@⁠carbon/storybook-addon-theme-1.44.7.tgz: 12 vulnerabilities (highest severity is: 7.5) - autoclosed

[ibm-mend-app]

Vulnerable Library - @⁠carbon/storybook-addon-theme-1.44.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/markdown-to-jsx-npm-6.11.4-e7ef0863b5-1dc3c245e1.zip

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (@⁠carbon/storybook-addon-theme version)	Remediation Possible**
CVE-2022-23647	High	7.5	prismjs-1.17.1.tgz	Transitive	N/A*	❌
CVE-2021-3801	High	7.5	prismjs-1.17.1.tgz	Transitive	N/A*	❌
CVE-2021-23341	High	7.5	prismjs-1.17.1.tgz	Transitive	N/A*	❌
CVE-2021-32723	High	7.4	prismjs-1.17.1.tgz	Transitive	N/A*	❌
CVE-2020-15138	High	7.1	prismjs-1.17.1.tgz	Transitive	N/A*	❌
CVE-2024-21535	Medium	6.1	markdown-to-jsx-6.11.4.tgz	Transitive	N/A*	❌
CVE-2020-26237	Medium	5.8	highlight.js-9.13.1.tgz	Transitive	N/A*	❌
CVE-2026-8723	Medium	5.3	qs-6.13.0.tgz	Transitive	N/A*	❌
CVE-2024-53382	Medium	4.9	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2026-33532	Medium	4.3	yaml-1.10.2.tgz	Transitive	N/A*	❌
CVE-2026-2391	Low	3.7	qs-6.13.0.tgz	Transitive	N/A*	❌
CVE-2025-15284	Low	3.7	qs-6.13.0.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-23647

Vulnerable Library - prismjs-1.17.1.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/prismjs-npm-1.17.1-6c69ea7fe8-82e4788c5d.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • components-5.3.22.tgz
    • react-syntax-highlighter-11.0.3.tgz
      • refractor-2.10.1.tgz
        • ❌ prismjs-1.17.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.

Publish Date: 2022-02-18

URL: CVE-2022-23647

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3949-f494-cm99

Release Date: 2022-02-18

Fix Resolution: prismjs- v1.27.0

CVE-2021-3801

Vulnerable Library - prismjs-1.17.1.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/prismjs-npm-1.17.1-6c69ea7fe8-82e4788c5d.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • components-5.3.22.tgz
    • react-syntax-highlighter-11.0.3.tgz
      • refractor-2.10.1.tgz
        • ❌ prismjs-1.17.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

prism is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-15

URL: CVE-2021-3801

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3801

Release Date: 2021-09-15

Fix Resolution: prismjs - 1.25.0

CVE-2021-23341

Vulnerable Library - prismjs-1.17.1.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/prismjs-npm-1.17.1-6c69ea7fe8-82e4788c5d.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • components-5.3.22.tgz
    • react-syntax-highlighter-11.0.3.tgz
      • refractor-2.10.1.tgz
        • ❌ prismjs-1.17.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.

Publish Date: 2021-02-18

URL: CVE-2021-23341

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h4hr-7fg3-h35w

Release Date: 2021-02-18

Fix Resolution: prismjs - 1.23.0

CVE-2021-32723

Vulnerable Library - prismjs-1.17.1.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/prismjs-npm-1.17.1-6c69ea7fe8-82e4788c5d.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • components-5.3.22.tgz
    • react-syntax-highlighter-11.0.3.tgz
      • refractor-2.10.1.tgz
        • ❌ prismjs-1.17.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.

Publish Date: 2021-06-28

URL: CVE-2021-32723

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gj77-59wh-66hg

Release Date: 2021-06-28

Fix Resolution: prismjs - 1.24.0

CVE-2020-15138

Vulnerable Library - prismjs-1.17.1.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/prismjs-npm-1.17.1-6c69ea7fe8-82e4788c5d.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • components-5.3.22.tgz
    • react-syntax-highlighter-11.0.3.tgz
      • refractor-2.10.1.tgz
        • ❌ prismjs-1.17.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2020-08-07

URL: CVE-2020-15138

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/PrismJS/prism/v1.21.0

Release Date: 2020-08-07

Fix Resolution: v1.21.0

CVE-2024-21535

Vulnerable Library - markdown-to-jsx-6.11.4.tgz

Convert markdown to JSX with ease for React and React-like projects. Super lightweight and highly configurable.

Library home page: https://registry.npmjs.org/markdown-to-jsx/-/markdown-to-jsx-6.11.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/markdown-to-jsx-npm-6.11.4-e7ef0863b5-1dc3c245e1.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • components-5.3.22.tgz
    • ❌ markdown-to-jsx-6.11.4.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown.

Publish Date: 2024-10-15

URL: CVE-2024-21535

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4wx3-54gh-9fr9

Release Date: 2024-10-15

Fix Resolution: markdown-to-jsx - 7.4.0

CVE-2020-26237

Vulnerable Library - highlight.js-9.13.1.tgz

Syntax highlighting with language autodetection.

