Fix vulnerabilities - #417
Conversation
|
|
📝 WalkthroughWalkthroughUpdates ChangesDependency scan updates
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.trivyignore:
- Around line 36-37: Replace the vulnerability-ID-only entries in .trivyignore
with package-scoped suppression entries for the specific patched brace-expansion
versions 1.1.17, 2.1.3, and 5.0.8, using .trivyignore.yaml or an equivalent
local override that targets only those installed versions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: b953ccf3-93d4-4c76-8bfe-883ad332db22
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (3)
.github/workflows/main.yml.trivyignorepackage.json
| CVE-2026-14257 exp:2026-08-12 | ||
| GHSA-mh99-v99m-4gvg exp:2026-08-12 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|/)(\.trivyignore|\.trivyignore\.ya?ml|trivyignore)' || true
echo "== .trivyignore relevant =="
if [ -f .trivyignore ]; then
nl -ba .trivyignore | sed -n '25,45p'
fi
echo "== repo references brace-expansion / advisories =="
rg -n "brace-expansion|CVE-2026-14257|GHSA-mh99-v99m-4gvg" . --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' || true
echo "== lock/package manifests =="
git ls-files | rg '(^|/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb|bun\.lock|go\.mod|go\.sum|Cargo\.lock|Gemfile\.lock|composer\.lock|poetry\.lock)$' || trueRepository: silverlogic/baseapp-frontend
Length of output: 259
🌐 Web query:
GitHub Advisory GHSA-mh99-v99m-4gvg brace-expansion fixed version CVE-2026-14257
💡 Result:
The brace-expansion package is vulnerable to a denial-of-service (DoS) attack through memory exhaustion, tracked as CVE-2026-14257 and GHSA-mh99-v99m-4gvg [1][2][3]. Versions through 5.0.7 are affected [1][2][4]. The vulnerability is fixed in version 5.0.8, which introduces a new maxLength option (defaulting to 4,000,000) to bound the total accumulated output and intermediate arrays, preventing uncatchable out-of-memory (OOM) crashes caused by unbounded expansion length [5][1][2]. While the advisory lists versions <= 5.0.7 as vulnerable, note that separate patches have been issued for older release branches (e.g., 1.1.16, 2.1.2, 3.0.2, 4.0.1) [6]. Users are encouraged to check for the latest patched version on their specific release branch [6].
Citations:
- 1: https://www.cve.org/CVERecord?id=CVE-2026-14257
- 2: https://nvd.nist.gov/vuln/detail/CVE-2026-14257
- 3: GHSA-mh99-v99m-4gvg
- 4: https://osv.dev/vulnerability/CVE-2026-14257
- 5: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg
- 6: Advisory GHSA-mh99-v99m-4gvg uses <=5.0.7 range which matches patched versions on lower branches juliangruber/brace-expansion#131
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== .trivyignore contents =="
python3 - <<'PY'
from pathlib import Path
p = Path(".trivyignore")
for i, line in enumerate(p.read_text().splitlines(), 1):
if 25 <= i <= 45:
print(f"{i:4d}\t{line}")
PY
echo "== all references =="
grep -RInE "brace-expansion|CVE-2026-14257|GHSA-mh99-v99m-4gvg" . --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=build --exclude-dir=.git || true
echo "== lock manifests =="
git ls-files | grep -E '(^|/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lock|go\.mod|go\.sum|Cargo\.lock|Gemfile\.lock|composer\.lock|poetry\.lock)$' || trueRepository: silverlogic/baseapp-frontend
Length of output: 2261
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== brace-expansion versions in lock manifests =="
python3 - <<'PY'
from pathlib import Path
for p in ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "go.mod", "go.sum", "Cargo.lock", "Gemfile.lock", "composer.lock", "poetry.lock"]:
if not Path(p).exists():
continue
text = Path(p).read_text(errors="ignore")
print(f"\n-- {p} --")
for line in text.splitlines():
if "brace-expansion" in line:
print(line)
PYRepository: silverlogic/baseapp-frontend
Length of output: 592
🌐 Web query:
github/advisory-database PR #8832 brace-expansion CVE-2026-14257 branch ranges 1.1.17 2.1.3
💡 Result:
CVE-2026-14257 is a high-severity (CVSS 7.5) denial-of-service vulnerability affecting the brace-expansion library [1][2]. It is caused by an unbounded expansion length in the expand function, which allows an attacker to trigger a fatal, uncatchable Node.js out-of-memory error by providing specially crafted brace patterns, even if the result count is within the default max limit [1][3][4]. The GitHub Advisory Database entry GHSA-mh99-v99m-4gvg identifies the vulnerability and tracks its remediation [1][3]. The primary fix was introduced in version 5.0.8, which adds a configurable maxLength option (default 4,000,000) to bound the total accumulated output [1][2]. Regarding the version ranges mentioned (1.1.17 and 2.1.3): - The advisory initially defined a broad vulnerable range (<=5.0.7) because automated tools and vulnerability scanners (e.g., npm audit, pnpm audit, osv-scanner) were flagging all major version branches (1.x, 2.x, 3.x, 4.x) as vulnerable [5]. - Maintainers have been actively working on backporting the fix to these older release branches [6][5]. GitHub PR #8832 in the advisory database has been updated to track these backports [6]. - As of July 2026, versions such as 1.1.16 and 2.1.2 were known to be vulnerable [5]. The specific versions 1.1.17 and 2.1.3 are intended to be the patched releases for their respective branches [1]. Users are advised to upgrade to the latest available release for their branch or to 5.0.8+ to mitigate the crash [1][3].
