@clerk/shared

Internal package utils used by the Clerk SDKs

Latest 4.40.0

91%

Total Score

healthy

Frequent releases, active contributors, and organization backing outweigh workflow hygiene findings and the weak repository package match.

Are you affected? Scan for Free

Health Score Breakdown

Repo package mention

The repository name does not match this sub-package and its README does not mention @clerk/shared, so the package-to-repository linkage is less transparent than ideal, despite the organization match.

Workflow audit

All 16 workflows were analyzed with no unpinned actions, untrusted checkouts, or script-injection findings. High-confidence template-injection findings and ad hoc package installs remain workflow hygiene concerns, but no corroborating dangerous trigger or sink is shown.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-420462 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @clerk/shared is vulnerable to Cross-site Scripting (XSS) in versions 0.0.1 - 4.25.4.	0.0.1 - 4.25.4	High
CVE-2026-42349 @clerk/shared is vulnerable to Improper Check for Unusual or Exceptional Conditions in versions 3.0.0 - 3.47.4 and 4.0.0 - 4.8.2.	3.0.0 - 3.47.44.0.0 - 4.8.2	High
AIKIDO-2024-10212 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @clerk/shared is vulnerable to Cross-site Scripting (XSS) in versions 0.0.1 - 2.4.5.	0.0.1 - 2.4.5	Low