Nearly half the packages specified have high risk vulnerabilities, all have some vulnerability.
This is why veteran coders with decades of experience disapprove of JS as a back-end language. Javascript is not intended to be a server side language, and these node packages create vulnerabilities that get servers hacked. This is a serious security concern and should be addressed by the developer, or there should be...
Read full answer below βQuestion
After npm i we can see that the level of vulnerabilities is unacceptable.
added 646 packages from 383 contributors and audited 762 packages in 7.892s
found 724 vulnerabilities (353 low, 23 moderate, 348 high)
run npm audit fix to fix them, or npm audit for details
I'm trying to fix the problem, at least locally. It will take a long time because every single specified package has a vulnerability.
Answers (4)
This is why veteran coders with decades of experience disapprove of JS as a back-end language. Javascript is not intended to be a server side language, and these node packages create vulnerabilities that get servers hacked. This is a serious security concern and should be addressed by the developer...
GrapesJS has a server-side layer?
Javascript is not intended to be a server side language, and these node packages create vulnerabilities that get servers hacked. Are you implying that Javascript is the only language where dependancies can introduce security vulnerabilities? If there's some trait of Javascript that makes these sort...
Thanks for reporting this, @AmtechInnovarch. Security and dependency issues are important. The GrapesJS team actively works on keeping dependencies up-to-date. For you right now: Run npm audit fix to see available patches Check for a newer GrapesJS version that may have already addressed this If av...
Related Questions and Answers
Continue research with similar issue discussions.
Issue #3443
Backbone-undo/underscore security advisory
Version: v0.17.3 Are you able to reproduce the bug from the demo?[x] Yes[ ] No What is the expected behavior? See below What is the current...
Issue #6687
Dependency: backbone-undo is deprecated (npm) β any plan to replace/remove?
GrapesJS version 0.22.14 (latest release as of 2025-11-20) What's the expected behavior? No deprecated dependencies in the GrapesJS install...
Issue #5743
XSS vulnerability in iframe attribute src
GrapesJS version [X] I confirm to use the latest version of GrapesJS What browser are you using? Edge v122 Reproducible demo link https://j...
Issue #6723
Dependency: grapesjs >=0.21.13 Depends on vulnerable versions of underscore
GrapesJS version [x] I confirm to use the latest version of GrapesJS What browser are you using? Edge, mozilla Reproducible demo link NA De...
Paid Plugins That Match This Issue
Curated by issue keywords and label relevance to help you ship faster.
Loading paid plugin recommendations...
Check the open-source GrapesJS plugins on GitHub or run a quick search in our free catalog.
Browse free plugins βPremium plugins ship with support, regular updates, and production-ready features β save days of integration work.
Browse premium plugins βRelated tutorials
In-depth guides on the same topic.
Tutorial
Superβ―Tooltip for GrapesJS β Versionβ―0.1.5 Released π
Weβre excited to announce the vβ―0.1.5 update of Superβ―Tooltip, our floatingβmenu and tooltip plugin for GrapesJS
Tutorial
GrapesJS in 2026: The Complete Guide to the Open-Source Web Builder Framework
Master GrapesJS in 2026. Architecture, code examples, React integration, plugin development, Studio SDK, and how it compares to other projects
Browse Plugin Categories
Jump directly to plugin category pages on the marketplace.