Issues

• [MEDIUM] Nx: Path traversal in nx migrate package-migrations extraction

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3305 · Filter by author cdk8s-automation opened on Oct 9, 2026

• [MEDIUM] PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3306 · Filter by author cdk8s-automation opened on Oct 9, 2026

• [HIGH] Nx: OS command injection via git revisions and remote refs

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3303 · Filter by author cdk8s-automation opened on Oct 9, 2026

• [HIGH] Nx daemon and plugin worker sockets are accessible to other local users

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3304 · Filter by author cdk8s-automation opened on Oct 9, 2026

• [MEDIUM] sprintf-js vulnerable to denial of service through unbounded precision specifiers

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3302 · Filter by author cdk8s-automation opened on Oct 9, 2026

• [HIGH] http-cache-semantics max-stale handling can disclose cross-user cached responses

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3295 · Filter by author cdk8s-automation opened on Oct 6, 2026

• (cdk8s-core) Chart#generateObjectName truncates names to 63 characters even for resources that allow 253 characters

  bugneeds-triage
  cdk8s-team/cdk8s#3270 · Filter by author Yang-33 opened on Sep 14, 2026

• [HIGH] js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3267 · Filter by author cdk8s-automation opened on Sep 12, 2026

• [MEDIUM] stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3260 · Filter by author cdk8s-automation opened on Sep 6, 2026

• [HIGH] Nx: Zip-Slip in the self-hosted remote cache

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3218 · Filter by author cdk8s-automation opened on Aug 9, 2026

• [HIGH] JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3217 · Filter by author cdk8s-automation opened on Aug 9, 2026

• [MEDIUM] nx graph dev server permissive CORS policy

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3204 · Filter by author cdk8s-automation opened on Aug 3, 2026

• [HIGH] js-yaml: YAML merge-key chains can force quadratic CPU consumption

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3190 · Filter by author cdk8s-automation opened on Jul 23, 2026

• [MEDIUM] node-tar: Process crash via PAX numeric path type confusion

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3189 · Filter by author cdk8s-automation opened on Jul 23, 2026

• Add support for Kubernetes v1.35

  feature-requestneeds-triage
  cdk8s-team/cdk8s#3186 · Filter by author Hazzard17h opened on Jul 20, 2026

• Cannot remove temporary file during cdk8s import

  bugneeds-triage
  cdk8s-team/cdk8s#3171 · Filter by author FirelightFlagboy opened on Jul 12, 2026

• CRD import: prefer storage version as default construct

  feature-requestneeds-triage
  cdk8s-team/cdk8s#3167 · Filter by author moh2a opened on Jul 9, 2026

• [HIGH] sigstore's certificateOIDs verification constraints are silently dropped and never enforced

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3158 · Filter by author cdk8s-automation opened on Jul 5, 2026

• [MEDIUM] @sigstore/core has DSSE payloadType type-binding failure

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3146 · Filter by author cdk8s-automation opened on Jun 30, 2026

• [MEDIUM] JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3127 · Filter by author cdk8s-automation opened on Jun 19, 2026

• [MEDIUM] node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3123 · Filter by author cdk8s-automation opened on Jun 18, 2026

• [MEDIUM] uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3032 · Filter by author cdk8s-automation opened on Apr 26, 2026
  1

• [MEDIUM] Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions

  dependabot-security-findingneeds-triagepriority/p0
  cdk8s-team/cdk8s#3000 · Filter by author cdk8s-automation opened on Apr 2, 2026

• Support ESM: generated imports are incompatible with "type": "module"

  cdk8s-team/cdk8s#2992 · Filter by author DanielRamosAcosta opened on Mar 28, 2026
  1

• Guided CDK8s install mission in KubeStellar Console

  cdk8s-team/cdk8s#2979 · Filter by author clubanderson opened on Mar 18, 2026