Skip to content

[Aikido] Fix 5 security issues in yaml, minimatch, ajv#1633

Merged
TheOrangePuff merged 2 commits intomainfrom
fix/aikido-security-update-packages-20837274-m9em
Mar 30, 2026
Merged

[Aikido] Fix 5 security issues in yaml, minimatch, ajv#1633
TheOrangePuff merged 2 commits intomainfrom
fix/aikido-security-update-packages-20837274-m9em

Conversation

@aikido-autofix
Copy link
Copy Markdown
Contributor

Upgrade yaml, minimatch, and ajv to fix DoS vulnerabilities: yaml stack overflow from deeply nested structures, minimatch ReDoS from glob patterns with consecutive wildcards and globstars, and ajv ReDoS from unvalidated regex patterns.

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-33532
MEDIUM
[yaml] A stack overflow vulnerability in the compose/resolve phase allows attackers to trigger a RangeError via deeply nested YAML structures (~2–10 KB), potentially causing denial of service or process termination in applications that don't catch this unexpected exception type.
CVE-2026-26996
LOW
[minimatch] A Regular Expression Denial of Service (ReDoS) vulnerability exists when glob patterns contain many consecutive * wildcards followed by a literal character, causing exponential backtracking with O(4^N) complexity. Applications passing user-controlled strings as patterns to minimatch() are vulnerable to severe performance degradation or hangs.
CVE-2026-27903
LOW
[minimatch] A ReDoS vulnerability in glob pattern matching causes unbounded recursive backtracking with multiple GLOBSTAR segments, enabling attackers to stall the event loop for tens of seconds via crafted patterns in build tools, CI/CD pipelines, or multi-tenant systems.
CVE-2026-27904
LOW
[minimatch] Nested extglobs (*() and +()) generate regexps with catastrophic backtracking, causing severe ReDoS denial-of-service attacks with minimal input patterns triggering multi-second hangs.
CVE-2025-69873
LOW
[ajv] A ReDoS vulnerability allows attackers to inject malicious regex patterns via the $data option, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal effort.

@aikido-autofix aikido-autofix bot requested a review from a team as a code owner March 26, 2026 23:45
@TheOrangePuff TheOrangePuff force-pushed the fix/aikido-security-update-packages-20837274-m9em branch from 4ba1ca8 to ea7df8d Compare March 30, 2026 02:10
@TheOrangePuff TheOrangePuff merged commit 52d8cc8 into main Mar 30, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant