Security vulnerabilities and automated fixes for yaml issues
21 posts found
A GitHub Actions workflow file contained a critical shell injection vulnerability where user-controlled inputs were directly interpolated into a shell command using `${{ }}` syntax. By moving the untrusted data into environment variables and properly quoting them, the vulnerability was eliminated while preserving all functionality.
A Dependabot configuration in `.github/dependabot.yml` was missing a `cooldown` block, meaning dependency updates could be proposed immediately after a new package version was published — including potentially malicious or unstable releases. Adding a `cooldown` with `default-days: 7` ensures a 7-day waiting period before Dependabot opens pull requests for newly published versions, giving the security community time to detect and flag compromised packages.
A Node.js library's `.github/dependabot.yml` was configured to automatically propose dependency updates without any cooldown period, meaning a freshly published — potentially malicious or unstable — package version could be surfaced as a PR within minutes of release. By adding a `cooldown` block with `default-days: 7` to each of the three `package-ecosystem` entries (GitHub Actions, npm, and Composer), the project now waits one week before suggesting any new package version. This single configur
A missing `cooldown` block in the Dependabot configuration for a Node.js project left it exposed to potentially malicious or unstable newly published packages. By adding a `cooldown: default-days: 7` setting, the project now waits seven days before proposing updates, giving the security community time to identify and flag compromised packages before they reach your codebase.
A high-severity denial-of-service vulnerability (GHSA-5p4m-2wfm-xmqj) was discovered in js-yaml affecting both the 3.x and 4.x branches, where parsing YAML documents containing `!!omap` tags triggers quadratic CPU consumption. The fix upgrades js-yaml from `^4.1.1` to `5.2.0` in the project's GitHub Actions workflow dependencies, closing the attack surface for any untrusted YAML input processed by CI/CD tooling.
A GitHub Actions workflow in `templates/devto/devto-readme.yml` referenced `actions/checkout@v4` and `actions/setup-node@v4` using mutable version tags instead of pinned commit SHAs. This pattern enables supply-chain attacks where a compromised action owner silently repoints a tag to malicious code. The fix pins both actions to their full 40-character commit SHAs while preserving version comments for maintainability.
A high-severity shell injection vulnerability was discovered in `setup-js/action.yml` where direct interpolation of `inputs.package-manager` in a `run:` step could allow attackers to execute arbitrary code on the GitHub Actions runner. The fix introduces intermediate environment variables to safely pass user-controlled inputs, preventing command injection while maintaining the same functionality.
A high-severity shell injection vulnerability was discovered in `action.yml` at line 68, where GitHub Actions `${{ inputs.* }}` expressions were directly interpolated into `run:` shell scripts. An attacker who controls input values (like a URL or app name) could inject arbitrary shell commands into the CI runner, potentially stealing secrets and source code. The fix replaces all direct interpolations with intermediate environment variables, properly quoted to prevent injection.
A high-severity denial-of-service vulnerability in js-yaml versions 3.x and 4.x allowed attackers to trigger quadratic CPU consumption through specially crafted YAML documents using the !!omap tag. This fix upgrades js-yaml from 4.1.1 to 4.3.1 and from 3.14.2 to 3.15.1, eliminating the algorithmic complexity attack vector that could freeze Node.js applications processing untrusted YAML input.
A GitHub Actions workflow was using `actions/checkout@v1`, a mutable tag reference that could be silently repointed by the action owner to inject malicious code. This supply-chain vulnerability was fixed by pinning the action to a specific commit SHA (`11bd71901bbe5b1630ceea73d27597364c9af683`), ensuring the workflow always executes verified, immutable code.
A high-severity vulnerability in js-yaml versions 3.x and 4.x allowed attackers to cause quadratic CPU consumption through specially crafted YAML documents using the `!!omap` type. This denial-of-service vulnerability (GHSA-5p4m-2wfm-xmqj) was fixed by upgrading from js-yaml 4.3.0 to 4.3.1, protecting applications from algorithmic complexity attacks during YAML parsing.
A high-severity denial-of-service vulnerability in js-yaml (GHSA-5p4m-2wfm-xmqj) caused quadratic CPU consumption when resolving `!!omap` (ordered map) YAML tags, affecting both the 3.x and 4.x release lines. Upgrading to js-yaml 4.3.1 or 3.15.1 closes the gap by fixing the algorithmic inefficiency in `!!omap` duplicate-key detection. Any application that parses untrusted YAML input is at risk of resource exhaustion leading to service unavailability.