Skip to content

[Aikido] Fix 7 security issues in lodash, @babel/traverse, ajv and 2 more#1

Open
aikido-autofix[bot] wants to merge 1 commit intomasterfrom
fix/aikido-security-update-packages-18842197-6kly
Open

[Aikido] Fix 7 security issues in lodash, @babel/traverse, ajv and 2 more#1
aikido-autofix[bot] wants to merge 1 commit intomasterfrom
fix/aikido-security-update-packages-18842197-6kly

Conversation

@aikido-autofix
Copy link

@aikido-autofix aikido-autofix bot commented Mar 10, 2026

Upgrade dependencies to fix prototype pollution in lodash, RCE in @babel/traverse, prototype pollution in ajv, ReDoS in ajv, and ReDoS in ansi-regex.

✅ Code not affected by breaking changes.

The upgrade from lodash 4.17.15 to 4.17.23 does not introduce any breaking changes that affect this codebase. The changelog entry describes a security fix for the _.template method, which is not used anywhere in the codebase. This is a security patch rather than a breaking change, and it has no impact on the existing code.

All breaking changes by upgrading lodash from version 4.17.15 to 4.17.23 (CHANGELOG)

Version Description
4.17.20
Prevent command injection through _.template's variable option
✅ 7 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
NSWG-ECO-516
HIGH
[lodash] Prototype pollution attack (lodash)
CVE-2025-13465
MEDIUM
[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.
AIKIDO-2025-10745
MEDIUM
[@babel/traverse] A vulnerability allows remote code execution during compilation when processing malicious input with certain plugins that use internal evaluation methods. This affects plugins like @babel/plugin-transform-runtime and @babel/preset-env with useBuiltIns option.
CVE-2020-15366
MEDIUM
[ajv] A prototype pollution vulnerability in the validate() function allows arbitrary code execution through a maliciously crafted JSON schema. This enables remote code execution when processing untrusted schemas, exceeding the expected denial of service impact.
CVE-2025-69873
LOW
[ajv] A ReDoS vulnerability allows attackers to inject malicious regex patterns via the $data option, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal effort.
CVE-2021-3807
LOW
[ansi-regex] is vulnerable to Inefficient Regular Expression Complexity
CVE-2022-25883
LOW
[semver] Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

0 participants