fix(deps): benderbot round 3 — fast-xml-parser, postcss, protobufjs CVEs - #315
Merged
Merged
Conversation
…26-73569) VULN-112041 / CVE-2026-73569 (SEC_HIGH): fast-xml-parser 5.9.3 through 5.10.0 resets maxTotalExpansions and maxExpandedLength on every addInputEntities() call, so a document with repeated DOCTYPE declarations can reset the entity-expansion limits mid-parse and drive CPU/memory exhaustion. Fixed in 5.10.1; the lock now resolves 5.11.1, the current 5.x release. `npm update fast-xml-parser --package-lock-only`. The package.json range (^5.7.0) already permits it, so only package-lock.json changes; the diff is confined to fast-xml-parser and its own dependency subtree (@nodable/entities 3.0.0, is-unsafe 2.0.2, path-expression-matcher 1.6.2, strnum 2.4.2, nested xml-naming 0.3.0). A follow-up `npm install --package-lock-only` produces no further churn. Claude-Session: https://claude.ai/code/session_01MYw1R8CjHyKA8ZWWAo6wjK
VULN-112040: postcss loadMap() in lib/previous-map.js passes attacker- controlled sourceMappingURL values into join(dirname(opts.from), annotation) and loadFile() accepts traversed or absolute .map paths, so untrusted CSS processed without `map: false` can leak sourcesContent from arbitrary reachable .map files via result.map. CVE-2026-73646 is fixed in 8.5.18; the ticket's remediation floor is 8.5.23 (also covers CVE-2026-69153). - src/react-native-app: 8.5.16 -> 8.5.26 (the ticket's originPath) - src/frontend: 8.5.19 -> 8.5.26 (same dependency, also below the 8.5.23 floor, so it would surface on the next scan) `npm update postcss --package-lock-only` in each. Both package.json ranges are already ^8.5.10, so only the lockfiles change and each diff is the four version/resolved/integrity lines of the postcss entry. Claude-Session: https://claude.ai/code/session_01MYw1R8CjHyKA8ZWWAo6wjK
…2026-59877) VULN-112039 / CVE-2026-59877 (SEC_HIGH): protobufjs advances through schema tokens looking for `=` when parsing an option name without checking for end of input, so a truncated .proto that opens an option declaration makes parse, Root.load and Root.loadSync spin forever. Fixed in 7.6.5 and 8.6.6. src/react-native-app/package-lock.json held two vulnerable copies: - node_modules/@opentelemetry/otlp-transformer/node_modules/protobufjs 8.6.5 -> 8.8.0 (the version the ticket flags) - node_modules/protobufjs 7.6.4 -> 7.6.6 (below the 7.6.5 fix on the 7.x line) `npm update protobufjs --package-lock-only`; lockfile only, and the diff is just the version/resolved/integrity lines of those two entries. src/frontend and src/payment were checked and already resolve fixed versions (root 7.6.5, @splunk/otel nested 8.7.1), so they need no change. Claude-Session: https://claude.ai/code/session_01MYw1R8CjHyKA8ZWWAo6wjK
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Benderbot round 3. Three FOSSA/VULN tickets, all lockfile-only dependency bumps — no source changes.
Notes:
npm update <pkg> --package-lock-only; every affectedpackage.jsonrange already permitted the fixed version, so only lockfiles change.src/frontendwas at 8.5.19, above the CVE-2026-73646 fix (8.5.18) but below the ticket's 8.5.23 floor covering CVE-2026-69153, so it is bumped in the same commit rather than waiting to be filed separately.src/frontendandsrc/paymentalready resolve fixed versions and are untouched.Also triaged in this round, no change made:
src/secureapp-loadgen, an intentional demo vulnerability. Won't Fix per the standing SecureApp guidance.splunk/bank-of-splunk, which was archived on 2026-08-24 and is read-only. The fix is prepared locally but cannot be pushed.https://claude.ai/code/session_01MYw1R8CjHyKA8ZWWAo6wjK