{"uuid": "b59c3437-4bbc-42ac-9bfd-6f3513a6c96d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/djlan/d0b5d62b498894d793a58be38d8f85e5", "content": "# [SECURITY] \u5c06 ReverseSelection \u4e2d\u7684 brace-expansion \u4ece 1.1.11 \u5347\u7ea7\u5230 1.1.18\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 ReverseSelection \u793a\u4f8b\u6269\u5c55\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u5f00\u53d1\u4f9d\u8d56\u94fe\u4e2d\u7684 `brace-expansion` \u56fa\u5b9a\u5230 1.1.18\uff0c\u4ee5\u5904\u7406 Component Governance \u62a5\u544a\u7684\u4e24\u4e2a\u9ad8\u5371\u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u4fdd\u6301\u4f9d\u8d56\u6765\u6e90\u548c\u4f9d\u8d56\u5173\u7cfb\u4e0d\u53d8\u3002\n\n- **PR\uff1a** [AzureNotebooks PR 767497](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767497)\n- **\u4f5c\u8005\uff1a** Dependabot\n- **\u72b6\u6001\uff1a** Active\uff0c\u975e\u8349\u7a3f\uff1b\u5305\u5185\u8bb0\u5f55\u7684\u5408\u5e76\u72b6\u6001\u4e3a `succeeded`\n- **\u5206\u652f\uff1a** `dependabot/npm_and_yarn/sample%2Fextensions%2Fcommon-extensions%2FReverseSelection/brace-expansion-1.1.18-749879` \u2192 `main`\n- **\u521b\u5efa\u65f6\u95f4\uff1a** 2026-08-07 09:45:17\n- **\u53d8\u66f4\u7edf\u8ba1\uff1a** 1 \u4e2a\u6587\u4ef6\u30011 \u4e2a\u63d0\u4ea4\u30011 \u4e2a\u8fed\u4ee3\uff1b\u6839\u636e\u5b8c\u6574\u5dee\u5f02\u8ba1\u6570\u4e3a 6 \u884c\u65b0\u589e\u30016 \u884c\u5220\u9664\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n6. [\u5dee\u5f02\u8986\u76d6\u8303\u56f4](#\u5dee\u5f02\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u6b64 PR \u7531 Dependabot \u521b\u5efa\uff0c\u76ee\u6807\u662f\u89e3\u51b3 Component Governance \u6807\u8bb0\u7684\u4e24\u4e2a\u9ad8\u5371\u544a\u8b66\uff1aCVE-2026-13149 \u548c CVE-2026-14257\u3002\u5b9e\u9645\u4ee3\u7801\u53d8\u66f4\u4ec5\u4f4d\u4e8e [sample/extensions/common-extensions/ReverseSelection/package-lock.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767497?path=/sample/extensions/common-extensions/ReverseSelection/package-lock.json&_a=files)\u3002\n\n\u9501\u6587\u4ef6\u4e2d\u7684 `brace-expansion` \u4ece 1.1.11 \u5347\u7ea7\u4e3a 1.1.18\u3002\u5305\u5185\u9644\u5e26\u7684\u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u660e\u786e\u63d0\u5230 