T08 · Insecure Dependencies
- Location
iteration/references/templates/prototype-template.html:11- Finding
Unpinned Third-Party JavaScript Dependencies Without Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
iteration/references/templates/prototype-template.html, lines 11-14
Vulnerability Type: External dependency supply-chain exposure
Risk Level: MediumVulnerable Code
html <script crossorigin src="https://unpkg.com/react@18/umd/react.production.min.js"></script> <script crossorigin src="https://unpkg.com/react-dom@18/umd/react-dom.production.min.js"></script> <script src="https://unpkg.com/@babel/standalone/babel.min.js"></script> <script src="https://cdn.tailwindcss.com"></script>Technical Analysis
The prototype template loads and executes JavaScript from third-party CDNs whenever the generated HTML file is opened. The React resources use mutable major-version aliases, while the Babel and Tailwind resources do not specify versions. None of the resources includes a Subresource Integrity hash.
Consequently, the effective executable code can change after the Skill package has been reviewed. A compromised CDN, compromised upstream package, malicious package release, DNS or network interception scenario, or unexpected change to a mutable alias could cause generated prototypes to execute unauthorized JavaScript.
The
crossoriginattribute does not verify resource integrity. Without anintegrityattribute containing a trusted cryptographic hash, the browser has no mechanism to determine whether the downloaded script is the exact version approved by the project author.Attack Path
- An attacker compromises one of the referenced CDN resources, an upstream package release, or the resolution of a mutable version alias.
- The Skill generates a prototype based on this template.
- A user opens the generated prototype while network access is available.
- The browser retrieves the modified JavaScript from the external CDN.
- The browser executes that code in the prototype page context without integrity verification.
- The malicious script can inspect or modify prototype content, read brow ...[truncated 994 chars]
- Remediation
View remediation
Remediation Suggestions
-
Bundle dependencies locally
- Download reviewed releases of React, ReactDOM, Babel, and Tailwind during a controlled build process.
- Store the required compiled assets within the project or package.
- Serve generated prototypes without runtime dependency retrieval.
-
Pin exact immutable versions
- Replace mutable aliases such as
react@18with exact versions. - Specify exact versions for Babel and Tailwind.
- Avoid CDN endpoints whose response can change without a corresponding URL change.
- Replace mutable aliases such as
-
Add Subresource Integrity
- Generate and verify SHA-384 or SHA-512 hashes for every external resource.
- Add an
integrityattribute and usecrossorigin="anonymous". - Update integrity hashes only after reviewing and approving dependency changes.
-
Apply a restrictive Content Security Policy
- Limit
script-srcto explicitly approved locations and hashes. - Restrict outbound connections through
connect-src. - Disable unnecessary object, frame, and plugin sources.
- Limit
-
Remove runtime compilers from distributed prototypes
- Precompile JSX and Tailwind CSS during generation.
- Distribute static JavaScript and CSS rather than loading Babel and Tailwind's runtime CDN scripts.
-
Establish dependency review controls
- Maintain a dependency inventory and approved-version lock file.
- Monitor dependency advisories and verify checksums during updates.
- Require security review before changing external assets.
-