Scanner confirmation: trivy rule CVE-2026-6321 flagged this pattern.
Production code: This file is in the production codebase, not test-only code.
Threat Model Context
This is a Node.js library - vulnerabilities affect downstream consumers who use this package.
Changes
flowsint-app/package.json
flowsint-app/yarn.lock
Verification
Build passes
Scanner re-scan confirms fix
LLM code review passed
This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/reconurge/flowsint/pull/158
Author: @orbisai0security
Created: 6/3/2026
Status: ❌ Closed
Base:
main← Head:fix-cve-2026-6321-fast-uri📝 Commits (1)
1568a10fix: CVE-2026-6321 security vulnerability📊 Changes
2 files changed (+6 additions, -0 deletions)
View changed files
📝
flowsint-app/package.json(+1 -0)📝
yarn.lock(+5 -0)📄 Description
Summary
Upgrade fast-uri from 3.1.0 to 3.1.1 to fix CVE-2026-6321.
Vulnerability
CVE-2026-6321flowsint-app/yarn.lockDescription: fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies
Evidence
Scanner confirmation: trivy rule
CVE-2026-6321flagged this pattern.Production code: This file is in the production codebase, not test-only code.
Threat Model Context
This is a Node.js library - vulnerabilities affect downstream consumers who use this package.
Changes
flowsint-app/package.jsonflowsint-app/yarn.lockVerification
This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.
Automated security fix by OrbisAI Security
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.