[Aikido] Fix 39 security issues in handlebars, undici, lodash and 10 more#1110
[Aikido] Fix 39 security issues in handlebars, undici, lodash and 10 more#1110aikido-autofix[bot] wants to merge 1 commit intostagingfrom
Conversation
✅ Deploy Preview for vortexfi ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for vortex-sandbox ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
Pull request overview
This PR updates the repo’s Bun dependency overrides/lockfile to remediate a large set of reported CVEs, primarily targeting Handlebars RCE issues and Undici HTTP request smuggling, by forcing newer versions of a number of transitive packages.
Changes:
- Added/updated
package.jsonoverridesentries to pin multiple vulnerable dependencies to newer versions. - Regenerated
bun.lockto reflect the new override resolutions (including new/updated transitive packages).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| package.json | Updates Bun overrides to pin vulnerable dependencies (handlebars, undici, lodash, tar, axios, etc.) to specific versions. |
| bun.lock | Lockfile refresh to apply the new overrides and update resolved package versions/transitives accordingly. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "node-forge": "1.4.0", | ||
| "path-to-regexp": "8.4.0", | ||
| "@fastify/busboy": "3.2.0", | ||
| "bn.js": "4.12.3", |
There was a problem hiding this comment.
The override pins bn.js to 4.12.3, which is a downgrade from the previously locked 5.2.3 and still below the >=5.2.3 threshold referenced by the bn.js security advisory (CVE-2026-2739 affects versions before 5.2.3). This means the PR likely does not resolve that issue and may reintroduce the vulnerable version. Consider pinning bn.js to 5.2.3 (or later) and regenerating bun.lock, or otherwise document why a downgrade is required and how the CVE is mitigated.
| "bn.js": "4.12.3", | |
| "bn.js": "5.2.3", |
| "wagmi": "^2.17.5" | ||
| "wagmi": "^2.17.5", | ||
| "handlebars": "4.7.9", | ||
| "undici": "7.24.1", |
There was a problem hiding this comment.
This override forces undici to 7.24.1, but the lockfile shows hardhat / @nomicfoundation/hardhat-verify depend on undici: ^5.14.0. Forcing a major-version jump via overrides can break those tools at runtime if they rely on Undici v5 APIs. If possible, prefer upgrading the dependent packages to versions compatible with Undici v7, or pin Undici to the latest patched release within the major line they support.
| "undici": "7.24.1", | |
| "undici": "5.28.5", |
| "@fastify/busboy": "3.2.0", | ||
| "bn.js": "4.12.3", | ||
| "tmp": "0.2.4", | ||
| "pino": "10.1.1", |
There was a problem hiding this comment.
The override pins pino to 10.1.1, but the lockfile indicates @walletconnect/logger@2.1.2 depends on pino 7.11.0. Overriding across major versions risks breaking WalletConnect logging (and anything else expecting the v7 API). Consider upgrading the WalletConnect packages to a version that supports Pino v10, or keep the override within the major version range required by dependents while still addressing the advisory.
| "pino": "10.1.1", | |
| "pino": "7.11.0", |
| "bn.js": "4.12.3", | ||
| "tmp": "0.2.4", | ||
| "pino": "10.1.1", | ||
| "ajv": "8.18.0" |
There was a problem hiding this comment.
Overriding ajv to 8.18.0 is likely incompatible with tooling dependencies in the lockfile such as @eslint/eslintrc@2.1.4 / eslint@8.57.1, which declare ajv: ^6.12.4. Ajv has breaking API changes between v6 and v8, so forcing v8 globally may break lint/config loading in CI. Consider either (1) updating the eslint toolchain to versions that use Ajv v8, or (2) pinning Ajv to a patched v6 release if the goal is to remediate the ReDoS advisory while staying compatible.
| "ajv": "8.18.0" | |
| "ajv": "6.12.6" |
Upgrade dependencies to fix critical RCE vulnerabilities in Handlebars (AST injection, precompiler injection, partial-block hijacking) and HTTP request smuggling in Undici.
✅ 39 CVEs resolved by this upgrade, including 2 critical 🚨 CVEs
This PR will resolve the following CVEs:
Handlebars.compile()allows attackers to inject arbitrary JavaScript through crafted AST objects, enabling Remote Code Execution when theNumberLiteralvalue field is emitted without sanitization.@partial-blockvariable with a malicious Handlebars AST through helpers, enabling remote code execution when the partial block is subsequently invoked.__lookupSetter__while blocking its symmetric counterparts, allowing prototype pollution when the non-defaultallowProtoMethodsByDefault: trueoption is set. This creates an inconsistent security boundary enabling potential code execution or object manipulation through template injection.resolvePartial()allows attackers to inject malicious strings intoObject.prototypethat are rendered as unescaped partial templates, enabling reflected or stored XSS attacks.lookup()function allows prototype pollution and property access bypass when the compat option is enabled, potentially leading to information disclosure or code execution. The security check vialookupProperty()is discarded, and an unguarded property access is performed instead.undicilibrary are vulnerable to memory leaks. By making multiple fetch requests with the sameAbortSignal, undici adds event listeners without removing them, leading to excessive memory consumption.__proto__orconstructor, potentially influencing application behavior or enabling further attacks.__proto__,constructor, orprototypeinto internal objects, potentially modifying the prototype chain and influencing application behavior or enabling further attacks.ßandss) on case-insensitive filesystems, allowing symlink poisoning attacks that enable arbitrary file overwrites through concurrent processing of malicious tar archives.../sequences in archive filenames, enabling arbitrary file overwrite and potential code execution.data:scheme URLs that bypass memory limits, causing unbounded memory allocation and process crashes (DoS) on Node.js. The issue affects versions 0.28.0 through 0.30.1 and 1.x before 1.12.0.globalThis.__bundlerPathsOverridesaccess allows attackers to manipulate the prototype chain and alter application behavior.