Описание
Security update for python-pytest-html
This update for python-pytest-html fixes the following issues:
Changes in python-pytest-html:
- Revendor updating shell-quote and js-yaml deps:
- CVE-2026-13311: shell-quote: inefficient input parsing can lead to a denial of service (bsc#1269361)
- CVE-2026-53550: js-yaml: quadratic complexity when processing a crafted YAML document can lead to CPU exhaustion (bsc#1268818)
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1268818
- SUSE Bug 1269361
- SUSE CVE CVE-2026-13311 page
- SUSE CVE CVE-2026-53550 page
Описание
shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.
Затронутые продукты
Ссылки
- CVE-2026-13311
- SUSE Bug 1269320
Описание
js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.
Затронутые продукты
Ссылки
- CVE-2026-53550
- SUSE Bug 1268806