1.1.12 \u4fee\u590d\u4e86\u6f5c\u5728 ReDoS\uff08\u6b63\u5219\u8868\u8fbe\u5f0f\u62d2\u7edd\u670d\u52a1\uff09\u6216\u4f4e\u6548\u6b63\u5219\u8868\u8fbe\u5f0f\u95ee\u9898\uff1b\u4e0d\u8fc7\uff0c\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u4e24\u4e2a CVE \u4e0e\u5177\u4f53\u4e0a\u6e38\u63d0\u4ea4\u4e4b\u95f4\u7684\u9010\u9879\u6620\u5c04\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u6bcf\u4e2a CVE \u5206\u522b\u7531\u54ea\u4e2a\u63d0\u4ea4\u4fee\u590d\u3002\n\n## \u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n**\u4e3a\u4ec0\u4e48\u8981\u6539\uff1a** \u65e7\u7248\u672c `brace-expansion` 1.1.11 \u89e6\u53d1\u4e86\u4e24\u4e2a\u9ad8\u5371\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\u3002\u8be5\u5e93\u8d1f\u8d23\u89e3\u6790\u548c\u5c55\u5f00\u7c7b\u4f3c `{a,b}`\u3001`{1..3}` \u7684 brace \u8868\u8fbe\u5f0f\uff1b\u6b64\u7c7b\u89e3\u6790\u903b\u8f91\u82e5\u5bf9\u7279\u5236\u8f93\u5165\u4f7f\u7528\u4f4e\u6548\u6b63\u5219\u8868\u8fbe\u5f0f\uff0c\u53ef\u80fd\u4ea7\u751f\u8fc7\u9ad8\u7684 CPU \u6d88\u8017\u3002\n\n**\u5982\u4f55\u751f\u6548\uff1a** \u9501\u6587\u4ef6\u540c\u65f6\u66f4\u65b0\u4e86 npm \u65b0\u5f0f `node_modules/brace-expansion` \u6761\u76ee\u548c\u65e7\u5f0f\u4f9d\u8d56\u6620\u5c04\u4e2d\u7684 `brace-expansion` \u6761\u76ee\uff0c\u4f7f\u4e24\u79cd\u9501\u6587\u4ef6\u8868\u793a\u90fd\u6307\u5411 1.1.18\u3002\u540e\u7eed\u4f7f\u7528\u8be5\u9501\u6587\u4ef6\u6267\u884c\u786e\u5b9a\u6027\u5b89\u88c5\u65f6\uff0c\u5305\u7ba1\u7406\u5668\u4f1a\u83b7\u53d6\u65b0\u7248\u672c\uff0c\u800c\u4e0d\u662f\u7ee7\u7eed\u5b89\u88c5 1.1.11\u3002\n\n### 2. \u9501\u6587\u4ef6\u89e3\u6790\u4e0e\u6784\u5efa\u53ef\u91cd\u590d\u6027\n\n\u5347\u7ea7\u540c\u6b65\u4fee\u6539\u4e86\u4e09\u9879\u5b89\u88c5\u5143\u6570\u636e\uff1a\n\n- `version`\uff1a\u4ece 1.1.11 \u6539\u4e3a 1.1.18\u3002\n- `resolved`\uff1a\u4ecd\u4f7f\u7528\u5185\u90e8 `AzureNotebooksEntry` npm \u6e90\uff0c\u4f46\u4e0b\u8f7d\u76ee\u6807\u6539\u4e3a 1.1.18 \u7684 tarball\u3002\n- `integrity`\uff1a\u66f4\u65b0\u4e3a\u65b0 tarball \u5bf9\u5e94\u7684\u5b8c\u6574\u6027\u6458\u8981\uff0c\u4f9b npm \u5728\u5b89\u88c5\u65f6\u6821\u9a8c\u4e0b\u8f7d\u5185\u5bb9\u3002\n\n`dev: true`\u3001MIT \u8bb8\u53ef\u8bc1\u4fe1\u606f\u4ee5\u53ca\u5bf9 `balanced-match` \u7684\u4f9d\u8d56\u8981\u6c42\u5747\u672a\u6539\u53d8\u3002\u8fd9\u8bf4\u660e\u672c\u6b21\u53d8\u66f4\u6ca1\u6709\u628a\u8be5\u5305\u4ece\u5f00\u53d1\u4f9d\u8d56\u63d0\u5347\u4e3a\u751f\u4ea7\u4f9d\u8d56\uff0c\u4e5f\u6ca1\u6709\u5728\u53ef\u89c1\u5dee\u5f02\u4e2d\u6539\u53d8\u5176\u76f4\u63a5\u4f9d\u8d56\u7ed3\u6784\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n| \u5f71\u54cd\u9762 | \u5206\u6790 |\n|---|---|\n| \u5b89\u5168\u6027 | \u4e3b\u8981\u6536\u76ca\u662f\u79fb\u9664\u88ab\u7ec4\u4ef6\u6cbb\u7406\u6807\u8bb0\u7684 1.1.11\uff0c\u5e76\u91c7\u7528\u5305\u542b\u4e0a\u6e38\u5b89\u5168\u4fee\u590d\u7684 1.1.18\u3002 |\n| \u8fd0\u884c\u65f6 | \u9501\u6587\u4ef6\u5c06\u8be5\u5305\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u56e0\u6b64\u76f4\u63a5\u751f\u4ea7\u8fd0\u884c\u65f6\u5f71\u54cd\u9884\u8ba1\u6709\u9650\uff1b\u4f46\u5206\u6790\u5305\u672a\u63d0\u4f9b\u5b8c\u6574\u4f9d\u8d56\u6811\u8c03\u7528\u8def\u5f84\uff0c\u4e0d\u80fd\u786e\u8ba4\u5b83\u4ec5\u5728\u6d4b\u8bd5\u6216\u6784\u5efa\u9636\u6bb5\u6267\u884c\u3002 |\n| \u6784\u5efa\u4e0e\u5f00\u53d1\u5de5\u5177 | \u4efb\u4f55\u901a\u8fc7\u9501\u6587\u4ef6\u6062\u590d ReverseSelection \u4f9d\u8d56\u7684\u5b89\u88c5\u3001\u6784\u5efa\u6216\u6d4b\u8bd5\u6d41\u7a0b\u90fd\u4f1a\u4f7f\u7528 1.1.18\u3002 |\n| \u4f9d\u8d56\u6765\u6e90 | \u4ecd\u4ece\u73b0\u6709\u5185\u90e8 Azure Artifacts \u6e90\u4e0b\u8f7d\uff0c\u6ca1\u6709\u5f15\u5165\u65b0\u7684\u5916\u90e8\u6ce8\u518c\u8868\u3002 |\n| \u4ee3\u7801\u4e0e API | \u6ca1\u6709\u5e94\u7528\u4ee3\u7801\u3001\u6269\u5c55\u6e05\u5355\u6216\u516c\u5f00 API \u53d8\u66f4\uff1b\u53ef\u89c1\u53d8\u66f4\u53ea\u6d89\u53ca\u89e3\u6790\u540e\u7684\u4f9d\u8d56\u7248\u672c\u548c\u6821\u9a8c\u5143\u6570\u636e\u3002 |\n| \u5ba1\u67e5\u8303\u56f4 | \u5355\u6587\u4ef6\u3001\u5355\u5305\u3001\u540c\u4e00 1.x \u7cfb\u5217\u5185\u5347\u7ea7\uff0c\u6574\u4f53\u53d8\u66f4\u9762\u8f83\u5c0f\u3002 |\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\n\n1. **brace \u5c55\u5f00\u884c\u4e3a\u53d8\u5316\uff1a** \u5c3d\u7ba1\u662f 1.x \u5185\u7684\u5c0f\u7248\u672c\u5347\u7ea7\uff0c\u5b89\u5168\u4fee\u590d\u53ef\u80fd\u8c03\u6574\u5bf9\u5f02\u5e38\u3001\u8d85\u957f\u6216\u6076\u610f brace \u8868\u8fbe\u5f0f\u7684\u5904\u7406\u65b9\u5f0f\u3002\u82e5 