Issues · cdk8s-team/cdk8s-cli

[MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

cdk8s-team/cdk8s-cli#4118 · opened

on Sep 6, 2026

[HIGH] brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

cdk8s-team/cdk8s-cli#4045 · opened

on Jul 28, 2026

[HIGH] fast-uri vulnerable to host confusion via literal backslash authority delimiter

cdk8s-team/cdk8s-cli#4040 · opened

on Jul 25, 2026

[MEDIUM] JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

cdk8s-team/cdk8s-cli#3988 · opened

on Jun 19, 2026

[MEDIUM] uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

cdk8s-team/cdk8s-cli#3891 · opened

on Apr 26, 2026

[MEDIUM] follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

cdk8s-team/cdk8s-cli#3878 · opened

on Apr 18, 2026

[MEDIUM] lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

cdk8s-team/cdk8s-cli#3866 · opened

on Apr 5, 2026

[HIGH] lodash vulnerable to Code Injection via `_.template` imports key names

cdk8s-team/cdk8s-cli#3865 · opened

on Apr 5, 2026

[MEDIUM] Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry

cdk8s-team/cdk8s-cli#3860 · opened

on Apr 2, 2026

[LOW] Handlebars.js has a Property Access Validation Bypass in container.lookup

cdk8s-team/cdk8s-cli#3861 · opened

on Apr 2, 2026

[CRITICAL] Handlebars.js has JavaScript Injection via AST Type Confusion

cdk8s-team/cdk8s-cli#3855 · opened

on Mar 30, 2026

[HIGH] Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

cdk8s-team/cdk8s-cli#3853 · opened

on Mar 30, 2026

[HIGH] Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

cdk8s-team/cdk8s-cli#3852 · opened

on Mar 30, 2026

[HIGH] Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

cdk8s-team/cdk8s-cli#3854 · opened

on Mar 30, 2026

[MEDIUM] Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

cdk8s-team/cdk8s-cli#3849 · opened

on Mar 29, 2026

[HIGH] flatted vulnerable to unbounded recursion DoS in parse() revive phase

cdk8s-team/cdk8s-cli#3831 · opened

on Mar 17, 2026

[LOW] @tootallnate/once vulnerable to Incorrect Control Flow Scoping

cdk8s-team/cdk8s-cli#3829 · opened

on Mar 7, 2026

[LOW] fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

cdk8s-team/cdk8s-cli#3828 · opened

on Mar 6, 2026

[HIGH] minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

cdk8s-team/cdk8s-cli#3827 · opened

on Mar 3, 2026

[HIGH] minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

cdk8s-team/cdk8s-cli#3826 · opened

on Mar 3, 2026

[HIGH] minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

cdk8s-team/cdk8s-cli#3825 · opened

on Mar 3, 2026

[HIGH] minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

cdk8s-team/cdk8s-cli#3824 · opened

on Feb 22, 2026

[HIGH] fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

cdk8s-team/cdk8s-cli#3823 · opened

on Feb 21, 2026

CRD import fails when kind name matches TypeScript built-in type (e.g., Record)

cdk8s-team/cdk8s-cli#3800 · opened

on Feb 3, 2026

Multiple CRD imports from same API group overwrite each other

cdk8s-team/cdk8s-cli#3797 · opened

on Feb 3, 2026