From 29d778027794779f3f51417c2a3de83286e223d3 Mon Sep 17 00:00:00 2001 From: KashKondaka <37753523+KashKondaka@users.noreply.github.com> Date: Tue, 21 Apr 2026 02:22:45 -0700 Subject: [PATCH 1/3] Resolve CVE-2026-4800 by bumping lodash and lodash-es to ^4.18.0 Details: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function(). Impact: When an application passes untrusted input as options.imports key names to _.template, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, prototype pollution can be exploited via assignInWith to inject keys into the Function() constructor. Fix: Bumped lodash and lodash-es resolutions to ^4.18.0 in package.json. Version 4.18.0 validates importsKeys against reForbiddenIdentifierChars and replaces assignInWith with assignWith when merging imports. Signed-off-by: KashKondaka <37753523+KashKondaka@users.noreply.github.com> --- package.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index fa833001f..51232bd06 100644 --- a/package.json +++ b/package.json @@ -39,7 +39,7 @@ "kind-of": "^6.0.3", "glob-parent": "^5.1.2", "ssri": "^6.0.2", - "lodash": "^4.17.21", + "lodash": "^4.18.0", "hosted-git-info": "^2.8.9", "json-schema": "^0.4.0", "ansi-regex": "^5.0.1", @@ -47,7 +47,8 @@ "moment": "^2.29.2", "async": "^3.2.3", "json5": "^2.2.3", - "brace-expansion": "^5.0.5" + "brace-expansion": "^5.0.5", + "lodash-es": "^4.18.0" }, "devDependencies": { "@elastic/elastic-eslint-config-kibana": "link:../../packages/opensearch-eslint-config-opensearch-dashboards", From 87392760812266e1478d78667211bce2662149fe Mon Sep 17 00:00:00 2001 From: Thomas Hurney Date: Wed, 6 May 2026 10:26:47 -0700 Subject: [PATCH 2/3] Fixed CI workflows to use correct OSD branch. Signed-off-by: Thomas Hurney --- .github/workflows/cypress-workflow.yml | 2 +- .github/workflows/unit-tests-workflow.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cypress-workflow.yml b/.github/workflows/cypress-workflow.yml index 9d134ef38..45d21f968 100644 --- a/.github/workflows/cypress-workflow.yml +++ b/.github/workflows/cypress-workflow.yml @@ -7,7 +7,7 @@ on: branches: - "*" env: - OPENSEARCH_DASHBOARDS_VERSION: '2.5.0' + OPENSEARCH_DASHBOARDS_VERSION: '2.5' OPENSEARCH_VERSION: '2.5.0-SNAPSHOT' SECURITY_ANALYTICS_BRANCH: '2.5' jobs: diff --git a/.github/workflows/unit-tests-workflow.yml b/.github/workflows/unit-tests-workflow.yml index 1c79aa467..7f631dbb1 100644 --- a/.github/workflows/unit-tests-workflow.yml +++ b/.github/workflows/unit-tests-workflow.yml @@ -7,7 +7,7 @@ on: branches: - "*" env: - OPENSEARCH_DASHBOARDS_VERSION: '2.5.0' + OPENSEARCH_DASHBOARDS_VERSION: '2.5' jobs: tests: name: Run unit tests From db8dcc0cab5380107a71bf0bad21b68897f377d8 Mon Sep 17 00:00:00 2001 From: Thomas Hurney Date: Wed, 6 May 2026 13:03:59 -0700 Subject: [PATCH 3/3] Consolidated CVE fixes: added minimatch, yaml, and picomatch resolutions. Signed-off-by: Thomas Hurney --- package.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index 51232bd06..6801398af 100644 --- a/package.json +++ b/package.json @@ -48,7 +48,10 @@ "async": "^3.2.3", "json5": "^2.2.3", "brace-expansion": "^5.0.5", - "lodash-es": "^4.18.0" + "lodash-es": "^4.18.0", + "minimatch": "^3.1.4", + "yaml": "^1.10.3", + "picomatch": "^2.3.2" }, "devDependencies": { "@elastic/elastic-eslint-config-kibana": "link:../../packages/opensearch-eslint-config-opensearch-dashboards",