[Git][security-tracker-team/security-tracker][master] Add new batch of node-js-yaml issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
80a7986b by Salvatore Bonaccorso at 2026-07-09T07:39:44+02:00
Add new batch of node-js-yaml issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -222,11 +222,18 @@ CVE-2026-59871 (node-tar is a tar archive manipulation library for Node.js. Prio
 	NOTE: https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp
 	NOTE: Fixed by: https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b (v7.5.18)
 CVE-2026-59870 (js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2. ...)
-	TODO: check
+	- node-js-yaml <not-affected> (Vulnerable code not present)
+	NOTE: https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm
+	NOTE: Fixed by: https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe (5.2.1)
 CVE-2026-59869 (js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15 ...)
-	TODO: check
+	- node-js-yaml <unfixed>
+	NOTE: https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m
+	NOTE: Fixed by: https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7 (3.15.0)
+	NOTE: Fixed by: https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4 (4.3.0)
 CVE-2026-59868 (js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2. ...)
-	TODO: check
+	- node-js-yaml <not-affected> (Vulnerable code not present)
+	NOTE: https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv
+	NOTE: Fixed by: https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1 (5.2.0)
 CVE-2026-59731 (Astro is a web framework for content-driven websites. Version 6.4.7 pe ...)
 	TODO: check
 CVE-2026-59725 (Socket.IO enables bidirectional and low-latency communication for ever ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/80a7986b0f70e7a553411845263597cb794991a4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/80a7986b0f70e7a553411845263597cb794991a4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260709/d87d5038/attachment-0001.htm>