fix: Fix 44 critical issues in handlebars, lodash, @microsoft/api-extractor and 16 more#28357
fix: Fix 44 critical issues in handlebars, lodash, @microsoft/api-extractor and 16 more#28357aikido-autofix[bot] wants to merge 1 commit into1.xfrom
Conversation
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 6 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="package.json">
<violation number="1" location="package.json:151">
P2: This override collapses Undici v6 and v7 into a single v7 resolution, which can break packages that explicitly depend on v6.</violation>
</file>
Architecture diagram
sequenceDiagram
participant Client as External Client / Browser
participant App as n8n Server (Express/Hono)
participant Config as Convict (Config Manager)
participant Tmpl as Handlebars (Template Engine)
participant Utils as Lodash (Utility Engine)
participant HTTP as Axios / Undici (HTTP Client)
participant Ext as External API / Service
Note over App,Config: System Initialization
App->>Config: CHANGED: Load Schema & User Config
Config->>Config: CHANGED: Prevent Prototype Pollution (__proto__)
Config-->>App: Validated Config Object
Note over Client,App: Incoming Request Flow
Client->>App: GET/POST Request (with Cookies/Headers)
App->>App: CHANGED: path-to-regexp (Route Matching)
Note right of App: Fixes ReDoS in optional groups
App->>App: CHANGED: Hono Middleware (IP Restriction)
Note right of App: Canonicalizes IPv4-mapped IPv6 for safety
alt Template Rendering (Email / Views)
App->>Tmpl: CHANGED: compile(templateSource)
Tmpl->>Tmpl: CHANGED: Sanitize AST / NumberLiterals
Note right of Tmpl: Prevents RCE via AST Injection
Tmpl-->>App: Rendered HTML
end
alt Internal Data Transformation
App->>Utils: CHANGED: _.omit() / _.unset()
Note right of Utils: Blocks 'constructor'/'prototype' keys
Utils-->>App: Sanitized Object
end
Note over App,Ext: Outbound Request Flow
App->>HTTP: CHANGED: request(url, options)
opt Proxy Enabled
HTTP->>HTTP: CHANGED: Axios NO_PROXY Normalization
Note right of HTTP: Prevents SSRF/Proxy Bypass (localhost)
end
HTTP->>Ext: CHANGED: Send HTTP Request
Note right of HTTP: Undici validates duplicate Content-Length
Ext-->>HTTP: Return Data (XML / WebSocket Frames)
alt XML Processing
HTTP->>App: XML String
App->>App: CHANGED: fast-xml-parser
Note right of App: Enforces Entity Expansion Limits (DoS)
end
alt WebSocket Connection
Ext->>HTTP: Compressed WS Frames
HTTP->>HTTP: CHANGED: Unbiased size validation
Note right of HTTP: Prevents Memory Exhaustion (DoS)
end
App-->>Client: Response (200 OK)
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.
| "hono@<=4.12.12": "4.12.12", | ||
| "@hono/node-server@<=1.19.13": "1.19.13", | ||
| "yaml@<=2.8.3": "2.8.3", | ||
| "undici@<=7.24.1": "7.24.1", |
There was a problem hiding this comment.
P2: This override collapses Undici v6 and v7 into a single v7 resolution, which can break packages that explicitly depend on v6.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 151:
<comment>This override collapses Undici v6 and v7 into a single v7 resolution, which can break packages that explicitly depend on v6.</comment>
<file context>
@@ -143,11 +136,22 @@
+ "hono@<=4.12.12": "4.12.12",
+ "@hono/node-server@<=1.19.13": "1.19.13",
+ "yaml@<=2.8.3": "2.8.3",
+ "undici@<=7.24.1": "7.24.1",
+ "fast-xml-parser": "5.5.7",
+ "picomatch@<=4.0.4": "4.0.4",
</file context>
| "undici@<=7.24.1": "7.24.1", | |
| "undici@6": "6.23.0", | |
| "undici@7": "7.24.1", |
n8n-assistant
bot
added
community
|
Hey @aikido-autofix[bot], Thank you for your contribution. We appreciate the time and effort you’ve taken to submit this pull request. Before we can proceed, please ensure the following: Regarding new nodes: If your node integrates with an AI service that you own or represent, please email nodes@n8n.io and we will be happy to discuss the best approach. About review timelines: Thank you again for contributing to n8n. |
Upgrade dependencies to fix critical RCE vulnerabilities in Handlebars AST injection, Lodash template code injection, Convict prototype pollution, and Undici HTTP request smuggling.
✅ No breaking changes from these package upgrades affect this codebase.
