@chunliangl

YUI 2.5.1 is an old library with known security issues like CVE-2010-4207, CVE-2012-5881, and CVE-2012-5882, and it's no longer maintained. Since Pega 24.1 still includes parts of YUI in the classic UI stack, the best step is to raise a support ticket with Pega and check if these vulnerabilities have already been patched or isolated in their platform. Meanwhile, don’t use YUI in any of your custom code. If it’s already in use, plan to remove or replace it. You can also reduce the risk by enabling Content Security Policy (CSP) headers to block dangerous scripts. Always sanitize user inputs and run regular security scans on your app to catch any remaining exposure.