Skip to main content

Lit Case Study

Verified baseline scan — CVE Lite CLI v1.18.1 · 2026-05-30

Lit logo

Summary​

  • Project: Lit — web components library and monorepo (lit, lit-html, labs, examples, and tooling)
  • Revision: 20afabd3c5bfd49fdcdf1b8518e05c7f99a46db6
  • Lockfile: package-lock.json (2,059 resolved packages, npm workspaces, lockfile v3)
  • Lead finding: all 3 direct vulnerable packages are rollup majors (2.79.2, 3.29.5, 4.46.4) — CVE Lite emits workspace-scoped upgrade commands to 2.80.0, 3.30.0, and 4.59.0
  • First-pass coverage: 13 findings have confident copy-and-run commands across 4 validated fix command groups
  • Direct vs transitive: 3 direct / 96 transitive — five critical findings are entirely transitive (handlebars, form-data, liquidjs, and legacy utility paths)
  • Baseline findings: 99 unique vulnerable packages (5 critical · 52 high · 33 medium · 9 low)
  • OSV advisory matches: 289 CVE/advisory entries deduplicated into 99 packages
  • npm audit (same lockfile): 107 vulnerability entries (7 critical · 65 high · 29 moderate · 6 low)
  • Remediation applied in this study: none — baseline scan and generated fix plan only

What this case study demonstrates​

Lit is the reference implementation for Web Components in the modern JavaScript ecosystem — a large npm workspaces monorepo spanning core packages, labs tooling, localization examples, Next.js integration demos, and test infrastructure. At 2,059 resolved packages, it sits between VS Code root (1,374) and Astro (2,228) in graph size.

Unlike framework monorepos that surface risk primarily in example apps, Lit’s direct vulnerable packages are all rollup versions (2.79.2, 3.29.5, 4.46.4) — the build toolchain the monorepo depends on directly. CVE Lite generates workspace-scoped upgrade commands for labs packages and parent-range npm update patterns across workspaces.

The five critical findings are entirely transitive — typical of documentation, localization, and legacy tooling paths:

[email protected] — critical prototype pollution / RCE class advisories.

[email protected] — critical unsafe random boundary generation.

[email protected] — critical template engine advisories in localization/labs paths.

[email protected] and [email protected] — critical legacy utility packages in deep toolchain chains.

The three direct findings share one remediation theme:

npm install -w packages/labs/compiler -w packages/labs/rollup-plugin-minify-html-literals …

CVE Lite validates separate upgrade targets for [email protected], [email protected], and [email protected] — reflecting three majors locked simultaneously in a long-lived monorepo.

Comparison Note: CVE Lite CLI vs npm audit​

Both tools were run against the same package-lock.json on the same machine on 2026-05-30.

Metricnpm auditCVE Lite CLI v1.18.1
Total reported findings10799
Critical75
High6552
Moderate / Medium2933
Low69
Direct vs transitive breakdown✗✓ (3 / 96)
Deduplicated package view✗✓
npm workspace-scoped commands✗✓ (4 groups)
Skipped findings with reason✗✓ (77 entries)

Why the totals differ: npm audit counts 107 vulnerability entries (advisory × path rows). CVE Lite counts 99 unique vulnerable package versions once each. Nine minimatch majors each appear as separate unique packages in CVE Lite; npm audit may emit multiple rows per path.

Critical severity: npm audit reports 7 critical entries; CVE Lite reports 5 critical unique packages. Both flag handlebars, form-data, and related legacy packages — CVE Lite deduplicates per package version rather than per audit row.

Fix guidance:

npm audit lists advisories without workspace-aware grouping. CVE Lite generates 4 command groups covering 13 findings on first pass — including npm install -w for labs Rollup plugins, npm update --workspace=… for analyzer tooling, and npm install [email protected] as a parent upgrade. That is a materially better first-pass outcome than lockfile-only snapshots where zero commands are generated.

Before vs After​

No remediation pass was performed for this study. This table records the verified baseline scan only.

StageFindingsCriticalHighMediumLowDirectTransitiveCommand groups
Baseline (verified)995523393964

Fix Journey​

No commands were run for this study.

The instinct on 5 critical findings is to bump root dependencies. CVE Lite shows they are transitive — liquidjs, handlebars, and form-data require upstream labs or localization package decisions, not root npm install.

For rollup, three direct versions each get validated targets — a maintainer must upgrade labs compiler plugins and parent workspace ranges together, not assume one rollup bump fixes all three locked majors.

13 of 99 first-pass coverage is unusually high for a lockfile-only snapshot — driven by npm workspace command generation and identifiable parent upgrades (lint-staged, @web/test-runner paths).

Why this matters​

Lit is embedded in countless design systems and component libraries. Security teams auditing Lit need to understand that risk splits between direct Rollup toolchain debt (three versions) and transitive legacy template/HTTP utilities in labs and localization paths — not a single lit package version alone.

CVE Lite's value is workspace-aware remediation at 2,059-package scale: 99 deduplicated findings, 13 first-pass fixes, and 77 skipped findings with reasons — versus 107 npm audit rows without grouped commands.

Scan command​

Run from the Lit repository root or from the examples/lit directory in this repository:

cve-lite . --verbose --all

The example lockfile reflects Lit at revision 20afabd3c5bfd49fdcdf1b8518e05c7f99a46db6. OSV advisory data changes over time — re-scanning may show different counts on the same revision.

Scan verification​

Every number in this case study comes from a live scan of the committed fixture at examples/lit/ in the CVE Lite CLI repository.

FieldValue
Scan date2026-05-30
CLI versionv1.18.1
CVE Lite commandnode dist/index.js examples/lit --verbose --all --json
npm audit commandnpm audit / npm audit --json
Advisory sourceOSV (https://api.osv.dev) — online mode
Lockfile sourceexamples/lit/package-lock.json from lit/lit@20afabd
Packages parsed (CVE Lite)2,059
Unique vulnerable packages (CVE Lite)99
Vulnerability entries (npm audit)107
Fix command groups (CVE Lite)4
First-pass covered findings (CVE Lite)13
Skipped findings with reason (CVE Lite)77

Reproduce CVE Lite locally from the repository root:

npm install
npm run build
node dist/index.js examples/lit --verbose --all

Reproduce npm audit from the example directory:

cd examples/lit
npm audit
npm audit --json

Both tools were run against the same package-lock.json on the same machine on 2026-05-30.

Remaining risk​

All 99 baseline findings remain open at the time of this study. No remediation was applied.

  • 5 critical: [email protected], [email protected], [email protected], [email protected], [email protected]
  • 52 high: including 3 direct rollup versions (2.79.2, 3.29.5, 4.46.4), three next versions, nine minimatch versions, four ws versions, three axios versions, playwright, koa, ip (no fix)
  • 33 medium: multiple esbuild versions, vite (two versions), postcss, qs, js-yaml, useragent (no fix), parseuri (no fix)
  • 9 low: debug (two versions), three diff versions, cookie, send, serve-static, webpack

13 findings have first-pass commands; 77 require parent upgrades, workspace-scoped manual releases, or acceptance of npm workspace path-reconstruction limits.

Baseline findings​

Full vulnerable package list from the verified scan on 2026-05-30 (revision 20afabd):

