GPT Home AI Agent

Findings (97)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/backend.py:1408
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/frontend/scripts/generate-version.js:12
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/frontend/scripts/generate-version.js:20
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/frontend/scripts/generate-version.js:21
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @babel/plugin-transform-modules-systemjs@7.22.11: 1 known vulnerability

  GHSA-fv7c-fp4j-7gwp

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @remix-run/router@1.9.0: 2 known vulnerabilities

  GHSA-2j2x-hqr9-3h42, GHSA-2w69-qvjg-hvjx

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  axios@1.5.0: 32 known vulnerabilities

  GHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-3w6x-2g7m-8v23, GHSA-42h9-826w-cgv3 +27 more

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@1.20.1: 3 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-qwcr-r2fm-qrc7, GHSA-v422-hmwv-36x6

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@1.1.11: 8 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +3 more

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@2.0.1: 8 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +3 more

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  browserslist@4.28.1: 2 known vulnerabilities

  GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  compression@1.7.4: 1 known vulnerability

  GHSA-vc2v-76pw-4v95

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  cross-spawn@7.0.3: 1 known vulnerability

  GHSA-3xgq-45jj-v275

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@3.1.0: 12 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  flatted@3.2.9: 2 known vulnerabilities

  GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  http-proxy-middleware@2.0.6: 4 known vulnerabilities

  GHSA-4www-5p9h-95mh, GHSA-64mm-vxmg-q3vj, GHSA-9gqv-wp59-fq42, GHSA-c7qv-q95q-8v27

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  js-yaml@3.14.1: 5 known vulnerabilities

  GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  js-yaml@4.1.0: 5 known vulnerabilities

  GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  launch-editor@2.6.0: 5 known vulnerabilities

  GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-c27g-q93r-2cwf, GHSA-r825-w8mm-5pxw, GHSA-v6wh-96g9-6wx3

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  lodash@4.17.21: 2 known vulnerabilities

  GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  minimatch@3.1.2: 3 known vulnerabilities

  GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  minimatch@5.1.6: 3 known vulnerabilities

  GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.11: 3 known vulnerabilities

  GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  node-forge@1.3.1: 18 known vulnerabilities

  GHSA-2328-f5f3-gj25, GHSA-4487-j8r4-4g2f, GHSA-4642-5mcj-2rqw, GHSA-525v-9gp9-w22h, GHSA-554w-wpv2-vw27 +13 more

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nth-check@1.0.2: 1 known vulnerability

  GHSA-rp65-9cf3-cjxr

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  path-to-regexp@0.1.7: 2 known vulnerabilities

  GHSA-37ch-88jc-xwx2, GHSA-rhx6-c78j-4q9w

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  picomatch@2.3.1: 2 known vulnerabilities

  GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  picomatch@4.0.3: 2 known vulnerabilities

  GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  postcss@7.0.39: 5 known vulnerabilities

  GHSA-6g55-p6wh-862q, GHSA-7fh5-64p2-3v2j, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  postcss@8.5.6: 4 known vulnerabilities

  GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  rollup@2.79.1: 2 known vulnerabilities

  GHSA-gcx4-mw62-g8wm, GHSA-mw96-cpmx-2vgc

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  serialize-javascript@4.0.0: 2 known vulnerabilities

  GHSA-5c6j-r48x-rmvq, GHSA-m5mm-p8h7-m29v

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  serialize-javascript@6.0.2: 3 known vulnerabilities

  GHSA-5c6j-r48x-rmvq, GHSA-m5mm-p8h7-m29v, GHSA-qj8w-gfj5-8c6v

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  svgo@1.3.2: 3 known vulnerabilities

  GHSA-2p49-hgcm-8545, GHSA-4vpr-x523-8j87, GHSA-w27v-7q3p-w38r

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  svgo@2.8.0: 4 known vulnerabilities

  GHSA-2p49-hgcm-8545, GHSA-4vpr-x523-8j87, GHSA-w27v-7q3p-w38r, GHSA-xpqw-6gx7-v673

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  underscore@1.12.1: 1 known vulnerability

  GHSA-qpx9-hpmf-5gmw

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  uuid@8.3.2: 1 known vulnerability

  GHSA-w5hq-g745-h8pq

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  webpack-dev-middleware@5.3.3: 2 known vulnerabilities

  GHSA-g84c-rxfj-3j2c, GHSA-wr3j-pwj9-hqq6

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ws@7.5.9: 2 known vulnerabilities

  GHSA-3h5v-q93c-6h6q, GHSA-96hv-2xvq-fx4p

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ws@8.14.1: 3 known vulnerabilities

  GHSA-3h5v-q93c-6h6q, GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p

  src/frontend/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fastapi@0.103.0: 1 known vulnerability

  PYSEC-2024-38

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  httplib2@0.22.0: 1 known vulnerability

  PYSEC-2026-3444

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  idna@3.4: 2 known vulnerabilities

  PYSEC-2024-60, PYSEC-2026-215

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  langchain-core@1.2.6: 4 known vulnerabilities

  PYSEC-2026-2193, PYSEC-2026-2562, PYSEC-2026-2563, PYSEC-2026-2564

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  langgraph@1.0.5: 1 known vulnerability

  PYSEC-2026-83

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  langsmith@0.3.45: 3 known vulnerabilities

  PYSEC-2026-2582, PYSEC-2026-2583, GHSA-f4xh-w4cj-qxq8

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  oauthlib@3.2.2: 3 known vulnerabilities

  PYSEC-2026-4113, PYSEC-2026-4114, GHSA-7984-qgvg-3j9c

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  protobuf@3.20.1: 3 known vulnerabilities

