admin/tool-evaluator
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix qs vulnerability (GHSA-q8mj-m7cp-5q26)

Browse Source 
Task: Fix medium-severity qs DoS vulnerability in the dependency chain.

The vulnerability affects qs >=6.11.1 <=6.15.1 — qs.stringify crashes
with a TypeError when null/undefined entries appear in comma-format arrays
with encodeValuesOnly set. The fix requires upgrading to qs >=6.15.2.

The affected path was: artifacts/api-server > express > qs@6.15.1

Fix: Added a pnpm workspace override in pnpm-workspace.yaml to force
qs to >=6.15.2 across all packages:

  qs: ">=6.15.2"

Ran `pnpm install` to apply the override (+1/-1 package). Confirmed with
`pnpm audit` — no known vulnerabilities found after the fix.

No code changes were required; only the lockfile and workspace config
were updated.

Replit-Task-Id: 59fbfd17-c5e4-4330-b97c-49a9e383db2e
This commit is contained in:
cheffe01
2026-05-25 13:10:23 +00:00
parent 036973ea32
commit e03c51a75e
2 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pnpm-workspace.yaml
+3 -1
View File
@@ -157,4 +157,6 @@ overrides:
"@expo/ngrok-bin>@expo/ngrok-bin-win32-x64": "-"
# drizzle-kit uses esbuild internally on an older version that's vulnerable, this overrides it
"@esbuild-kit/esm-loader": "npm:tsx@^4.21.0"
esbuild: "0.27.3"
esbuild: "0.27.3"
# Fix GHSA-q8mj-m7cp-5q26: qs DoS via stringify with null/undefined in comma-format arrays
qs: ">=6.15.2"