You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@yunikorn.apache.org by "Wilfred Spiegelenburg (Jira)" <ji...@apache.org> on 2026/01/26 04:22:00 UTC

[jira] [Created] (YUNIKORN-3207) Update dependencies for CVE fixes

Wilfred Spiegelenburg created YUNIKORN-3207:
-----------------------------------------------

             Summary: Update dependencies for CVE fixes
                 Key: YUNIKORN-3207
                 URL: https://issues.apache.org/jira/browse/YUNIKORN-3207
             Project: Apache YuniKorn
          Issue Type: Improvement
          Components: security, webapp
            Reporter: Wilfred Spiegelenburg


Another set of CVE upgrades that cannot be applied by dependabot:
 * CVE-2025-13465: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions (Moderate)
 * CVE-2026-23950 Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS (High)
 * CVE-2026-23745 node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization (High)



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@yunikorn.apache.org
For additional commands, e-mail: issues-help@yunikorn.apache.org