Citations:
- 1: GHSA-mh99-v99m-4gvg
- 2: https://www.cve.org/CVERecord?id=CVE-2026-14257
- 3: GHSA-mh99-v99m-4gvg
- 4: https://osv.dev/vulnerability/CVE-2026-14257
- 5: Advisory GHSA-mh99-v99m-4gvg uses <=5.0.7 range which matches patched versions on lower branches juliangruber/brace-expansion#131
- 6: fix: backport GHSA-mh99-v99m-4gvg juliangruber/brace-expansion#129
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== .trivyignore package versions =="
python3 - <<'PY'
from pathlib import Path
for i, line in enumerate(Path(".trivyignore").read_text().splitlines(), 1):
if 10 <= i <= 38:
print(f"{i:4d}\t{line}")
PYRepository: silverlogic/baseapp-frontend
Length of output: 1926
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
# Read advisory/ranges from the repository, without executing repository code.
advisory = Path(".github/advisories/GHSA-mh99-v99m-4gvg.json").read_text() if Path(".github/advisories/GHSA-mh99-v99m-4gvg.json").exists() else None
advisories_path = Path(".github/advisories")
cve_path = Path(".github/advisories/CVE-2026-14257.json") if Path(".github/advisories/CVE-2026-14257.json").exists() else None
print("repo_advisory_exists=", Path(".github/advisories/GHSA-mh99-v99m-4gvg.json").exists())
print("repo_cve_exists=", cve_path and cve_path.exists())
if cve_path:
print("cve_text_head=")
print(cve_path.read_text(errors="ignore").splitlines()[:80])
if advisory:
print("ghsa_text_head=")
print(advisory.splitlines()[:80])
# Inspect override resolution in package files for brace-expansion constraints.
json_path = Path("package.json")
if json_path.exists():
pkg = json_path.read_text()
for pattern in ["brace-expansion@^1.0.0", "brace-expansion@^2.0.0", "brace-expansion@^5.0.0"]:
print(f"{json_path}: contains {pattern}= {'true'}")
idx = pkg.find(json.dumps({"brace-expansion@^1.0.0": ""}).replace('""','"')) or pkg.find('"brace-expansion')
PYRepository: silverlogic/baseapp-frontend
Length of output: 380
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== lockfile braces relevant =="
python3 - <<'PY'
from pathlib import Path
text = Path("pnpm-lock.yaml").read_text(errors="ignore").splitlines()
for i, line in enumerate(text, 1):
if 502 <= i <= 504 or 6229 <= i <= 6236 or 18314 <= i <= 18324 or 22959 <= i <= 22968:
print(f"{i:5d}\t{line}")
PY
echo "== package.json brace overrides =="
python3 - <<'PY'
from pathlib import Path
import json
pkg = json.loads(Path("package.json").read_text())
for key, value in [
("overrides", pkg.get("overrides", {})),
("resolutions", pkg.get("resolutions", {})),
("pnpm.overrides", pkg.get("pnpm", {}).get("overrides", {})),
]:
if not value:
continue
print(f"-- {key} --")
for k, v in value.items():
if "brace-expansion" in k or "brace-expansion" in str(v):
print(k, "=", v)
PYRepository: silverlogic/baseapp-frontend
Length of output: 1514
Scope the suppression to the patched brace-expansion versions.
.trivyignore treats these by vulnerability ID only, so future lockfiles that reintroduce vulnerable brace-expansion ranges (such as <1.1.17, <2.1.3, or the broad mainline range) would also be hidden. Use package-scoped .trivyignore.yaml entries, e.g. pkg:npm/brace-expansion@1.1.17, pkg:npm/brace-expansion@2.1.3, and pkg:npm/brace-expansion@5.0.8, or keep a local override patch that targets only the installed versions.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.trivyignore around lines 36 - 37, Replace the vulnerability-ID-only entries
in .trivyignore with package-scoped suppression entries for the specific patched
brace-expansion versions 1.1.17, 2.1.3, and 5.0.8, using .trivyignore.yaml or an
equivalent local override that targets only those installed versions.
|
@priscilladeroode I think we should close this PR without merging, since it was fixed on the comments epic PR I merged last week. |
2 participants
Summary by CodeRabbit
Bug Fixes
Chores