Repository navigation
[VANTA] [VULNERABILITY] <HIGH> CVE-2026-84375, fix before 2026-10-13 #29
Description
Important
CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.
DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.
npm-js-yaml >= 3.0.0, < 3.15.2 CODE_REPOSITORY/commercelayer-cli-plugin-cleanups CVE-2026-84375 HIGH remediate by: 2026-10-13T11:54:39.924Z
Related URLs
- GHSA-2883-xcg3-v3hh
- https://nvd.nist.gov/vuln/detail/CVE-2026-84375
- fix: count empty merge sources against maxTotalMergeKeys nodeca/js-yaml#797
- nodeca/js-yaml@3485bc0
- nodeca/js-yaml@6a8e05f
- nodeca/js-yaml@d90b661
- https://github.com/nodeca/js-yaml/releases/tag/3.15.2
- https://github.com/nodeca/js-yaml/releases/tag/4.3.2
- GHSA-2883-xcg3-v3hh
REPO TAG SKIPPED (no releases)
Activity
commercelayer-ci commentedon Oct 5, 2026
CODE_REPOSITORY/commercelayer-cli-plugin-cleanups
commercelayer-ci commentedon Oct 6, 2026
CODE_REPOSITORY/commercelayer-cli-plugin-cleanups