This might be a false positive, but site/package-lock.json around line 3546 looked worth a second pair of eyes.
js-yaml version 4.2.0 suffers from a CPU‑exhaustion vulnerability (CVE‑2026‑59869). When parsing YAML that contains a chain of merge keys, the library can enter a quadratic‑time algorithm, allowing an attacker to cause a denial‑of‑service with minimal input. This HIGH‑severity issue can be triggered via user‑controlled YAML data, leading to high CPU usage, service disruption, and potential resource exhaustion.
Something like this might fix it:
Upgrade js-yaml to version 4.3.0 (or ≥4.3.0) in package.json and run `npm install` to update package-lock.json.
For reference: rule CVE-2026-59869. Rated high.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
This might be a false positive, but
site/package-lock.jsonaround line 3546 looked worth a second pair of eyes.js-yaml version 4.2.0 suffers from a CPU‑exhaustion vulnerability (CVE‑2026‑59869). When parsing YAML that contains a chain of merge keys, the library can enter a quadratic‑time algorithm, allowing an attacker to cause a denial‑of‑service with minimal input. This HIGH‑severity issue can be triggered via user‑controlled YAML data, leading to high CPU usage, service disruption, and potential resource exhaustion.
Something like this might fix it:
For reference: rule
CVE-2026-59869. Rated high.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.