Skip to content

[Aikido] Fix 5 security issues in lodash, @actions/github, @octokit/core#6

Closed
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-16216078-pjar
Closed

[Aikido] Fix 5 security issues in lodash, @actions/github, @octokit/core#6
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-16216078-pjar

Conversation

@aikido-autofix
Copy link
Copy Markdown

Upgrade dependencies to mitigate prototype pollution in Lodash and multiple ReDoS vulnerabilities in GitHub/Octokit packages affecting request parsing and pagination.

✅ Code not affected by breaking changes.

No breaking changes from the package upgrades affect this codebase.

The codebase uses Node.js 20 (as specified in action.yml), which satisfies the Node.js 18+ requirement of the upgraded packages. The source code in src/gh.js only uses standard Octokit methods (octokit.request() and octokit.paginate()) without passing custom request options, HTTP agents, or using any deprecated APIs. The HTTP agent configuration is handled internally by @actions/github v6.0.1, which is already compatible with the newer Octokit packages.

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2025-13465
MEDIUM
[lodash] Prototype pollution vulnerability allows attackers to delete methods from global object prototypes via crafted paths in _.unset and _.omit functions, potentially disrupting application behavior without direct code execution.
AIKIDO-2025-10094
LOW
[lodash] ReDoS vulnerability in GraphQL header parsing allows attackers to craft malicious inputs that trigger excessive regex backtracking, causing severe performance degradation and potential system outages through computational overhead.
CVE-2025-25288
LOW
[lodash] ReDoS vulnerability in pagination plugin allows attackers to craft malicious link headers, potentially causing excessive regex processing and consuming significant CPU resources through a denial-of-service attack.
CVE-2025-25290
LOW
[lodash] ReDoS vulnerability in link header parsing regex allows attackers to craft malicious input, causing excessive CPU consumption and potential DoS by making the server unresponsive through catastrophic backtracking.
CVE-2025-25289
LOW
[lodash] A Regular Expression Denial of Service (ReDoS) vulnerability exists in HTTP header processing. An attacker can send a crafted authorization header with long space sequences, causing excessive CPU consumption and potential server performance degradation or DoS.

@aikido-autofix aikido-autofix Bot closed this Apr 3, 2026
@aikido-autofix aikido-autofix Bot deleted the fix/aikido-security-update-packages-16216078-pjar branch April 3, 2026 23:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants