npm package report

Is c3 safe?

1 known vulnerability.

// reach

1 direct dependencies

none carry a known advisory

2 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

cvss

not scored

severity out of 10

epss

0.00%

medium

chance of exploitation in 30 days, 75th percentile of all CVEs

xyz score

not scored

CyberXYZ composite out of 10

fig. 01 — GHSA-gvg7-pp82-cff3, the advisory selected below

// 1 advisories

GHSA-gvg7-pp82-cff3

Affected versions of c3 are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips.

// recommendation

Update to 0.4.11 or later.

Checked 2026-10-04 at 01:09 UTC. The most recent advisory here was published 2020-09-01. Updated continuously from NVD, GHSA, OSV and CNA feeds.