diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 90caef5ae..fdfcde4ea 100755
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -266,6 +266,28 @@ jobs:
             -w /workspace/apps/web \
             docker.m.daocloud.io/library/node:20 \
             sh -lc 'npx vitest run src/test'
+
+      - name: Run npm audit (high severity)
+        continue-on-error: true
+        shell: sh
+        run: |
+          set +e
+          echo "=== npm audit 检查 (high 级别及以上) ==="
+          docker run --rm \
+            -v "$PWD:/workspace" \
+            -w /workspace/apps/web \
+            docker.m.daocloud.io/library/node:20 \
+            sh -lc 'npm audit --audit-level=high'
+          AUDIT_EXIT=$?
+          if [ "$AUDIT_EXIT" -ne 0 ]; then
+            echo ""
+            echo "⚠️  npm audit 发现 high 级别漏洞，请关注（当前为告警模式，不阻断 CI）"
+            echo "建议后续根据存量漏洞情况决定是否设置为阻断"
+          else
+            echo "✅ npm audit 未发现 high 级别漏洞"
+          fi
+          exit 0
+
   deploy-staging:
     name: Build & Push Staging (Watchtower auto-deploy)
     runs-on: saas