I think there may be a problem in gowind-uiapp/frontend/package-lock.json around line 1491.
The js-yaml package version 4.1.1 contains a YAML merge key parsing vulnerability (CVE‑2026‑59869) that can cause quadratic CPU usage when processing crafted YAML with many merge keys. An attacker could trigger a denial‑of‑service by sending a large but linear‑size YAML document that triggers repeated merges. The impact is high because it can crash the application or degrade performance, especially in web services. This is fixed in js-yaml 3.15.0 and 4.3.0, so updating the dependency eliminates the issue.
Something like this might fix it:
--- a/gowind-uiapp/frontend/package-lock.json
+++ b/gowind-uiapp/frontend/package-lock.json
@@ -1491,7 +1491,7 @@
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
- "version": "4.1.1",
+ "version": "4.3.0",
"engines": {
"node": ">=12"
}For reference: rule CVE-2026-59869. Rated high.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
I think there may be a problem in
gowind-uiapp/frontend/package-lock.jsonaround line 1491.The js-yaml package version 4.1.1 contains a YAML merge key parsing vulnerability (CVE‑2026‑59869) that can cause quadratic CPU usage when processing crafted YAML with many merge keys. An attacker could trigger a denial‑of‑service by sending a large but linear‑size YAML document that triggers repeated merges. The impact is high because it can crash the application or degrade performance, especially in web services. This is fixed in js-yaml 3.15.0 and 4.3.0, so updating the dependency eliminates the issue.
Something like this might fix it:
For reference: rule
CVE-2026-59869. Rated high.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.