Security: Vulnerable dependency minimatch@3.1.2 [SNYK-JS-MINIMATCH-15309438, CVE-2026-26996]
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 38/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript
- Domain
- security
Research direction
Inspect the dependency tree for ember-cli-htmlbars@7.0.0 and trace the listed paths through broccoli-plugin, walk-sync, rimraf, glob, and related packages. Verify that all minimatch versions resolve to 10.2.1 or higher, then run the project’s existing test suite; done means no vulnerable minimatch version remains without breaking dependency compatibility.
Written by the indexing model from the issue text.
Description
Summary
ember-cli-htmlbars@7.0.0 depends on multiple vulnerable versions of minimatch (3.1.2, 9.0.5), which are vulnerable to Regular Expression Denial of Service (ReDoS) (High severity).
- Snyk Advisory: https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15309438
- Fix Commit: https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
- Severity: High
Vulnerability Details
Affected versions of minimatch are vulnerable to ReDoS in the AST class, caused by catastrophic backtracking when an input string contains many * characters in a row followed by an unmatched character.
Example Affected Dependency Paths
minimatch is pulled in through multiple paths in ember-cli-htmlbars@7.0.0:
| # | Dependency Path |
|---|---|
| 1 | ember-cli-htmlbars → walk-sync@4.0.1 → matcher-collection@2.0.1 → minimatch@3.1.2 |
| 2 | ember-cli-htmlbars → broccoli-plugin@4.0.7 → rimraf@3.0.2 → glob@7.2.3 → minimatch@3.1.2 |
| 3 | ember-cli-htmlbars → broccoli-persistent-filter@3.1.3 → rimraf@3.0.2 → glob@7.2.3 → minimatch@3.1.2 |
| 4 | ember-cli-htmlbars → broccoli-plugin@4.0.7 → quick-temp@0.1.9 → rimraf@5.0.10 → glob@10.5.0 → minimatch@9.0.5 |
| few more... |
Potential Remediation
- Fix has been given in minimatch to version 10.2.1 or higher. Upgrade transitive dependencies that pull in vulnerable
minimatchversions — particularlybroccoli-plugin,broccoli-persistent-filter,broccoli-debug,walk-sync,rimraf, andglob— to versions that depend onminimatch@>=10.2.1
References
- Dominant language
- JavaScript
- Stars
- 77
- Forks
- 65
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ember-cli/ember-cli-htmlbars
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
ember-cli/ember-cli-htmlbars#787 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 38/100
ember-cli/ember-cli-htmlbars#781 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
ember-cli/ember-cli-htmlbars#779 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
ember-cli/ember-cli-htmlbars#774 · 2 comments ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 30/100
ember-cli/ember-cli-htmlbars#753 · 1 comment · 1 reaction ·
All issues in ember-cli/ember-cli-htmlbars
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
docToolchain/docToolchain#1705 ·
-
Timezone select lists one option per character; duplicate "Failed" reason; shared tracker popover id Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
nightscout/nocturne#1414 ·
-
bug v2
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
modelcontextprotocol/inspector#2458 · 1 comment ·
-
Mend: dependency security vulnerability status: needs triage 🕵️♀️
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
carbon-design-system/ibm-products#9907 ·