[security] deps: @xmldom/xmldom 0.8.15 + js-yaml 3.15.2/4.3.2 (high) #121

New issue

Closed

opened 2026-09-26 00:08:34 +00:00 by maximus · 0 comments

maximus commented

2026-09-26 00:08:34 +00:00

Owner

npm audit reports 2 HIGH findings, published on 2026-09-08 after the current override floors (@xmldom/xmldom ^0.8.13, js-yaml@^3.0.0 -> ^3.15.1, js-yaml@^4.0.0 -> ^4.3.1).

@xmldom/xmldom 0.8.13

10 advisories (4 HIGH: GHSA-c7q8-3ch8-vqpv, GHSA-x4fp-j954-r2f4, GHSA-93r5-fhx6-vmg9, ...), injection bypasses of requireWellFormed and quadratic parsing. Patched in 0.8.15 (lts line).
Consumers: @expo/cli -> @expo/plist; @expo/config-plugins -> xcode -> simple-plist -> plist.

js-yaml 3.15.1 / 4.3.1

GHSA-2883-xcg3-v3hh (HIGH): maxTotalMergeKeys does not limit CPU for empty merge sources. Patched in 3.15.2 and 4.3.2.
Consumers: @expo/cli -> @expo/xcpretty (4.x); react-native -> babel-jest -> babel-plugin-istanbul -> @istanbuljs/load-nyc-config (3.x).

Exposure

Build-time tooling only (iOS plist/xcode/xcpretty, Jest coverage). Nothing in the Android bundle, inputs are project files. Low real risk.

Fix

Raise the three override floors: @xmldom/xmldom ^0.8.15, js-yaml@^3.0.0 -> ^3.15.2, js-yaml@^4.0.0 -> ^4.3.2. Targeted lock update, no npm audit fix. Verify smoke test (toolchain guards) + npx expo export --platform android.

Note: the Defenseur did not open an issue for these (run of 2026-09-18 opened #117 only).

`npm audit` reports 2 HIGH findings, published on 2026-09-08 after the current override floors (`@xmldom/xmldom ^0.8.13`, `js-yaml@^3.0.0 -> ^3.15.1`, `js-yaml@^4.0.0 -> ^4.3.1`). ## @xmldom/xmldom 0.8.13 10 advisories (4 HIGH: GHSA-c7q8-3ch8-vqpv, GHSA-x4fp-j954-r2f4, GHSA-93r5-fhx6-vmg9, ...), injection bypasses of `requireWellFormed` and quadratic parsing. Patched in **0.8.15** (lts line). Consumers: `@expo/cli` -> `@expo/plist`; `@expo/config-plugins` -> `xcode` -> `simple-plist` -> `plist`. ## js-yaml 3.15.1 / 4.3.1 GHSA-2883-xcg3-v3hh (HIGH): `maxTotalMergeKeys` does not limit CPU for empty merge sources. Patched in **3.15.2** and **4.3.2**. Consumers: `@expo/cli` -> `@expo/xcpretty` (4.x); `react-native` -> `babel-jest` -> `babel-plugin-istanbul` -> `@istanbuljs/load-nyc-config` (3.x). ## Exposure Build-time tooling only (iOS plist/xcode/xcpretty, Jest coverage). Nothing in the Android bundle, inputs are project files. Low real risk. ## Fix Raise the three override floors: `@xmldom/xmldom ^0.8.15`, `js-yaml@^3.0.0 -> ^3.15.2`, `js-yaml@^4.0.0 -> ^4.3.2`. Targeted lock update, no `npm audit fix`. Verify smoke test (toolchain guards) + `npx expo export --platform android`. Note: the Defenseur did not open an issue for these (run of 2026-09-18 opened #117 only).