Library home page: https://registry.npmjs.org/highlight.js/-/highlight.js-9.13.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/highlight.js-npm-9.13.1-472c834b5e-99c9f8ef61.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • components-5.3.22.tgz
    • react-syntax-highlighter-11.0.3.tgz
      • lowlight-1.11.0.tgz
        • ❌ highlight.js-9.13.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. If your website or application does not render user provided data it should be unaffected. Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

Publish Date: 2020-11-24

URL: CVE-2020-26237

CVSS 3 Score Details (5.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vfrc-7r7c-w9mx

Release Date: 2020-11-24

Fix Resolution: 9.18.2, 10.1.2

CVE-2026-8723

Vulnerable Library - qs-6.13.0.tgz

Library home page: https://registry.npmjs.org/qs/-/qs-6.13.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/qs-npm-6.13.0-53676ddc84-f548b376e6.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • addons-6.5.16.tgz
    • router-6.5.16.tgz
      • ❌ qs-6.13.0.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Summary
"qs.stringify" throws "TypeError" when called with "arrayFormat: 'comma'" and "encodeValuesOnly: true" on an array containing "null" or "undefined". The throw is synchronous and not handled by any of qs's null-related options ("skipNulls", "strictNullHandling").
Details
In the comma + "encodeValuesOnly" branch, "lib/stringify.js:145" mapped the array through the raw encoder before joining:
obj = utils.maybeMap(obj, encoder);
"utils.encode" ("lib/utils.js:195") reads "str.length" with no null guard, so a "null" or "undefined" element throws "TypeError". "skipNulls" and "strictNullHandling" are both checked in the per-element loop below this line and never get a chance to run.
Same class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + "encodeValuesOnly" branch was introduced in 4c4b23d ("encode comma values more consistently", PR #⁠463, 2023-01-19), first released in v6.11.1.
PoC
const qs = require('qs');
qs.stringify({ a: [null, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [undefined, 'b'] }, { arrayFormat: 'comma', encodeValuesOnly: true });
qs.stringify({ a: [null] }, { arrayFormat: 'comma', encodeValuesOnly: true });
// TypeError: Cannot read properties of null (reading 'length')
// at encode (lib/utils.js:195:13)
// at Object.maybeMap (lib/utils.js:322:37)
// at stringify (lib/stringify.js:145:25)
Fix
"lib/stringify.js:145", applied in 21f80b3 on "main" and released as v6.15.2:

• obj = utils.maybeMap(obj, encoder);

• obj = utils.maybeMap(obj, function (v) {

• return v == null ? v : encoder(v);
  

• });
  "null" and "undefined" now pass through "maybeMap" unchanged and reach the "join(',')" step as-is. For "{ a: [null, 'b'] }" this produces "a=,b", matching the non-"encodeValuesOnly" comma path (which already joins before encoding and produces "a=%2Cb" for the same input). Single-element "[null]" arrays still collapse via the existing "obj.join(',') || null" and remain subject to "skipNulls" / "strictNullHandling" in the main loop.
  Affected versions
  ">=6.11.1 <6.15.2" — fixed in v6.15.2.
  The vulnerable code shape was introduced in 4c4b23d and first shipped in v6.11.1. Earlier versions — including all of 6.7.x, 6.8.x, 6.9.x, 6.10.x, and 6.11.0 — implemented the comma + "encodeValuesOnly" path differently (joining before encoding) and are not affected. Empirically verified across released versions.
  Impact
  Application code that calls "qs.stringify" with both "arrayFormat: 'comma'" and "encodeValuesOnly: true" (both non-default) on input that may contain a "null" or "undefined" array element will throw synchronously instead of producing a query string. In a typical Node.js HTTP framework (Express, Fastify, Koa, hapi) the sync throw is caught by the framework's error boundary and the affected request returns a 500; the worker process does not exit and subsequent requests are unaffected. The "kills the worker process" framing applies only to call sites outside a request-handler error boundary (background jobs, startup paths, stream pipelines) or to deployments with framework error handling explicitly disabled.
  The vulnerable input is a "null" or "undefined" entry inside an array; this is reachable from JSON request bodies or from application code constructing arrays from user input, but not from standard HTML form submissions (which produce strings or omitted fields, not literal "null").
  Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-05-16

URL: CVE-2026-8723

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q8mj-m7cp-5q26

Release Date: 2026-05-16

Fix Resolution: qs - 6.15.2,qs - 6.15.2,https://github.com/ljharb/qs.git - v6.15.2

CVE-2024-53382

Vulnerable Libraries - prismjs-1.29.0.tgz, prismjs-1.17.1.tgz

prismjs-1.29.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.29.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/prismjs-npm-1.29.0-6faa5b04b8-2080db382c.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • components-5.3.22.tgz
    • react-syntax-highlighter-11.0.3.tgz
      • ❌ prismjs-1.29.0.tgz (Vulnerable Library)

prismjs-1.17.1.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/prismjs-npm-1.17.1-6c69ea7fe8-82e4788c5d.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • components-5.3.22.tgz
    • react-syntax-highlighter-11.0.3.tgz
      • refractor-2.10.1.tgz
        • ❌ prismjs-1.17.1.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

