Several issues reported by a bot in workers implementation

[fabroos]

A bot reported several issues on this, are they representing a real risk?

I need support on this ASAP pls, would be super have this merged today!

---

  // eslint-disable-next-line @typescript-eslint/no-explicit-any
  console[level] = (message: any, ...optionalParams: any[]) => {
    const hasSubstitutions =
      typeof message === 'string' && /%[sdifcoO]/.test(message);

Medium SAST Finding

Regular Expression Denial of Service (ReDoS) in User Input Validation (CWE-185)

runtimes/typescript/worker.ts

      eval?.(`"use strict";
        ${event.data.dependencyBundle}`);

Medium SAST Finding

Unsafe Evaluation of User Input in JavaScript (CWE-95)

typescript/worker.ts

      eval?.(`"use strict";
        ${event.data.bundle}`);

Medium SAST Finding

Unsafe Evaluation of User Input in JavaScript (CWE-95)

typescript/worker.ts

      eval?.(`"use strict";
        ${event.data.dependencyBundle}`);

Medium SAST Finding

Unsafe Usage of eval() Function (CWE-95)

runtimes/typescript/worker.ts

      eval?.(`"use strict";
        ${event.data.bundle}`);

Medium SAST Finding

Unsafe Usage of eval() Function (CWE-95)

cc: @nebrius

[jaccolor2]

Hi! we also uncovered high severity security issues that seems to be related to your implementation since we didn't use any of those packages.

Here's the list of the security issues:

1. React Server Components Denial-of-Service

CVE: CVE-2025-55184
Severity: High (7.5)
Component: next
Fixed Version: 15.9
Description: Incomplete fix for denial-of-service attacks in React Server Components, affecting versions 19.0.2, 19.1.3, 19.2.2, and frameworks using App Router.
Impact: Malicious HTTP requests can cause server process hangs and CPU consumption.

2. Glob Command Injection

CVE: CVE-2025-64756
Severity: High (7.5)
Component: glob
Fixed Version: 11.1.0
Description: Command injection vulnerability in --cmd option, allowing arbitrary command execution when processing malicious filenames.
Impact: Remote code execution under user or CI privileges.

3. Linkify XSS Vulnerability

CVE: CVE-2025-8101
Severity: High (8.8)
Component: linkifyjs
Fixed Version: 4.3.2
Description: Improperly controlled modification of object prototype attributes allows XSS targeting HTML attributes.

4. Path-to-Regexp Denial-of-Service

CVE: CVE-2024-45296
Severity: High (7.5)
Component: path-to-regexp
Fixed Version: 6.3.0
Description: Poorly generated regular expressions can block the event loop, leading to DoS.
Impact: Performance degradation and potential DoS.

[nebrius]

Sure I'll look into these when I start work on the other issues in about an hour or so.

Couple notes:

Unsafe Evaluation of User Input in JavaScript (CWE-95)
Unsafe Evaluation of User Input in JavaScript (CWE-95)
Unsafe Evaluation of User Input in JavaScript (CWE-95)

These three are expected. The first one is for loading the our try-it-now dependencies, the second is for loading the SDK, and the third is for running the code that the user wrote in the Try It Now editor. There is no way to make this safe, from a technical perspective, but at the same time it's more safe than a user opening the dev tools and running code there, since it's run in a web worker (which is isolated from some things)

React Server Components Denial-of-Service

This comes from Next.js, not docs-md. It's been widely reported on, and is indeed a big deal. You should upgrade Next.js ASAP.

[nebrius]

Following up on the last CWE:

Regular Expression Denial of Service (ReDoS) in User Input Validation (CWE-185)

This one can be ignored too. This is in the patched console that's implemented to collect console logs and display them in the UI. Since console logs can include printf style formatting, the patch needs interpret the string contents and also run this formatting. Regex's are used to do this interpretation.

It's technically possible for the user to DoS themselves by inputting a malformed console.log. Since this is run in a web worker though, it won't lock up the main UI, just the try it now runner. And since this is on the client, it's not possible for this to cause any sort of DoS on any server.

[nebrius]

2. Glob Command Injection

The affected version was a transitive dependency of storybook, so a dev-only dependency. Regardless, I never actually used storybook, so I ripped out it, thus ripping out the affected version of glob.

Before:

After:

[nebrius]

3. Linkify XSS Vulnerability

docs-md doesn't include linkify:

the platform-docs repo does:

it's a transitive dependency of:

https://github.com/mistralai/platform-docs/blob/8e2d414b97e7352d32c50af4f0761f668321d5e9/package.json#L56

[nebrius]

4. Path-to-Regexp Denial-of-Service

Similar to linkifyjs, docs-md doesn't include path-to-regexp:

But platform-docs does:

[nebrius]

In summary:

• The four CWEs can be ignored
• One of the four CVEs is caused by docs-md, but is a dev-only dependency and so won't impact you. Nonetheless, I'll publish a new version along with any fixes for Several API examples are not reproducible or inconsistent across cURL and TypeScript #200 later today.

Action item for you: the other three CVEs are in platform-docs, and the Next.js CVE is extremely critical and you should fix that one ASAP.

[nebrius]

@simplesagar looks like I no longer have permission to publish docs-md to npm. Version 2.38 is ready to go. It only includes the removal of storybook though to address this thread, and so isn't pressing.