Skip to content
eSHARS Operations

Dependabot Vulnerability Review — March 2026

Audience: Dev leads, ops team Repo: AuthenticaTech/HISD Triggered by: Branch protection ruleset activation surfacing 49 open Dependabot alerts Last updated: 2026-03-18

Summary

On 2026-03-17, 49 open Dependabot security alerts were discovered on the HISD repo (3 critical, 38 high, 8 moderate). These were surfaced when configuring branch protection rules. Alerts span both production projects and the EsharsSeleniumTests test project.

Note on alert counts: Dependabot raises one alert per packages.config file per advisory (CVE or GHSA). A single advisory affecting 9 projects = 9 individual alerts. All 49 are accounted for — they map to 15 unique production advisory+package combinations and 8 unique test-only ones.

Production: 41 individual alerts → 15 unique advisory+package combinations (requiring action) Test-only: 8 individual alerts → 8 unique advisory+package combinations (lower priority)

Priority 1 — Fix Immediately (Auth / Session Security)

Microsoft.AspNet.Identity.Owin — CVE-2023-33170 · HIGH

  • Risk: Race condition in token validation allows security feature bypass in auth pipeline. Real exploitation risk for a web app.
  • Vulnerable: < 2.2.4
  • Fix: Upgrade to >= 2.2.4
  • Affected: Eshars.WebUI/packages.config, Eshars.Web.Security/packages.config, Eshars.ApplicationService/packages.config

Microsoft.Owin + Microsoft.Owin.Security.Cookies — CVE-2022-29117 / CVE-2020-1045 · HIGH

  • Risk: DoS via crafted requests + cookie parsing exploit. OWIN sits in the auth middleware pipeline.
  • Vulnerable: < 4.2.2 (CVE-2022-29117), < 4.1.1 (CVE-2020-1045)
  • Fix: Upgrade to >= 4.2.2
  • Affected: 3 files each — Eshars.WebUI, Eshars.Web.Security, Eshars.ApplicationService

Priority 1 — Fix Immediately (Serialization / Input Handling)

Newtonsoft.Json — CVE-2024-21907 · HIGH

  • Risk: DoS via deeply nested JSON input. Widely exploitable through any API endpoint accepting JSON.
  • Vulnerable: < 13.0.1
  • Fix: Upgrade to >= 13.0.1 — safe, non-breaking upgrade
  • Affected: 10 files across almost all projects

System.Text.Json — CVE-2024-43485 · HIGH

  • Risk: DoS in TMHPService. Impacts Medicaid claims processing stability.
  • Vulnerable: >= 8.0.0, <= 8.0.4
  • Fix: Upgrade to >= 8.0.5
  • Affected: Eshars.TMHPService/packages.config, Eshars.JobScheduler/packages.config

Priority 2 — Fix Soon (Frontend / JWT)

Moment.js — CVE-2022-31129 / CVE-2022-24785 · HIGH

  • Risk: ReDoS via malicious date strings + path traversal in locale loading.
  • Vulnerable: < 2.29.4
  • Fix: Upgrade to >= 2.29.4
  • Affected: Eshars.WebUI/packages.config

System.IdentityModel.Tokens.Jwt + Microsoft.IdentityModel.JsonWebTokens — CVE-2024-21319 · MODERATE

  • Risk: Crafted JWT tokens can cause CPU spike / DoS.
  • Vulnerable: < 5.7.0
  • Fix: Upgrade to >= 5.7.0
  • Affected: Eshars.WebUI/packages.config

Microsoft.Rest.ClientRuntime — CVE-2022-26907 · MODERATE

  • Risk: Azure SDK information disclosure.
  • Vulnerable: < 2.3.24
  • Fix: Upgrade to >= 2.3.24
  • Affected: Eshars.WebUI, Eshars.Core, Eshars.ApplicationService

Microsoft.Azure.Storage.DataMovement — CVE-2024-35252 · HIGH

  • Risk: DoS via blob storage operations.
  • Vulnerable: < 2.0.5
  • Fix: Upgrade to >= 2.0.5
  • Affected: Eshars.Core/packages.config

Priority 3 — Evaluate / No Direct Fix

DotNetZip — CVE-2024-48510 · HIGH · NO FIX

  • Risk: Directory traversal when extracting zip files. Valid if users can upload zips.
  • Mitigation: Validate/sanitize all extracted paths manually, or migrate to System.IO.Compression (built-in .NET).
  • Action: Audit usage — determine if DotNetZip is used in any user-upload flow.

RestSharp — CVE-2021-27293 · HIGH · Fix in alpha only

  • Risk: ReDoS via malformed URLs.
  • Action: Assess if RestSharp is actively used. If so, evaluate upgrade to v107+ (breaking API change).

AutoMapper — GHSA-rvv3-g6hj-g44x · HIGH

  • Risk: DoS via deeply nested circular object graphs.
  • Fix: v15.1.1 — but this is a major breaking version jump from current usage (likely v6-10 range).
  • Action: Defer. Real-world risk is low unless attackers control the objects being mapped. Track for next major refactor.

Test Project Only — Lower Priority

These alerts are in EsharsSeleniumTests only and do not ship to production.

SeverityPackageCVEFix Available
CRITICALRazorEngineCVE-2021-46703 — code injectionNo fix exists
CRITICALSystem.Text.Encodings.WebCVE-2021-26701 — RCEYes (>= 4.5.1)
CRITICALMicrosoft.AspNetCore.Server.Kestrel.CoreCVE-2025-55315Yes (>= 2.3.6)
HIGHMongoDB.DriverCVE-2022-48282 — deserializationYes (>= 2.19.0)
MODERATEMicrosoft.AspNetCore.Server.IISCVE-2019-1075Yes
MODERATEmongodb.driverCVE-2021-20331Yes (>= 2.12.2)
MODERATEsharpcompressCVE-2021-39208Yes (>= 0.29)

Recommendation: Upgrade all test project packages in a single cleanup PR. For RazorEngine (no fix), evaluate removing it from the test project entirely if it’s not actively used.

Remediation Approach

All Priority 1 and 2 upgrades should be done via individual PRs per project to keep diffs reviewable and rollback clean. Batch per-project, not per-vulnerability.

Suggested PR order:

  1. Eshars.WebUI — Newtonsoft.Json, Owin packages, Moment.js, JWT tokens, RestSharp, Rest.ClientRuntime
  2. Eshars.Web.Security + Eshars.ApplicationService — Owin, Identity.Owin, Newtonsoft.Json
  3. Eshars.TMHPService + Eshars.JobScheduler — System.Text.Json, Newtonsoft.Json
  4. Eshars.Core — Azure.Storage.DataMovement, Newtonsoft.Json, Rest.ClientRuntime
  5. EsharsSeleniumTests — all test project alerts in one PR

References