Publish Date: 2025-03-03

URL: CVE-2024-53382

CVSS 3 Score Details (4.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-53382

Release Date: 2025-03-03

Fix Resolution: prismjs - 9000.0.1,prismjs - 1.30.0

CVE-2026-33532

Vulnerable Library - yaml-1.10.2.tgz

JavaScript parser and stringifier for YAML

Library home page: https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/yaml-npm-1.10.2-0e780aebdf-e088b37b4d.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • components-5.3.22.tgz
    • theming-5.3.22.tgz
      • styled-10.3.0.tgz
        • babel-plugin-emotion-10.2.2.tgz
          • babel-plugin-macros-2.8.0.tgz
            • cosmiconfig-6.0.0.tgz
              • ❌ yaml-1.10.2.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

"yaml" is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of "yaml" on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a "RangeError: Maximum call stack size exceeded" with a small payload (~2–10 KB). The "RangeError" is not a "YAMLParseError", so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one "[" and one "]"). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's "Parser" (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: "YAML.parse()", "YAML.parseDocument()", and "YAML.parseAllDocuments()". Versions 1.10.3 and 2.8.3 contain a patch.

Publish Date: 2026-03-26

URL: CVE-2026-33532

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: eemeli/yaml@1e84ebb

Release Date: 2026-03-25

Fix Resolution: https://github.com/eemeli/yaml.git - v1.10.3,https://github.com/eemeli/yaml.git - v2.8.3

CVE-2026-2391

Vulnerable Library - qs-6.13.0.tgz

Library home page: https://registry.npmjs.org/qs/-/qs-6.13.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/qs-npm-6.13.0-53676ddc84-f548b376e6.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • addons-6.5.16.tgz
    • router-6.5.16.tgz
      • ❌ qs-6.13.0.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Summary
The "arrayLimit" option in qs does not enforce limits for comma-separated values when "comma: true" is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).
Details
When the "comma" option is set to "true" (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., "?param=a,b,c" becomes "['a', 'b', 'c']"). However, the limit check for "arrayLimit" (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in "parseArrayValue", enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.
Vulnerable code (lib/parse.js: lines ~40-50):
if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {
    return val.split(',');
}
if (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {
    throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');
}
return val;
The "split(',')" returns the array immediately, skipping the subsequent limit check. Downstream merging via "utils.combine" does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., "?param=,,,,,,,,..."), allocating massive arrays in memory without triggering limits. It bypasses the intent of "arrayLimit", which is enforced correctly for indexed ("a[0]=") and bracket ("a[]=") notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).
PoC
Test 1 - Basic bypass:
npm install qs
const qs = require('qs');
const payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)
const options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };
try {
  const result = qs.parse(payload, options);
  console.log(result.a.length); // Outputs: 26 (bypass successful)
} catch (e) {
  console.log('Limit enforced:', e.message); // Not thrown
}
Configuration:

• "comma: true"
• "arrayLimit: 5"
• "throwOnLimitExceeded: true"
  Expected: Throws "Array limit exceeded" error.
  Actual: Parses successfully, creating an array of length 26.
  Impact
  Denial of Service (DoS) via memory exhaustion.
  Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-02-12

URL: CVE-2026-2391

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w7fw-mjwx-w883

Release Date: 2026-02-12

Fix Resolution: qs - 6.14.2,https://github.com/ljharb/qs.git - v6.14.2,qs - 6.14.2

CVE-2025-15284

Vulnerable Library - qs-6.13.0.tgz

Library home page: https://registry.npmjs.org/qs/-/qs-6.13.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /.yarn/cache/qs-npm-6.13.0-53676ddc84-f548b376e6.zip

Dependency Hierarchy:

• @⁠carbon/storybook-addon-theme-1.44.7.tgz (Root Library)
  • addons-6.5.16.tgz
    • router-6.5.16.tgz
      • ❌ qs-6.13.0.tgz (Vulnerable Library)

Found in HEAD commit: e7312c67021bf5e59d7d607c7e5b30e2517b72fd

Found in base branch: main

Vulnerability Details

Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
Summary
The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.
Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.
Details
The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).
Vulnerable code (lib/parse.js:159-162):
if (root === '[]' && options.parseArrays) {
obj = utils.combine([], leaf); // No arrayLimit check
}
Working code (lib/parse.js:175):
else if (index <= options.arrayLimit) { // Limit checked here
obj = [];
obj[index] = leaf;
}
The bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.
PoC
const qs = require('qs');
const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });
console.log(result.a.length); // Output: 6 (should be max 5)
Note on parameterLimit interaction: The original advisory's "DoS demonstration" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.
Impact
Consistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.

Publish Date: 2025-12-29

URL: CVE-2025-15284

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6rw7-vpxm-498p

Release Date: 2025-12-29

Fix Resolution: qs - 6.14.1,qs - 6.14.1,https://github.com/ljharb/qs.git - v6.14.1

[ibm-mend-app]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.