y-monaco-0.1.6.tgz: 2 vulnerabilities (highest severity is: 8.6)

[mend-bolt-for-github]

Vulnerable Library - y-monaco-0.1.6.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/lib0/package.json

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (y-monaco version)	Remediation Possible**
CVE-2026-102521	High	8.6	lib0-0.2.117.tgz	Transitive	N/A*	❌
CVE-2026-102360	High	8.6	lib0-0.2.117.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-102521

Vulnerable Library - lib0-0.2.117.tgz

> Monorepo of isomorphic utility functions

Library home page: https://registry.npmjs.org/lib0/-/lib0-0.2.117.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/lib0/package.json

Dependency Hierarchy:

• y-monaco-0.1.6.tgz (Root Library)
  • ❌ lib0-0.2.117.tgz (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

The decoder in "readFromDataView" in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view, thus exposing adjacent process memory. This can be anything that is currently in the head, for example credentials or logs. This is similar to but different from GHSA-r5c8-rf4w-qrq8.

Publish Date: 2026-09-29

URL: CVE-2026-102521

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2026-102360

Vulnerable Library - lib0-0.2.117.tgz

> Monorepo of isomorphic utility functions

Library home page: https://registry.npmjs.org/lib0/-/lib0-0.2.117.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/lib0/package.json

Dependency Hierarchy:

• y-monaco-0.1.6.tgz (Root Library)
  • ❌ lib0-0.2.117.tgz (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. "readUint8Array" never compares the wire-supplied length against the decoder's own view, so one over-long length prefix returns whatever the host process allocated next: other tenants' document content, personal data, and live bearer session tokens**, recovered in full and at will. An attacker who can supply bytes to a lib0 decoder which means any peer that can open a socket, including before authentication reads adjacent process memory and, where the consumer echoes, stores or re-serves the decoded value, receives it back. This is patched in version 0.2.118 and 1.0.0-rc.33.

Publish Date: 2026-09-29

URL: CVE-2026-102360

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here