SEC-045
Browser library with a known vulnerability
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Version numbers in script URLs, file names and library banner comments, against 70 libraries of the Retire.js vulnerability repository (fetched 2026-10-28). A bundle without a visible version is not judged.
Why it matters
Each listed version has a public vulnerability; attackers scan for these versions automatically.
Recommended fix
Upgrade each listed library to at least the fixed version.
How to verify
Reload the page and confirm the listed library is loaded at a fixed version (check the script URL or the banner at the top of the file).
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-045: Browser library with a known vulnerability
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Upgrade the browser libraries in the evidence to their latest releases (at least the fixed versions named there), update the script tags or packages, and run the tests.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Reload the page and confirm the listed library is loaded at a fixed version (check the script URL or the banner at the top of the file).