Skip to content
This repository was archived by the owner on Aug 5, 2026. It is now read-only.

[Aikido] Fix 9 security issues in lodash, @babel/traverse, ajv and 2 more - #2

Closed
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-21766471-d8hf
Closed

[Aikido] Fix 9 security issues in lodash, @babel/traverse, ajv and 2 more#2
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-21766471-d8hf

Conversation

@aikido-autofix

@aikido-autofix aikido-autofix Bot commented Apr 2, 2026

Copy link
Copy Markdown

Upgrade dependencies to fix critical RCE vulnerability in template compilation and prototype pollution attacks affecting code execution.

⚠️ Incomplete breaking changes analysis (3/5 analyzed)

⚠️ Breaking changes analysis not available for: @babel/traverse, ansi-regex

✅ No breaking changes from the lodash upgrade affect this codebase. The project does not use lodash as a direct dependency (it's not listed in package.json), and searches for _.unset(), _.omit(), and _.template() found no matches in the source code.

All breaking changes by upgrading lodash from version 4.17.15 to 4.18.1 (CHANGELOG)

Version Description
4.18.0
_.unset / _.omit now block constructor and prototype as non-terminal path keys unconditionally. Calls that previously returned true and deleted the property now return false and leave the target untouched.
4.18.0
_.template now throws "Invalid imports option passed into _.template" when imports keys contain forbidden identifier characters, which were previously allowed.
✅ 9 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-4800
🚨 CRITICAL
[lodash] A vulnerability in _.template allows arbitrary code execution through untrusted key names in options.imports or prototype pollution, as validation was incomplete after a prior CVE fix. An attacker can inject malicious code that executes during template compilation.
NSWG-ECO-516
HIGH
[lodash] Prototype pollution attack (lodash)
CVE-2025-13465
MEDIUM
[lodash] A prototype pollution vulnerability in _.unset and _.omit functions allows attackers to delete methods from global prototypes via crafted paths. While this prevents property overwriting, it can cause denial of service by removing critical functionality.
CVE-2026-2950
MEDIUM
[lodash] Prototype pollution vulnerability in _.unset and _.omit functions allows attackers to bypass previous fixes using array-wrapped path segments, enabling deletion of properties from built-in prototypes. While this doesn't allow overwriting prototype behavior, it can cause denial of service or unexpected application behavior.
AIKIDO-2025-10745
MEDIUM
[@babel/traverse] A vulnerability allows remote code execution during compilation when processing malicious input with certain plugins that use internal evaluation methods. This affects plugins like @babel/plugin-transform-runtime and @babel/preset-env with useBuiltIns option.
CVE-2020-15366
MEDIUM
[ajv] A prototype pollution vulnerability in the validate() function allows arbitrary code execution through a maliciously crafted JSON schema. This enables remote code execution when processing untrusted schemas, exceeding the expected denial of service impact.
CVE-2025-69873
LOW
[ajv] A ReDoS vulnerability allows attackers to inject malicious regex patterns via the $data option, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal effort.
CVE-2021-3807
LOW
[ansi-regex] is vulnerable to Inefficient Regular Expression Complexity
CVE-2022-25883
LOW
[semver] Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

@aikido-autofix

Copy link
Copy Markdown
Author

Closed by Aikido: a new AutoFix has been created → #3

@aikido-autofix aikido-autofix Bot closed this May 17, 2026
@aikido-autofix
aikido-autofix Bot deleted the fix/aikido-security-update-packages-21766471-d8hf branch May 17, 2026 23:52
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Development

Successfully merging this pull request may close these issues.

0 participants