Skip to content

[Aikido] Fix security issue in js-yaml via minor version upgrade from 4.1.0 to 4.1.1#203

Closed
aikido-autofix[bot] wants to merge 1 commit intomasterfrom
fix/aikido-security-update-packages-12428511-1gK8
Closed

[Aikido] Fix security issue in js-yaml via minor version upgrade from 4.1.0 to 4.1.1#203
aikido-autofix[bot] wants to merge 1 commit intomasterfrom
fix/aikido-security-update-packages-12428511-1gK8

Conversation

@aikido-autofix
Copy link
Copy Markdown
Contributor

Upgrading js-yaml to address vulnerabilities. Changelog indicates no breaking changes are introduced and upgrading should be safe.

2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2025-64718
MEDIUM
js-yaml is a JavaScript YAML parser and dumper. In js-yaml 4.1.0 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-...
AIKIDO-2025-10809
MEDIUM
Affected versions of this package are vulnerable to Prototype Pollution, where the code insufficiently validates properties during merging by checking only own properties with _hasOwnProperty, allowing attackers to craft malicious YAML input that injects keys like __proto__ or constructor into t...

@aikido-autofix
Copy link
Copy Markdown
Contributor Author

Closed by Aikido: a new AutoFix has been created → #217

@aikido-autofix aikido-autofix Bot closed this Apr 23, 2026
@aikido-autofix aikido-autofix Bot deleted the fix/aikido-security-update-packages-12428511-1gK8 branch April 23, 2026 10:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants