[Aikido] Fix 4 security issues in @babel/traverse, aws-sdk, @actions/core

[aikido-autofix]

Upgrade dependencies to fix remote code execution in Babel compilation, prototype pollution in XML parsing, and environment variable injection vulnerabilities in GitHub Actions.

✅ 4 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2025-10745	MEDIUM	[@babel/traverse] A vulnerability allows remote code execution during compilation when processing malicious input with certain plugins that use internal evaluation methods. This affects plugins like @babel/plugin-transform-runtime and @babel/preset-env with useBuiltIns option.
CVE-2023-0842	MEDIUM	[xml2js] version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
CVE-2020-15228	MEDIUM	[@actions/core] Untrusted data logged to stdout can be interpreted as runner commands, allowing attackers to modify environment variables and PATH without authorization. This enables arbitrary code execution through workflow manipulation.
CVE-2022-35954	MEDIUM	[@actions/core] The core.exportVariable function uses a predictable delimiter that attackers can exploit to break out of variables and assign arbitrary values to other environment variables, potentially modifying the path or other critical variables. This allows arbitrary environment variable injection when untrusted values are written to GITHUB_ENV.

[aikido-pr-checks]

CVE-2026-22036 in undici - high severity
Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0.

Details

Remediation Aikido suggests bumping this package to version 6.23.0 to resolve this issue

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
More info