begininvoke opened a new issue, #1776: URL: https://github.com/apache/daffodil-vscode/issues/1776
This might be a false positive, but `yarn.lock` around line 402 looked worth a second pair of eyes. The project uses @grpc/grpc-js version 1.12.2, which is vulnerable to CVE-2026-48068. An attacker can send a malformed HTTP/2 stream that triggers an unhandled exception, causing the gRPC server process to crash. This denial‑of‑service condition is classified as HIGH severity because it can bring down critical services. Upgrading to a patched release (≥ 1.12.7, or any of the listed fixed versions) eliminates the flaw. Something like this might fix it: ````diff ```diff --- a/yarn.lock +++ b/yarn.lock @@ -@grpc/[email protected]: - version "1.12.2" - resolved "https://registry.yarnpkg.com/@grpc/grpc-js/-/grpc-js-1.12.2.tgz#..."; - integrity sha512-... - dependencies: - ... +@grpc/[email protected]: + version "1.14.4" + resolved "https://registry.yarnpkg.com/@grpc/grpc-js/-/grpc-js-1.14.4.tgz#..."; + integrity sha512-... + dependencies: + ... ``` ```` For reference: rule `CVE-2026-48068`. Rated high. The suggested change is untested against this project, so please read it before applying it. --- *Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
