{
  "dependencies": {
    "lodash": "4.17.20"
  }
}
// lodash 4.17.20 is affected by CVE-2021-23337
// (command injection through _.template), fixed in 4.17.21

CheckCheck it yourself

# npm's own audit, from the lockfile (production dependencies only)
npm audit --omit=dev

# Ask OSV about one package version directly
curl -s https://api.osv.dev/v1/query \
  -d '{"package":{"name":"lodash","ecosystem":"npm"},"version":"4.17.20"}' | head -c 600

FixThe fix

# A direct dependency: upgrade to the fixed version
npm install lodash@4.17.21

# A dependency of a dependency: force a fixed version (npm 8.3 or later)
# package.json
"overrides": {
  "lodash": "4.17.21"
}

Run your tests after any upgrade, especially across a major version. npm audit fix applies the safe upgrades for you; avoid --force unless you have read what it will change.

Code findings come with the file, the line and a one-line fix in the report, for your engineer to make. PatchLabs never pushes to your repo.

ProveHow PatchLabs finds it

[SCAN]    package-lock.json
          lodash 4.17.20              LEAK
          CVE-2021-23337 · fixed 4.17.21
[OSV]     checked against osv.dev
          offline: reported as skipped

PatchLabs Code reads exact versions from package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock or bun.lock, or exact versions in package.json when there is no lockfile. It never installs packages or runs your code. Package names and versions, and nothing else from your repo, are sent to the public OSV API. If OSV can't be reached, the dependency check is reported as skipped rather than as clean.

IntentWhen the pattern is intended

An advisory for a development-only tool that never runs in production can reasonably wait for your next upgrade. Note why, and upgrade when convenient; old versions collect more advisories over time.

RateWhy it’s rated from the advisory

Taken from the advisory, because its authors know the bug best. PatchLabs doesn't re-score it and doesn't check whether your code reaches the vulnerable function.

See alsoRelated findings

Guides

• How to find and fix vulnerable npm dependencies
• Pre-launch security checklist for vibe-coded apps

Last reviewed 10 Nov 2026. Finding IDs are stable: link to them freely. Spotted a mistake? Tell us.