What is a dependency vulnerability?
A dependency vulnerability is a known security hole in one of the packages your app is built on. Your app is mostly other people's code, and when a flaw is found in it, the details are published, so attackers know exactly what to look for. The usual fix is to update to a patched version.
ON THIS PAGE
What it means
Even a small app pulls in hundreds of packages, including the packages those packages use. A flaw in any of them is a flaw in your app.
Each known flaw gets a public entry and a severity rating. Tools compare your package list with those entries and tell you which ones affect you.
Why it matters for vibe-coded apps
AI tools often pin older versions they learned about in training, and nobody revisits them once the app works.
- Attackers scan for apps using versions with known holes.
- You may be exposed for months without any visible sign.
- Fixes are usually free and quick, but only if you know they exist.
Example
Checking a Node.js project.
$ npm audit
lodash <4.17.21
Severity: high
Command Injection in lodash$ npm audit fix
$ npm audit
found 0 vulnerabilitiesRun your tests after updating, because newer versions can occasionally change behaviour.
How to check if your app has this problem
- 1Run npm audit (or pip-audit for Python) in your project folder.
- 2Look for Dependabot alerts in your GitHub repository.
- 3Run a full check, which reads your package files and reports known issues.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Update the flagged packages to the fixed version, starting with high and critical ones.
- 2Run your tests and click through the app to catch anything that changed.
- 3Turn on Dependabot or a similar tool so new problems are reported to you.
- 4Remove packages you no longer use.
Run npm audit on my project and list every vulnerability with its severity, the package affected and the fixed version. Update the packages that can be fixed without breaking changes, run the tests, and tell me about any that need a major version upgrade before changing them. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for dependency vulnerability issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Hallucinated packagesAdd-ons an AI suggests that don't exist, or that attackers have since created.
- SQL injectionAn attacker types database commands into your app and it runs them.
- Cross-site scripting (XSS)Someone sneaks code into your pages that runs in other users' browsers.
- Security headersSettings your site sends that tell browsers how to protect visitors.
Related reading
Need help?
Not sure what this means for your app? Our team will explain it in plain English.