[VANTA] [VULNERABILITY] <HIGH> CVE-2026-84375, fix before 2026-10-13 #18

New issue

Copy link

New issue

Copy link

Closed

#19

Closed

[VANTA] [VULNERABILITY] <HIGH> CVE-2026-84375, fix before 2026-10-13#18

#19

Copy link

Assignees

Labels

compliancep1Security priority: HighSecurity priority: Highvulnerability

Description

commercelayer-ci

opened on Sep 29, 2026

Issue body actions

Important

CLOSE THE ISSUE ONLY IF YOU PLAN TO DEPLOY THE FIX BEFORE THE DEADLINE IN THE TITLE.

DO NOT MANUALLY MODIFY THE ISSUE TITLE OR TEXT BODY.

npm-js-yaml >= 3.0.0, < 3.15.2 CODE_REPOSITORY/commercelayer-cli-plugin-provisioning CVE-2026-84375 HIGH remediate by: 2026-10-13T11:54:39.924Z

• https://github.com/commercelayer/commercelayer-cli-plugin-provisioning/security/dependabot/107

Related URLs

• GHSA-2883-xcg3-v3hh
• https://nvd.nist.gov/vuln/detail/CVE-2026-84375
• fix: count empty merge sources against maxTotalMergeKeys nodeca/js-yaml#797
• nodeca/js-yaml@3485bc0
• nodeca/js-yaml@6a8e05f
• nodeca/js-yaml@d90b661
• https://github.com/nodeca/js-yaml/releases/tag/3.15.2
• https://github.com/nodeca/js-yaml/releases/tag/4.3.2
• GHSA-2883-xcg3-v3hh

REPO TAG SKIPPED (no releases)

Reactions are currently unavailable

Activity

1. commercelayer-ci

   assigned

   malessani

   and

   pviti

   on Sep 29, 2026
2. commercelayer-ci

   added

   compliance

   p1Security priority: HighSecurity priority: High

   vulnerability

   on Sep 29, 2026
3. pviti

   closed this as completedin #19on Sep 29, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

• 
  malessani
• 
  pviti

Labels

compliancep1Security priority: HighSecurity priority: Highvulnerability

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

• Open in GitHub Copilot app