Vulnerability
Severity: HIGH (CVSS 7.5)
Package: js-yaml@3.14.2
Advisory: GHSA-52cp-r559-cp3m / CVE-2026-59869
Affected component: core
Dependency type: direct (core/package.json devDependencies → "js-yaml": "^3.14.2")
Description
js-yaml's parser is vulnerable to a denial-of-service attack via YAML merge-key chains — "a chain of mappings where each mapping merges the previous one" forces O(N²) computational work during parsing, even though the input document is only linearly sized. A crafted YAML file can cause significant CPU consumption / stalling wherever this dependency parses untrusted YAML.
Fix
Recommended version: js-yaml ≥3.15.0 (or ≥4.3.0 if upgrading the major line)
Fix command:
cd core && npm update js-yaml
core/package.json pins "^3.14.2", which already permits 3.15.0+ without a manifest change.
Risk Assessment
Direct devDependency of core. Need to confirm where js-yaml is actually invoked (e.g. OpenAPI spec loading in core/specs or the SDK generation scripts) — if it only parses first-party YAML files under repo control, exploitability is low. If it's ever used to parse YAML from an external or user-supplied source, this becomes a real DoS vector.
Found by automated dependency vulnerability scan
Vulnerability
Severity: HIGH (CVSS 7.5)
Package: js-yaml@3.14.2
Advisory: GHSA-52cp-r559-cp3m / CVE-2026-59869
Affected component: core
Dependency type: direct (
core/package.jsondevDependencies →"js-yaml": "^3.14.2")Description
js-yaml's parser is vulnerable to a denial-of-service attack via YAML merge-key chains — "a chain of mappings where each mapping merges the previous one" forces O(N²) computational work during parsing, even though the input document is only linearly sized. A crafted YAML file can cause significant CPU consumption / stalling wherever this dependency parses untrusted YAML.
Fix
Recommended version: js-yaml ≥3.15.0 (or ≥4.3.0 if upgrading the major line)
Fix command:
core/package.jsonpins"^3.14.2", which already permits 3.15.0+ without a manifest change.Risk Assessment
Direct devDependency of
core. Need to confirm wherejs-yamlis actually invoked (e.g. OpenAPI spec loading incore/specsor the SDK generation scripts) — if it only parses first-party YAML files under repo control, exploitability is low. If it's ever used to parse YAML from an external or user-supplied source, this becomes a real DoS vector.Found by automated dependency vulnerability scan