Possible fix(deps): 68 vulnerable dependencies in package-lock.json

[begininvoke]

This might be a false positive, but exploitation/promptfoo/package-lock.json around line 9182 looked worth a second pair of eyes.

CRITICAL severity (CVE-2026-25896): exploitation/promptfoo/package-lock.json resolves fast-xml-parser@5.3.2, which falls in the affected range (>=4.1.3, <5.3.5). The parser mishandles a dot (.) in a DOCTYPE entity name, treating it as a regex wildcard during entity replacement. This lets an attacker craft an XML document whose entity declarations shadow the built-in XML entities (<, >, &, ", ') with arbitrary values, bypassing the library's entity-encoding safeguards. Impact: any XML parsed from untrusted input (e.g., user-supplied configs, API/report data rendered by the promptfoo web UI) can be decoded into raw markup on output, leading to cross-site scripting (XSS) when the parsed result is rendered. Risk is rated CRITICAL because exploitation requires only a crafted XML document — no authentication or privileges — and can enable session/credential theft and client-side compromise in any consumer that renders parser output. Remediation: upgrade fast-xml-parser to >=5.3.5 (or pin the backported 4.5.4 if you must stay on the 4.x line) and regenerate the lockfile.

Something like this might fix it:

Do not hand-edit the integrity hash; regenerate the lockfile with the patched release:

```bash
# If fast-xml-parser is a direct dependency:
cd exploitation/promptfoo
npm install fast-xml-parser@^5.3.5

# If it is a transitive dependency, force it via an override in package.json:
#   "overrides": { "fast-xml-parser": "^5.3.5" }
npm install
```

Resulting diff in exploitation/promptfoo/package-lock.json:

```diff
--- a/exploitation/promptfoo/package-lock.json
+++ b/exploitation/promptfoo/package-lock.json
@@
     "node_modules/fast-xml-parser": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.2.tgz",
-      "integrity": "sha512-<old-integrity-hash>",
+      "version": "5.3.5",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.5.tgz",
+      "integrity": "sha512-<new-integrity-hash>",
       "license": "MIT",
       "dependencies": {
         "strnum": "^2.1.1"
       }
     }
```

Also update package.json if the dependency is declared there ("fast-xml-parser": "^5.3.5"), then verify with `npm audit` and re-run the vulnerability scanner. If upgrading to 5.x is not feasible, pin the backported 4.5.4 release instead. As defense-in-depth, avoid rendering fast-xml-parser output as raw HTML/Markdown without context-aware output escaping.

For reference: rule CVE-2026-25896. Rated critical.

I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.