Analysis summary:
handlebars (4.7.8 => 4.7.9): Security fixes only. The codebase uses handlebars for email templates and express views, but the security restrictions don't affect the current usage patterns.
lodash (4.17.23 => 4.18.1):
_.unset/_.omitchanges: The codebase useslodash/unsetandlodash/omitextensively, but none of the usages attempt to deleteconstructororprototypeproperties. All usages pass static field names or user-controlled field names that don't target these protected properties._.templatechanges: The codebase does not uselodash/templateat all.lodash-es (4.17.23 => 4.18.1): Not directly imported or used in the codebase.
node-forge (1.3.2 => 1.4.0): The package is listed in dependencies but the breaking changes (BigInteger.modInverse, RSA signature verification, Ed25519 verification, certificate chain verification) are not used directly in the codebase.
path-to-regexp (8.2.0 => 8.4.0): Used as a transitive dependency through
express-openapi-validator. The backtracking restrictions are internal optimizations that don't affect API usage.@xmldom/xmldom (0.8.10 => 0.8.12): Used as a transitive dependency. The codebase does not call
createCDATASectiondirectly.defu (6.1.4 => 6.1.5): Used as a transitive dependency. The change to ignore inherited enumerable properties is a security fix that doesn't affect normal usage patterns.
yaml (2.3.4 => 2.8.3):
Used only as a transitive dependency through
@langchain/classic,postcss-load-config, anddocker-compose.Collection.maxFlowStringSingleLineLengthis not used anywhere in the codebase.Node.js version requirement change (14.6 => 14.18) is satisfied as the codebase requires Node.js >= 20.19.
All breaking changes by upgrading lodash-es from version 4.17.23 to 4.18.1 (CHANGELOG)
_.unset/_.omit:constructorandprototypeare now blocked unconditionally as non-terminal path keys. Calls that previously returnedtrueand deleted the property now returnfalseand leave the target untouched._.template:importskeys containing forbidden identifier characters now throw"Invalid imports option passed into _.template"error, where previously they were accepted.All breaking changes by upgrading node-forge from version 1.3.2 to 1.4.0 (CHANGELOG)
BigInteger.modInverse()now exits early with zero when the target object value is <= 0, instead of entering an infinite looppki.verifyCertificateChain()now rejects certificate chains where intermediate certificates lackbasicConstraintsextensionAll breaking changes by upgrading path-to-regexp from version 8.2.0 to 8.4.0 (CHANGELOG)
All breaking changes by upgrading @xmldom/xmldom from version 0.8.10 to 0.8.12 (CHANGELOG)
createCDATASectionnow throwsInvalidCharacterErrorwhendatacontains"]]>", which will break code that previously passed strings containing"]]>"to this methodAll breaking changes by upgrading defu from version 6.1.4 to 6.1.5 (CHANGELOG)
All breaking changes by upgrading yaml from version 2.3.4 to 2.8.3 (CHANGELOG)
Collection.maxFlowStringSingleLineLength✅ 42 CVEs resolved by this upgrade, including 6 critical 🚨 CVEs
This PR will resolve the following CVEs:
Handlebars.compile()allows attackers to inject arbitrary JavaScript through crafted AST objects, enabling Remote Code Execution when theNumberLiteralvalue field is emitted without sanitization.@partial-blockvariable with a malicious Handlebars AST through helpers, enabling remote code execution when the partial block is subsequently invoked.__lookupSetter__while blocking its symmetric counterparts, allowing prototype pollution when the non-defaultallowProtoMethodsByDefault: trueoption is set. This creates an inconsistent security boundary enabling potential code execution or object manipulation through template injection.resolvePartial()allows attackers to inject malicious strings intoObject.prototypethat are rendered as unescaped partial templates, enabling reflected or stored XSS attacks.lookup()function allows prototype pollution and property access bypass when the compat option is enabled, potentially leading to information disclosure or code execution. The security check vialookupProperty()is discarded, and an unguarded property access is performed instead.__proto__orconstructor, potentially influencing application behavior or enabling further attacks.__proto__,constructor, orprototypeinto internal objects, potentially modifying the prototype chain and influencing application behavior or enabling further attacks.__proto__orconstructor.prototypekeys, potentially leading to authentication bypass or RCE depending on how polluted properties are used.__proto__payloads in unsanitized user input, potentially leading to application logic bypass or information disclosure.setCookie(),serialize(), orserializeSigned(), allowing invalid characters that can cause malformed Set-Cookie headers and runtime errors when processing untrusted cookie names.🔗 Related Tasks