[object Object]

← back to Exo

fix: upgrade devalue to 5.6.2 (CVE-2026-22774) (#2150)

cdf1add8673b1a1d7fcc7b36eead1a0f2adca15a · 2026-06-22 18:59:15 +0530 · OrbisAI Security

## Summary
Upgrade devalue from 5.5.0 to 5.6.2 to fix CVE-2026-22774.

## Vulnerability
| Field | Value |
|-------|-------|
| **ID** | CVE-2026-22774 |
| **Severity** | HIGH |
| **Scanner** | trivy |
| **Rule** | `CVE-2026-22774` |
| **File** | `dashboard/package-lock.json` |
| **Assessment** | Likely exploitable |

**Description**: devalue: devalue: Denial of Service due to excessive
resource consumption from untrusted input

## Evidence

**Scanner confirmation**: trivy rule `CVE-2026-22774` flagged this
pattern.

**Production code**: This file is in the production codebase, not
test-only code.

## Threat Model Context

This is a web service - vulnerabilities in request handlers are directly
exploitable by remote attackers.

## Changes
- `dashboard/package.json`
- `dashboard/package-lock.json`

## Verification
- [x] Build passes
- [x] Scanner re-scan confirms fix
- [x] LLM code review passed

---
*This change addresses a pattern flagged by static analysis. The code
path handles user-influenced input and the fix reduces the attack
surface against both manual and automated exploitation.*

---
*Automated security fix by [OrbisAI Security](https://orbisappsec.com)*

Files touched

Diff

commit cdf1add8673b1a1d7fcc7b36eead1a0f2adca15a
Author: OrbisAI Security <mediratta01.pally@gmail.com>
Date:   Mon Jun 22 18:59:15 2026 +0530

    fix: upgrade devalue to 5.6.2 (CVE-2026-22774) (#2150)
    
    ## Summary
    Upgrade devalue from 5.5.0 to 5.6.2 to fix CVE-2026-22774.
    
    ## Vulnerability
    | Field | Value |
    |-------|-------|
    | **ID** | CVE-2026-22774 |
    | **Severity** | HIGH |
    | **Scanner** | trivy |
    | **Rule** | `CVE-2026-22774` |
    | **File** | `dashboard/package-lock.json` |
    | **Assessment** | Likely exploitable |
    
    **Description**: devalue: devalue: Denial of Service due to excessive
    resource consumption from untrusted input
    
    ## Evidence
    
    **Scanner confirmation**: trivy rule `CVE-2026-22774` flagged this
    pattern.
    
    **Production code**: This file is in the production codebase, not
    test-only code.
    
    ## Threat Model Context
    
    This is a web service - vulnerabilities in request handlers are directly
    exploitable by remote attackers.
    
    ## Changes
    - `dashboard/package.json`
    - `dashboard/package-lock.json`
    
    ## Verification
    - [x] Build passes
    - [x] Scanner re-scan confirms fix
    - [x] LLM code review passed
    
    ---
    *This change addresses a pattern flagged by static analysis. The code
    path handles user-influenced input and the fix reduces the attack
    surface against both manual and automated exploitation.*
    
    ---
    *Automated security fix by [OrbisAI Security](https://orbisappsec.com)*
---
 dashboard/package-lock.json | 7 ++++---
 dashboard/package.json      | 5 +++--
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/dashboard/package-lock.json b/dashboard/package-lock.json
index 341dce91..5551b06c 100644
--- a/dashboard/package-lock.json
+++ b/dashboard/package-lock.json
@@ -8,6 +8,7 @@
 			"name": "exo-dashboard",
 			"version": "1.0.0",
 			"dependencies": {
+				"devalue": "^5.6.2",
 				"highlight.js": "^11.11.1",
 				"katex": "^0.16.27",
 				"marked": "^17.0.1",
@@ -2331,9 +2332,9 @@
 			}
 		},
 		"node_modules/devalue": {
-			"version": "5.5.0",
-			"resolved": "https://registry.npmjs.org/devalue/-/devalue-5.5.0.tgz",
-			"integrity": "sha512-69sM5yrHfFLJt0AZ9QqZXGCPfJ7fQjvpln3Rq5+PS03LD32Ost1Q9N+eEnaQwGRIriKkMImXD56ocjQmfjbV3w==",
+			"version": "5.6.2",
+			"resolved": "https://registry.npmjs.org/devalue/-/devalue-5.6.2.tgz",
+			"integrity": "sha512-nPRkjWzzDQlsejL1WVifk5rvcFi/y1onBRxjaFMjZeR9mFpqu2gmAZ9xUB9/IEanEP/vBtGeGganC/GO1fmufg==",
 			"license": "MIT"
 		},
 		"node_modules/enhanced-resolve": {
diff --git a/dashboard/package.json b/dashboard/package.json
index 08179b5c..1b40cb5e 100644
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -11,8 +11,6 @@
 		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json"
 	},
 	"devDependencies": {
-		"prettier": "^3.4.2",
-		"prettier-plugin-svelte": "^3.3.3",
 		"@sveltejs/adapter-static": "^3.0.10",
 		"@sveltejs/kit": "^2.48.4",
 		"@sveltejs/vite-plugin-svelte": "^5.0.0",
@@ -20,6 +18,8 @@
 		"@types/d3": "^7.4.3",
 		"@types/node": "^22",
 		"d3": "^7.9.0",
+		"prettier": "^3.4.2",
+		"prettier-plugin-svelte": "^3.3.3",
 		"svelte": "^5.0.0",
 		"svelte-check": "^4.0.0",
 		"tailwindcss": "^4.0.0",
@@ -28,6 +28,7 @@
 		"vite": "^6.0.0"
 	},
 	"dependencies": {
+		"devalue": "^5.6.2",
 		"highlight.js": "^11.11.1",
 		"katex": "^0.16.27",
 		"marked": "^17.0.1",

← 09f9ea31 libp2p -> zenoh (#2132)  ·  back to Exo  ·  Add Kimi K2.7-Code model card (official INT4 weights + visio b5375f8c →