Issues

[LOW] deepmerge mergeObject() allows prototype poisoning of returned objects

cdk8s-team/cdk8s-cli#4207 · opened

on Oct 31, 2026

[HIGH] Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

cdk8s-team/cdk8s-cli#4204 · opened

on Oct 30, 2026

[MEDIUM] Withdrawn Advisory: sprintf-js vulnerable to denial of service through unbounded precision specifiers

cdk8s-team/cdk8s-cli#4189 · opened

on Oct 23, 2026

[HIGH] braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

cdk8s-team/cdk8s-cli#4163 · opened

on Oct 9, 2026

[MEDIUM] sprintf-js vulnerable to denial of service through unbounded precision specifiers

cdk8s-team/cdk8s-cli#4162 · opened

on Oct 9, 2026

[MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

cdk8s-team/cdk8s-cli#4118 · opened

on Sep 6, 2026

[HIGH] brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

cdk8s-team/cdk8s-cli#4045 · opened

on Jul 28, 2026

[HIGH] fast-uri vulnerable to host confusion via literal backslash authority delimiter

cdk8s-team/cdk8s-cli#4040 · opened

on Jul 25, 2026

[MEDIUM] JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

cdk8s-team/cdk8s-cli#3988 · opened

on Jun 19, 2026

[MEDIUM] uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

cdk8s-team/cdk8s-cli#3891 · opened

on Apr 26, 2026

[MEDIUM] follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

cdk8s-team/cdk8s-cli#3878 · opened

on Apr 18, 2026

[MEDIUM] lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

cdk8s-team/cdk8s-cli#3866 · opened

on Apr 5, 2026

[HIGH] lodash vulnerable to Code Injection via `_.template` imports key names

cdk8s-team/cdk8s-cli#3865 · opened

on Apr 5, 2026

[MEDIUM] Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry

cdk8s-team/cdk8s-cli#3860 · opened

on Apr 2, 2026

[LOW] Handlebars.js has a Property Access Validation Bypass in container.lookup

cdk8s-team/cdk8s-cli#3861 · opened

on Apr 2, 2026

[CRITICAL] Handlebars.js has JavaScript Injection via AST Type Confusion

cdk8s-team/cdk8s-cli#3855 · opened

on Mar 30, 2026

[HIGH] Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

cdk8s-team/cdk8s-cli#3853 · opened

on Mar 30, 2026

[HIGH] Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

cdk8s-team/cdk8s-cli#3852 · opened

on Mar 30, 2026

[HIGH] Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

cdk8s-team/cdk8s-cli#3854 · opened

on Mar 30, 2026

[MEDIUM] Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

cdk8s-team/cdk8s-cli#3849 · opened

on Mar 29, 2026

[HIGH] flatted vulnerable to unbounded recursion DoS in parse() revive phase

cdk8s-team/cdk8s-cli#3831 · opened

on Mar 17, 2026

[LOW] @tootallnate/once vulnerable to Incorrect Control Flow Scoping

cdk8s-team/cdk8s-cli#3829 · opened

on Mar 7, 2026

[LOW] fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

cdk8s-team/cdk8s-cli#3828 · opened

on Mar 6, 2026

[HIGH] minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

cdk8s-team/cdk8s-cli#3827 · opened

on Mar 3, 2026

[HIGH] minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

cdk8s-team/cdk8s-cli#3826 · opened

on Mar 3, 2026

Navigation Menu

Repository navigation

Issues

[LOW] deepmerge mergeObject() allows prototype poisoning of returned objects

[HIGH] Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

[MEDIUM] Withdrawn Advisory: sprintf-js vulnerable to denial of service through unbounded precision specifiers

[HIGH] braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

[MEDIUM] sprintf-js vulnerable to denial of service through unbounded precision specifiers

[MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

[HIGH] brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

[HIGH] fast-uri vulnerable to host confusion via literal backslash authority delimiter

[MEDIUM] JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

[MEDIUM] uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

[MEDIUM] follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

[MEDIUM] lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

[HIGH] lodash vulnerable to Code Injection via `_.template` imports key names

[MEDIUM] Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry

[LOW] Handlebars.js has a Property Access Validation Bypass in container.lookup

[CRITICAL] Handlebars.js has JavaScript Injection via AST Type Confusion

[HIGH] Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

[HIGH] Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

[HIGH] Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

[MEDIUM] Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

[HIGH] flatted vulnerable to unbounded recursion DoS in parse() revive phase

[LOW] @tootallnate/once vulnerable to Incorrect Control Flow Scoping

[LOW] fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

[HIGH] minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

[HIGH] minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions