Security: Vulnerable dependency minimatch@3.1.2 [SNYK-JS-MINIMATCH-15309438, CVE-2026-26996]
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript
- Domain
- security
Research direction
Start by inspecting the dependency tree for ember-cli-babel@8.3.1, especially the listed broccoli, walk-sync, rimraf, glob, and babel-plugin-module-resolver paths. Check which compatible upgrades remove minimatch 3.1.2, 8.0.4, and 9.0.5, then verify the dependency tree against the Snyk advisory. Done means no vulnerable minimatch versions remain without breaking the package.
Written by the indexing model from the issue text.
Description
Summary
ember-cli-babel@8.3.1 depends on multiple vulnerable versions of minimatch (3.1.2, 8.0.4, 9.0.5), which are vulnerable to Regular Expression Denial of Service (ReDoS) (High severity).
- Snyk Advisory: https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15309438
- Fix Commit: https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
- Severity: High
Vulnerability Details
Affected versions of minimatch are vulnerable to ReDoS in the AST class, caused by catastrophic backtracking when an input string contains many * characters in a row followed by an unmatched character.
Example Affected Dependency Paths
minimatch is pulled in through 21 paths in ember-cli-babel@8.3.1. Key paths grouped by vulnerable version:
| # | Dependency Path |
|---|---|
| 1 | ember-cli-babel → babel-plugin-module-resolver@5.0.2 → glob@9.3.5 → minimatch@8.0.4 |
| 2 | ember-cli-babel → broccoli-funnel@3.0.8 → minimatch@3.1.2 |
| 3 | ember-cli-babel → broccoli-funnel@3.0.8 → walk-sync@2.2.0 → minimatch@3.1.2 |
| few more... |
Potential Remediation
- Fix has been given in
minimatchto version 10.2.1 or higher. Upgrade transitive dependencies that pull in vulnerableminimatchversions —broccoli-funnel,broccoli-plugin,broccoli-persistent-filter,broccoli-debug,walk-sync,rimraf,glob, andbabel-plugin-module-resolver— to versions that depend onminimatch@>=10.2.1
References
- Dominant language
- JavaScript
- Stars
- 152
- Forks
- 115
- Avg merge
- 23h 22m
- Merged PRs (30d)
- 4
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from emberjs/ember-cli-babel
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
emberjs/ember-cli-babel#508 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
emberjs/ember-cli-babel#535 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
emberjs/ember-cli-babel#519 · 6 comments · 8 reactions ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
emberjs/ember-cli-babel#517 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 25/100
emberjs/ember-cli-babel#514 ·
All issues in emberjs/ember-cli-babel
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·