  PYSEC-2026-1805, PYSEC-2026-1806, PYSEC-2026-899

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  pyasn1@0.5.0: 8 known vulnerabilities

  PYSEC-2026-2263, PYSEC-2026-3455, PYSEC-2026-3456, PYSEC-2026-3457, GHSA-2qm8-x737-gmw5 +3 more

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  python-multipart@0.0.9: 8 known vulnerabilities

  PYSEC-2026-1851, PYSEC-2026-1852, PYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3038 +3 more

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  spotipy@2.23.0: 2 known vulnerabilities

  PYSEC-2026-1936, PYSEC-2026-1937

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  starlette@0.37.0: 7 known vulnerabilities

  PYSEC-2026-161, PYSEC-2026-1941, PYSEC-2026-1943, PYSEC-2026-2280, PYSEC-2026-2281 +2 more

  src/requirements.txt
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  urllib3@1.26.16: 10 known vulnerabilities

  PYSEC-2023-192, PYSEC-2023-212, PYSEC-2026-141, PYSEC-2026-1994, PYSEC-2026-1995 +5 more

  src/requirements.txt
• lowLow. Minor, or common in normal tools. Shown for information.
  @adobe/css-tools@4.3.1: 1 known vulnerability

  GHSA-prr3-c3m5-p7q2

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @babel/core@7.22.20: 1 known vulnerability

  GHSA-4x5r-pxfx-6jf8

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @babel/helpers@7.22.15: 1 known vulnerability

  GHSA-968p-4wvh-cqc8

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @babel/runtime@7.22.15: 1 known vulnerability

  GHSA-968p-4wvh-cqc8

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @tootallnate/once@1.1.2: 1 known vulnerability

  GHSA-vpq2-c234-7xj6

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ajv@6.12.6: 1 known vulnerability

  GHSA-2g4f-4pwh-qvx6

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ajv@8.12.0: 1 known vulnerability

  GHSA-2g4f-4pwh-qvx6

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  baseline-browser-mapping@2.9.11: 1 known vulnerability

  GHSA-w5vr-8v7q-w6rv

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  colord@2.9.3: 1 known vulnerability

  GHSA-2wm5-q62r-hmrv

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  cookie@0.5.0: 1 known vulnerability

  GHSA-pxg6-pf52-xh8x

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  deepmerge@4.3.1: 1 known vulnerability

  GHSA-gcqx-w48m-w2h4

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ejs@3.1.9: 1 known vulnerability

  GHSA-ghr5-ch3p-vcr6

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  express@4.18.2: 2 known vulnerabilities

  GHSA-qw6h-vgh9-j6wx, GHSA-rv95-896h-c2vc

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  follow-redirects@1.15.2: 3 known vulnerabilities

  GHSA-cxjh-pqwp-8mfp, GHSA-jchw-25xp-jwwc, GHSA-r4q5-vmmm-2653

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  on-headers@1.0.2: 1 known vulnerability

  GHSA-76c9-3jph-rj3q

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  postcss-selector-parser@6.1.2: 2 known vulnerabilities

  GHSA-rj75-hqrm-r3gf, GHSA-w9m9-85wc-3x92

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.11.0: 4 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-w7fw-mjwx-w883

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  react-router@6.16.0: 4 known vulnerabilities

  GHSA-2j2x-hqr9-3h42, GHSA-337j-9hxr-rhxg, GHSA-9jcx-v3wj-wh4m, GHSA-wrjc-x8rr-h8h6

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  send@0.18.0: 1 known vulnerability

  GHSA-m6fv-jmcg-4jfg

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  serve-static@1.15.0: 1 known vulnerability

  GHSA-cm22-4g7w-348p

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  webpack-dev-server@4.15.1: 6 known vulnerabilities

  GHSA-4v9v-hfq4-rm2v, GHSA-79cf-xcqc-c78w, GHSA-9jgg-88mc-972h, GHSA-f5vj-f2hx-8m93, GHSA-m28w-2pqf-7qgj +1 more

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  yaml@1.10.2: 1 known vulnerability

  GHSA-48c2-rrv3-qjmp

  src/frontend/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  langchain@1.2.0: 1 known vulnerability

  PYSEC-2026-2192

  src/requirements.txt
• lowLow. Minor, or common in normal tools. Shown for information.
  langchain-anthropic@1.3.0: 1 known vulnerability

  PYSEC-2026-2556

  src/requirements.txt
• lowLow. Minor, or common in normal tools. Shown for information.
  langchain-openai@1.1.5: 1 known vulnerability

  PYSEC-2026-76

  src/requirements.txt
• lowLow. Minor, or common in normal tools. Shown for information.
  langgraph-checkpoint@3.0.1: 2 known vulnerabilities

  PYSEC-2026-2573, PYSEC-2026-2574

  src/requirements.txt
• lowLow. Minor, or common in normal tools. Shown for information.
  langgraph-checkpoint-postgres@3.0.2: 2 known vulnerabilities

  PYSEC-2026-3635, GHSA-6hmw-9432-67qq

  src/requirements.txt
• lowLow. Minor, or common in normal tools. Shown for information.
  python-dotenv@1.0.0: 1 known vulnerability

  PYSEC-2026-2270

  src/requirements.txt
• lowLow. Minor, or common in normal tools. Shown for information.
  requests@2.32.5: 1 known vulnerability

  PYSEC-2026-2275

  src/requirements.txt
• lowLow. Minor, or common in normal tools. Shown for information.
  tqdm@4.66.1: 1 known vulnerability

  PYSEC-2026-1976

  src/requirements.txt
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)