Possible fix(deps): 69 vulnerable dependencies in package-lock.json

[begininvoke]

Spotted what might be an issue in exploitation/promptfoo/package-lock.json around line 6244.

CRITICAL severity: CVE-2026-25896 affects fast-xml-parser v5.2.5 (vulnerable range: 4.1.3 to <5.3.5) declared in exploitation/promptfoo/package-lock.json. The library treats a dot (.) in a DOCTYPE entity name as a regex wildcard during entity replacement. This allows an attacker to define entities such as &x.y; that shadow the built-in XML entities (<, >, &, ", ') with arbitrary values. As a result, entity encoding is bypassed and malicious markup is passed through unescaped into the parsed JS object; when that output is rendered (e.g., in the promptfoo web UI or downstream report generation), it leads to Cross-Site Scripting (XSS). An attacker who can influence the XML content processed by this application (external test results, feeds, API responses) could inject executable scripts, hijack sessions, or deface results. Impact is high (code execution in the browser context of users viewing parsed output), exploitability is low-effort, and CVSS severity is CRITICAL. Recommended fix: upgrade fast-xml-parser to >= 5.3.5 (or pin to 4.5.4 if staying on the 4.x branch).

Something like this might fix it:

Regenerate the lockfile after bumping the dependency. In exploitation/promptfoo/package.json:

```diff
--- a/exploitation/promptfoo/package.json
+++ b/exploitation/promptfoo/package.json
@@
   "dependencies": {
-    "fast-xml-parser": "^5.2.5",
+    "fast-xml-parser": "^5.3.5",
```

Then run:

    cd exploitation/promptfoo && npm install fast-xml-parser@5.3.5

This updates package-lock.json accordingly:

```diff
--- a/exploitation/promptfoo/package-lock.json
+++ b/exploitation/promptfoo/package-lock.json
@@ -6244,9 +6244,9 @@
-        "node_modules/fast-xml-parser": {
-          "version": "5.2.5",
-          "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.2.5.tgz",
-          "integrity": "sha512-<old-integrity-hash>"
+        "node_modules/fast-xml-parser": {
+          "version": "5.3.5",
+          "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.5.tgz",
+          "integrity": "sha512-<new-integrity-hash>"
```

Notes:
- The exact resolved URL/integrity values are regenerated automatically by npm; do not hand-edit the lockfile.
- Verify no transitive dependency pins fast-xml-parser below 5.3.5 (check with `npm ls fast-xml-parser`).
- After upgrading, re-run the scan to confirm CVE-2026-25896 is resolved, and add a test parsing XML containing a DOCTYPE entity with a dot in its name to ensure built-in entities are no longer shadowed.

For reference: rule CVE-2026-25896. Rated critical.

I may be wrong about this one — closing it costs you nothing if so.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.