GHSA-48c2-rrv3-qjmp
Medium · 4.3CVSS
4.3
EPSS
—
Published
Mar 25, 2026
CISA due date
—
The record
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | yaml | 1.0.0 | 1.10.3 |
| npm | yaml | 2.0.0 | 2.8.3 |
| Chainguard | argo-workflows-ui-4.0 | 0 | 4.0.3-r2 |
| Chainguard | gemini-cli | 0 | 0.35.3-r0 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r17 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r20 |
| Chainguard | lerna | 0 | 9.0.7-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.5-r4 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 2.19.5-r3 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r11 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 0 | 3.5.0-r8 |
| Chainguard | opentelemetry-auto-instrumentations-node | 0 | 0.72.0-r0 |
| Chainguard | prism | 0 | 5.14.3-r13 |
| Chainguard | redisinsight | 0 | 3.2.0-r4 |
| Chainguard | tileserver-gl | 0 | 5.5.0-r11 |
| Chainguard | tileserver-gl-fips | 0 | 5.5.0-r11 |
| Wolfi | argo-workflows-ui-4.0 | 0 | 4.0.3-r2 |
| Wolfi | lerna | 0 | 9.0.7-r2 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.5-r4 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r11 |
| Wolfi | prism | 0 | 5.14.3-r13 |
| Wolfi | tileserver-gl | 0 | 5.5.0-r11 |
Related vulnerabilities
- CVE-2026-33532 `yaml` is a YAML parser and serialiser for JavaScript. Same vulnerability
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects argo-workflows-ui-4.0
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects argo-workflows-ui-4.0
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects argo-workflows-ui-4.0
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects argo-workflows-ui-4.0
- GHSA-37ch-88jc-xwx2 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route… Also affects argo-workflows-ui-4.0
- CVE-2026-33750 The brace-expansion library generates arbitrary strings containing a common prefix and… Also affects argo-workflows-ui-4.0
- CVE-2026-33671 Picomatch is a glob matcher written JavaScript. Also affects argo-workflows-ui-4.0