ReverseSelection \u7684\u6784\u5efa\u5de5\u5177\u94fe\u95f4\u63a5\u4f9d\u8d56\u65e7\u7248\u672c\u5728\u8fb9\u754c\u8f93\u5165\u4e0a\u7684\u884c\u4e3a\uff0c\u53ef\u80fd\u51fa\u73b0\u8f93\u51fa\u6216\u6027\u80fd\u5dee\u5f02\u3002\n2. **\u4f20\u9012\u4f9d\u8d56\u517c\u5bb9\u6027\uff1a** PR \u6ca1\u6709\u4fee\u6539 `package.json`\uff0c\u8bf4\u660e `brace-expansion` \u5f88\u53ef\u80fd\u662f\u4f20\u9012\u4f9d\u8d56\u6216\u4ec5\u7531\u9501\u6587\u4ef6\u7ea6\u675f\u3002\u9501\u6587\u4ef6\u80fd\u56fa\u5b9a\u5b89\u88c5\u7ed3\u679c\uff0c\u4f46\u4e0a\u6e38\u8c03\u7528\u8005\u4e0e 1.1.18 \u7684\u5b9e\u9645\u517c\u5bb9\u6027\u4ecd\u9700\u901a\u8fc7\u5b89\u88c5\u548c\u6784\u5efa\u9a8c\u8bc1\u3002\n3. **\u5b8c\u6574\u6027\u6458\u8981\u683c\u5f0f\u53d8\u5316\uff1a** `integrity` \u4ece SHA-512 \u683c\u5f0f\u53d8\u4e3a SHA-1 \u683c\u5f0f\u3002\u8be5\u503c\u5e94\u5f53\u662f\u53d1\u5e03\u5305\u5143\u6570\u636e\u6240\u5bf9\u5e94\u7684\u6821\u9a8c\u503c\uff0cnpm \u901a\u5e38\u53ef\u6b63\u5e38\u8bc6\u522b\uff1b\u4f46 SHA-1 \u7684\u6297\u78b0\u649e\u80fd\u529b\u5f31\u4e8e SHA-512\uff0c\u4e14\u90e8\u5206\u4e25\u683c\u4f9b\u5e94\u94fe\u7b56\u7565\u53ef\u80fd\u62d2\u7edd\u8f83\u5f31\u6458\u8981\uff0c\u56e0\u6b64\u5e94\u786e\u8ba4\u5f53\u524d npm \u7248\u672c\u548c\u7ec4\u7ec7\u7b56\u7565\u5141\u8bb8\u8be5\u683c\u5f0f\u3002\n4. **\u5185\u90e8\u6e90\u53ef\u7528\u6027\uff1a** \u5b89\u88c5\u4f9d\u8d56\u4e8e\u5185\u90e8\u6e90\u4e2d\u5b58\u5728\u5e76\u53ef\u8bbf\u95ee `brace-expansion` 1.1.18 tarball\u3002\u82e5\u5305\u5c1a\u672a\u540c\u6b65\u3001\u6743\u9650\u4e0d\u8db3\u6216\u6e90\u7f13\u5b58\u5f02\u5e38\uff0c\u786e\u5b9a\u6027\u5b89\u88c5\u4f1a\u5931\u8d25\u3002\n5. **\u544a\u8b66\u5173\u95ed\u4f9d\u8d56\u626b\u63cf\u7ed3\u679c\uff1a** \u7248\u672c\u5347\u7ea7\u610f\u56fe\u660e\u786e\uff0c\u4f46\u5206\u6790\u5305\u672a\u5305\u542b Component Governance \u7684\u91cd\u65b0\u626b\u63cf\u7ed3\u679c\uff0c\u4e0d\u80fd\u786e\u8ba4\u4e24\u4e2a\u544a\u8b66\u5df2\u7ecf\u5728\u5e73\u53f0\u4fa7\u5173\u95ed\u3002\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\u3001\u6d41\u6c34\u7ebf\u7ed3\u679c\u3001\u6784\u5efa\u65e5\u5fd7\u6216\u4eba\u5de5\u9a8c\u8bc1\u8bb0\u5f55\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u73b0\u6709\u6d4b\u8bd5\u5df2\u7ecf\u8986\u76d6\u6216\u901a\u8fc7\u3002\u5efa\u8bae\u81f3\u5c11\u6267\u884c\uff1a\n\n1. \u5728 `sample/extensions/common-extensions/ReverseSelection` \u4e0b\u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 Node.js/npm \u7248\u672c\u8fdb\u884c\u9501\u6587\u4ef6\u5b89\u88c5\uff08\u4f18\u5148\u4f7f\u7528 `npm ci`\uff09\uff0c\u786e\u8ba4\u5185\u90e8\u6e90\u4e0b\u8f7d\u4e0e\u5b8c\u6574\u6027\u6821\u9a8c\u6210\u529f\u3002\n2. \u8fd0\u884c\u8be5\u6269\u5c55\u73b0\u6709\u7684\u6784\u5efa\u3001lint \u548c\u6d4b\u8bd5\u547d\u4ee4\uff0c\u786e\u8ba4\u4f20\u9012\u4f9d\u8d56\u5347\u7ea7\u6ca1\u6709\u5f71\u54cd\u6253\u5305\u6216\u5f00\u53d1\u5de5\u5177\u94fe\u3002\n3. \u82e5\u9879\u76ee\u76f4\u63a5\u6216\u95f4\u63a5\u5904\u7406 brace/glob \u6a21\u5f0f\uff0c\u8865\u5145\u6216\u8fd0\u884c\u6b63\u5e38\u6a21\u5f0f\u3001\u5d4c\u5957\u6a21\u5f0f\u3001\u8d85\u957f\u8f93\u5165\u53ca\u6076\u610f\u8f93\u5165\u7528\u4f8b\uff0c\u786e\u8ba4\u7ed3\u679c\u517c\u5bb9\u4e14\u4e0d\u5b58\u5728\u660e\u663e\u6027\u80fd\u56de\u9000\u3002\n4. \u5728\u5408\u5e76\u524d\u786e\u8ba4 Component Governance \u91cd\u65b0\u626b\u63cf\u540e\uff0cCVE-2026-13149 \u4e0e CVE-2026-14257 \u5bf9\u5e94\u544a\u8b66\u5747\u5df2\u6d88\u9664\u3002\n\n## \u5dee\u5f02\u8986\u76d6\u8303\u56f4\n\n\u5206\u6790\u5305\u58f0\u660e\uff1a\n\n- `diffTruncated: false`\n- \u552f\u4e00\u6587\u4ef6\u5dee\u5f02\u7684 `truncated: false`\n- \u5dee\u5f02\u63d0\u53d6\u65b9\u5f0f\u4e3a `git-local`\n- \u65e0\u5bfc\u51fa\u9519\u8bef\u6216\u8b66\u544a\n\n\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u5185\u63d0\u4f9b\u7684\u5168\u90e8\u6587\u4ef6\u5dee\u5f02\uff1a\u4ec5 [sample/extensions/common-extensions/ReverseSelection/package-lock.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767497?path=/sample/extensions/common-extensions/ReverseSelection/package-lock.json&_a=files)\u3002PR \u63cf\u8ff0\u672c\u8eab\u5728\u5206\u6790\u5305\u4e2d\u4ee5\u622a\u65ad\u6587\u672c\u7ed3\u5c3e\uff0c\u56e0\u6b64\u672c\u8bf4\u660e\u6ca1\u6709\u5206\u6790\u6216\u5f15\u7528\u5176\u88ab\u622a\u65ad\u90e8\u5206\uff0c\u4e5f\u6ca1\u6709\u636e\u6b64\u63a8\u65ad\u989d\u5916\u53d1\u5e03\u8bf4\u660e\u3001\u63d0\u4ea4\u5185\u5bb9\u6216\u9a8c\u8bc1\u7ed3\u8bba\u3002\n", "creation_timestamp": "2026-08-30T16:29:34.727092Z"}