Distillation

Date: July 28, 2026

• 🟡 (10:17) gh api tool results returned for getsentry/craft. Security advisory (js-yaml): crafted YAML triggers algorithmic CPU exhaustion in merge-key processing (<<) by repeating same alias many times in a merge sequence; quadratic O(K*M) parse-time behavior (input size O(K+M)). Root cause in lib/loader.js: storeMappingPair(state, _result, overridableKeys, keyTag, keyNode, valueNode, startLine, startLineStart, startPos) merge branch (keyTag === 'tag:yaml.org,2002:merge', ~lines 359-366) calls mergeMappings(...) which recomputes Object.keys(source) + _hasOwnProperty checks per element. DoS via Node.js event-loop block.
• 🟡 (10:17) Dependabot alert #181 (state: fixed): package tar (node-tar), manifest pnpm-lock.yaml, scope development, relationship direct. Advisory GHSA-vmf3-w455-68vh / CVE-2026-53655: PAX size override applied to intermediary GNU long-name (L)/long-link headers → tar parser interpretation differential (file smuggling). Severity medium. Vulnerable version range <=7.5.15, first patched 7.5.16. Fixed 2026-07-01T13:19:11Z.
• 🟡 (10:17) Dependabot alert #180 (state: fixed): package tar (node-tar), manifest package.json, scope development, relationship direct. Same advisory GHSA-vmf3-w455-68vh / CVE-2026-53655. Fixed 2026-06-23T11:05:52Z.
• 🟡 (10:17) Dependabot alert #179 (state: fixed): package form-data, manifest pnpm-lock.yaml, scope development, relationship transitive. Advisory GHSA-hmw2-7cc7-3qxx / CVE-2026-12143: CRLF injection via unescaped multipart field names and filenames — FormData#append concatenates field name/filename directly into Content-Disposition with no escaping of CR/LF/". Affects through v4.0.5.
• 🟡 (10:17) tar CVE-2026-53655 metadata: published 2026-06-15T17:19:42Z, reported by tonghuaroot. Impact is integrity-of-archive-interpretation (hidden member list between node-tar scanner and GNU tar/libarchive/Python tarfile). No auth required; precondition: victim parses attacker-supplied tar. Severity medium.