Page 20
A high-severity algorithmic complexity vulnerability (GHSA-5p4m-2wfm-xmqj) in js-yaml versions 3.x through 4.3.0 allows attackers to trigger quadratic CPU consumption through specially crafted `!!omap` YAML sequences. The fix upgrades js-yaml to 4.3.1 using a pnpm override in the `e2e/adapter/claude-code` package, ensuring all transitive dependencies also receive the patched version. This proactive patch eliminates an exploit primitive before it can be chained with other weaknesses.
A high-severity SQL injection vulnerability was discovered in `scripts/setup-d1.mjs`, where migration filenames were directly concatenated into SQL INSERT statements using an inadequate `escapeSqlString` function. An attacker with filesystem write access could craft a malicious filename to execute arbitrary SQL commands against the Cloudflare D1 database. The fix replaces string concatenation with parameterized queries, eliminating the injection surface entirely.
A critical resource exhaustion vulnerability was discovered in the `dsh-plugin-marketplace` GitHub client where multiple `fetch()` calls in `lib/index.js` lacked timeout configuration. While one fetch call at line 1161 correctly used `AbortSignal.timeout()`, other calls at lines 101 and 145 had no timeout mechanism, allowing attackers to exhaust connection pools by targeting slow or unresponsive GitHub API endpoints. The fix ensures all fetch operations consistently apply the configurable `regis
A high-severity Denial of Service vulnerability (CVE-2026-59725) was discovered in engine.io versions prior to 6.6.7, where invalid binary POST requests could crash Socket.IO servers. The fix upgrades engine.io from 6.6.5 to 6.6.7, which includes improved validation for binary packet handling and prevents malformed requests from taking down real-time communication channels.
A URL injection vulnerability in `lib/client.js` allowed user-controlled `repo`, `branch`, and `file` parameters to be interpolated directly into fetch URLs without encoding, enabling potential URL manipulation and request hijacking. The fix introduces per-segment percent-encoding via a new `encodePathSegments` helper, neutralizing special characters before they reach the URL construction layer. This closes an exploit primitive that automated attack tooling could chain with other weaknesses.
A critical file type validation vulnerability in `src/js/insert.js` allowed attackers to rename malicious executables with image extensions and bypass security checks. The fix implements magic byte verification to confirm actual file content matches the declared file type, preventing attackers from disguising dangerous files as harmless images.
The tmp package version 0.0.33 contained a high-severity path traversal vulnerability (CVE-2026-44705) that allowed attackers to escape temporary directories through unsanitized prefix and postfix parameters. This reddit-app project was upgraded from tmp 0.0.33 to 0.2.7, which implements proper input sanitization to prevent directory traversal attacks and removes the deprecated os-tmpdir dependency.
CVE-2026-69152 is a high-severity Denial-of-Service vulnerability in the `brace-expansion` npm package, where crafted input strings cause the library to generate unbounded intermediate arrays that exhaust memory and CPU—bypassing the earlier CVE-2026-14257 mitigation. The fix upgrades `brace-expansion` across all affected version branches (1.x, 2.x, 3.x, 5.x) and pins the safe version in `package.json` to prevent regression.
A critical vulnerability (CVE-2026-54466) was discovered in the `websocket-driver` dependency (version 0.7.4), which handles WebSocket protocol framing and I/O. The fix upgrades the package to version 0.7.5 via an npm override in `package.json` and an updated lockfile, closing a WebSocket frame-parsing flaw that could allow attackers to inject or manipulate WebSocket traffic. This dependency-level fix is essential because the vulnerable library sits in the application's dependency tree and proce
CVE-2026-54290 is a HIGH severity CORS misconfiguration in the Hono web framework where the CORS middleware incorrectly reflects any `Origin` header back to the client — including credentials — when the `origin` option defaults to a wildcard. Upgrading `hono` from `4.12.16` to `4.12.34` in `package-lock.json` and pinning the version via `overrides` in `package.json` closes the vulnerability. Left unpatched, this flaw could allow malicious cross-origin sites to make credentialed requests and read
The `ip-address` library version 10.2.0 contained a critical parsing inconsistency where the `Address4` decoder interpreted leading-zero octets as decimal numbers, while most DNS resolvers and network systems interpreted them as octal. This mismatch allowed attackers to bypass IP-based access controls and SSRF filters. Upgrading to version 10.3.1 fixes this vulnerability by aligning the library's parsing behavior with standard resolver behavior.
A critical vulnerability (CVE-2026-54466) was discovered in websocket-driver version 0.7.4, a WebSocket protocol handler used in the dependency tree. The vulnerability allowed attackers to exploit flaws in WebSocket frame parsing, potentially leading to denial of service or protocol-level attacks. The fix upgraded websocket-driver to version 0.7.5, which patches the protocol handling vulnerabilities and hardens input validation for untrusted WebSocket frames.