PackageVersionSeverityRelationshipFix hintAdvisory IDs
basic-ftp5.0.5criticaltransitive5.3.1CVE-2026-27699, CVE-2026-41324…
form-data2.3.3criticaltransitive2.5.4CVE-2025-7783
handlebars4.7.8criticaltransitive4.7.9CVE-2026-33916, CVE-2026-33937…
liquidjs9.43.0criticaltransitive10.26.0CVE-2026-44644, CVE-2022-25948…
minimist1.2.0criticaltransitive1.2.6CVE-2020-7598, CVE-2021-44906
@babel/plugin-transform-modules-systemjs7.27.1hightransitive7.29.4CVE-2026-44728
@koa/cors3.4.3hightransitive5.0.0CVE-2023-49803
@xmldom/xmldom0.8.11hightransitive0.8.13CVE-2026-41673, CVE-2026-41674…
axios0.21.4hightransitive0.32.0CVE-2026-44495, CVE-2025-62718…
axios0.26.1hightransitive0.32.0CVE-2026-44495, CVE-2025-62718…
axios1.11.0hightransitive1.16.0CVE-2026-44494, CVE-2026-44495…
braces2.3.2hightransitive3.0.3CVE-2024-4068
compressing1.10.3hightransitive1.10.5CVE-2026-40931, CVE-2026-24884
fast-uri3.0.6hightransitive3.1.2CVE-2026-6321, CVE-2026-6322
flatted2.0.2hightransitive3.4.2CVE-2026-32141, CVE-2026-33228
flatted3.3.3hightransitive3.4.2CVE-2026-32141, CVE-2026-33228
glob10.4.5hightransitive10.5.0CVE-2025-64756
immutable3.8.2hightransitive3.8.3CVE-2026-29063
ip1.1.9hightransitive⚠ no fixCVE-2024-29415
js-cookie3.0.5hightransitive3.0.7CVE-2026-46625
jws3.2.2hightransitive3.2.3CVE-2025-65945
koa2.16.2hightransitive2.16.4CVE-2026-27959, CVE-2025-62595
lodash4.17.21hightransitive4.18.0CVE-2026-2950, CVE-2026-4800…
minimatch3.0.4hightransitive3.1.4CVE-2026-27904, CVE-2026-26996…
minimatch3.1.2hightransitive3.1.4CVE-2026-27904, CVE-2026-26996…
minimatch5.1.6hightransitive5.1.8CVE-2026-27904, CVE-2026-26996…
minimatch6.2.0hightransitive6.2.2CVE-2026-27904, CVE-2026-26996…
minimatch7.4.6hightransitive7.4.8CVE-2026-27904, CVE-2026-26996…
minimatch9.0.1hightransitive9.0.7CVE-2026-27904, CVE-2026-26996…
minimatch9.0.3hightransitive9.0.7CVE-2026-27904, CVE-2026-26996…
minimatch9.0.5hightransitive9.0.7CVE-2026-27904, CVE-2026-26996…
next13.5.11hightransitive14.1.1CVE-2026-44573, CVE-2026-44572…
next14.2.32hightransitive15.5.16CVE-2026-44573, CVE-2026-44572…
next15.5.7hightransitive15.5.18CVE-2026-44575, CVE-2026-45109…
picomatch2.3.1hightransitive2.3.2CVE-2026-33672, CVE-2026-33671
picomatch4.0.3hightransitive4.0.4CVE-2026-33672, CVE-2026-33671
playwright1.55.0hightransitive1.55.1CVE-2025-59288
preact10.27.1hightransitive10.27.3CVE-2026-22028
rollup2.79.2highdirect2.80.0CVE-2026-27606
rollup3.29.5highdirect3.30.0CVE-2026-27606
rollup4.46.4highdirect4.59.0CVE-2026-27606
serialize-javascript4.0.0hightransitive7.0.3—
serialize-javascript6.0.2hightransitive7.0.5CVE-2026-34043
socket.io-parser3.3.4hightransitive3.3.5CVE-2026-33151
socket.io-parser3.4.3hightransitive3.4.4CVE-2026-33151
socket.io-parser4.2.4hightransitive4.2.6CVE-2026-33151
systeminformation5.27.7hightransitive5.31.6CVE-2026-26318, CVE-2026-26280…
tar-fs2.1.1hightransitive2.1.4CVE-2025-48387, CVE-2024-12905…
tmp0.0.33hightransitive0.2.6CVE-2025-54798, CVE-2026-44705
tmp0.2.1hightransitive0.2.6CVE-2025-54798, CVE-2026-44705
tmp0.2.5hightransitive0.2.6CVE-2026-44705
trim0.0.1hightransitive0.0.3CVE-2020-7753
ua-parser-js0.7.22hightransitive0.7.24CVE-2020-7793, CVE-2021-27292
ws8.13.0hightransitive8.20.1CVE-2024-37890, CVE-2026-45736
ws8.2.3hightransitive8.20.1CVE-2024-37890, CVE-2026-45736
ws8.5.0hightransitive8.20.1CVE-2024-37890, CVE-2026-45736
ws8.8.0hightransitive8.20.1CVE-2024-37890, CVE-2026-45736
ajv6.12.6mediumtransitive6.14.0CVE-2025-69873
ajv8.17.1mediumtransitive8.18.0CVE-2025-69873
brace-expansion1.1.12mediumtransitive1.1.13CVE-2026-33750
brace-expansion2.0.2mediumtransitive2.0.3CVE-2026-33750
brace-expansion4.0.1mediumtransitive5.0.5CVE-2026-33750
esbuild0.17.19mediumtransitive0.25.0—
esbuild0.18.20mediumtransitive0.25.0—
esbuild0.21.5mediumtransitive0.25.0—
follow-redirects1.15.11mediumtransitive1.16.0—
ip-address10.0.1mediumtransitive10.1.1CVE-2026-42338
js-yaml3.13.1mediumtransitive3.14.2CVE-2025-64718
js-yaml3.14.1mediumtransitive3.14.2CVE-2025-64718
js-yaml4.1.0mediumtransitive4.1.1CVE-2025-64718
karma5.2.3mediumtransitive6.3.16CVE-2022-0437, CVE-2021-23495
log4js4.5.1mediumtransitive6.4.0CVE-2022-21704
micromatch3.1.10mediumtransitive4.0.8CVE-2024-4067
micromatch4.0.5mediumtransitive4.0.8CVE-2024-4067
parseuri0.0.6mediumtransitive⚠ no fixCVE-2024-36751
postcss8.4.31mediumtransitive8.5.10CVE-2026-41305
postcss8.5.6mediumtransitive8.5.10CVE-2026-41305
qs6.13.0mediumtransitive6.15.2CVE-2025-15284, CVE-2026-8723…
qs6.14.0mediumtransitive6.15.2CVE-2025-15284, CVE-2026-8723…
qs6.5.3mediumtransitive6.14.1CVE-2025-15284
request2.88.2mediumtransitive3.0.0CVE-2023-28155
tough-cookie2.5.0mediumtransitive4.1.3CVE-2023-26136
useragent2.3.0mediumtransitive⚠ no fixCVE-2020-26311
uuid3.4.0mediumtransitive11.1.1CVE-2026-41907
uuid9.0.1mediumtransitive11.1.1CVE-2026-41907
vite4.5.14mediumtransitive6.4.2CVE-2026-39365, CVE-2025-62522…
vite5.4.19mediumtransitive6.4.2CVE-2026-39365, CVE-2025-62522…
ws8.17.1mediumtransitive8.20.1CVE-2026-45736
ws8.18.3mediumtransitive8.20.1CVE-2026-45736
yaml2.3.1mediumtransitive2.8.3CVE-2026-33532
cookie0.4.2lowtransitive0.7.0CVE-2024-47764
debug3.2.6lowtransitive3.2.7CVE-2017-16137
debug4.1.1lowtransitive4.3.1CVE-2017-16137
diff3.5.0lowtransitive3.5.1CVE-2026-24001
diff4.0.2lowtransitive4.0.4CVE-2026-24001
diff5.2.0lowtransitive5.2.2CVE-2026-24001
send0.16.2lowtransitive0.19.0CVE-2024-43799
serve-static1.13.2lowtransitive1.16.0CVE-2024-43800
webpack5.101.3lowtransitive5.104.1CVE-2025-68157, CVE-2025-68458

Want your project reviewed?​

If you maintain an interesting JavaScript or TypeScript project and want CVE Lite CLI considered for a public case study, open an issue in the CVE Lite CLI repository.

Please include:

  • the repository link
  • why the project would make a useful case study
  • whether the dependency graph is publicly reproducible

Not every project will be selected. Preference will go to projects that are publicly useful, technically interesting, and strong examples of realistic dependency remediation workflows.