{"vulnerability": "cve-2026-13149", "sightings": [{"uuid": "37b9865b-1733-4c03-835a-aa75ba9e7551", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/djlan/9ed54c153214c454e5a8661f729e3aaf", "content": "# PR 767495\uff1a\u5347\u7ea7 AzNB.Gather \u7684 brace-expansion \u4ee5\u4fee\u590d\u5b89\u5168\u6f0f\u6d1e\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 AzNB.Gather \u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u5f00\u53d1\u4f9d\u8d56\u94fe\u4e2d\u7684 `brace-expansion` \u4ece 1.1.11 \u56fa\u5b9a\u5230 1.1.18\uff0c\u4ee5\u54cd\u5e94\u4e24\u4e2a\u9ad8\u5371 Component Governance \u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u4e0d\u6539\u53d8\u5176\u73b0\u6709\u5b50\u4f9d\u8d56\u58f0\u660e\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [767495](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767495) |\n| \u539f\u59cb\u6807\u9898 | `[SECURITY] Bump brace-expansion from 1.1.11 to 1.1.18 in /sample/extensions/common-extensions/AzNB.Gather` |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | Active\uff0c\u975e\u8349\u7a3f\uff1b\u5305\u5185\u8bb0\u5f55\u7684\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fextensions%2Fcommon-extensions%2FAzNB.Gather/brace-expansion-1.1.18-749870` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-08-07 09:45:17\uff08\u5206\u6790\u5305\u672a\u6ce8\u660e\u65f6\u533a\uff09 |\n| \u53d8\u66f4\u7edf\u8ba1 | 1 \u4e2a\u63d0\u4ea4\u30011 \u4e2a\u8fed\u4ee3\u30011 \u4e2a\u6587\u4ef6\uff1b\u6309\u5dee\u5f02\u884c\u8ba1\u7b97\u4e3a\u65b0\u589e 7 \u884c\u3001\u5220\u9664 6 \u884c |\n\n## \u76ee\u5f55\n\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n  - [\u4f9d\u8d56\u89e3\u6790\u4e0e\u7248\u672c\u9501\u5b9a](#\u4f9d\u8d56\u89e3\u6790\u4e0e\u7248\u672c\u9501\u5b9a)\n  - [\u5305\u6765\u6e90\u3001\u5b8c\u6574\u6027\u4e0e\u8bb8\u53ef\u8bc1\u5143\u6570\u636e](#\u5305\u6765\u6e90\u5b8c\u6574\u6027\u4e0e\u8bb8\u53ef\u8bc1\u5143\u6570\u636e)\n  - [\u5b89\u5168\u544a\u8b66\u5904\u7f6e](#\u5b89\u5168\u544a\u8b66\u5904\u7f6e)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n- [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n- [\u6d4b\u8bd5\u60c5\u51b5\u4e0e\u5efa\u8bae](#\u6d4b\u8bd5\u60c5\u51b5\u4e0e\u5efa\u8bae)\n- [\u5206\u6790\u8986\u76d6\u8303\u56f4\u4e0e\u622a\u65ad\u8bf4\u660e](#\u5206\u6790\u8986\u76d6\u8303\u56f4\u4e0e\u622a\u65ad\u8bf4\u660e)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u672c\u6b21\u53d8\u66f4\u53ea\u7f16\u8f91\u4e86 [`sample/extensions/common-extensions/AzNB.Gather/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767495?path=/sample/extensions/common-extensions/AzNB.Gather/package-lock.json&_a=files)\u3002\u9501\u6587\u4ef6\u4e2d `brace-expansion` \u7684\u4e24\u4e2a\u8bb0\u5f55\u4f4d\u7f6e\u88ab\u540c\u6b65\u66f4\u65b0\uff1a\n\n1. `node_modules/brace-expansion` \u7684\u5b9e\u9645\u5b89\u88c5\u8bb0\u5f55\u3002\n2. \u9501\u6587\u4ef6\u4f9d\u8d56\u6620\u5c04\u4e2d\u7684 `brace-expansion` \u8bb0\u5f55\u3002\n\n\u4e24\u5904\u7248\u672c\u5747\u4ece 1.1.11 \u5347\u7ea7\u5230 1.1.18\uff0c\u5e76\u540c\u6b65\u66ff\u6362\u5185\u90e8 Azure Artifacts npm \u5305\u5730\u5740\u548c\u5b8c\u6574\u6027\u6458\u8981\u3002\u73b0\u6709 `balanced-match` \u4e0e `concat-map` \u4f9d\u8d56\u58f0\u660e\u4fdd\u6301\u4e0d\u53d8\uff0c\u56e0\u6b64\u53d8\u66f4\u76ee\u6807\u96c6\u4e2d\u5728\u88ab\u9501\u5b9a\u5305\u81ea\u8eab\uff0c\u800c\u4e0d\u662f\u91cd\u5851\u4f9d\u8d56\u6811\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### \u4f9d\u8d56\u89e3\u6790\u4e0e\u7248\u672c\u9501\u5b9a\n\n**\u4e3a\u4ec0\u4e48\u6539\uff1a** PR \u63cf\u8ff0\u6307\u51fa Component Governance \u68c0\u6d4b\u5230\u4e24\u4e2a\u9ad8\u5371\u5b89\u5168\u544a\u8b66\uff1aCVE-2026-13149 \u548c CVE-2026-14257\u3002Dependabot \u56e0\u6b64\u9009\u62e9\u540c\u4e00 1.x \u4e3b\u7248\u672c\u4e2d\u7684 1.1.18\uff0c\u907f\u514d\u7ee7\u7eed\u5b89\u88c5\u5b58\u5728\u544a\u8b66\u7684 1.1.11\u3002\n\n**\u5982\u4f55\u751f\u6548\uff1a** npm \u6309\u9501\u6587\u4ef6\u5b89\u88c5 AzNB.Gather \u7684\u5f00\u53d1\u4f9d\u8d56\u65f6\uff0c\u4f1a\u4ece\u66f4\u65b0\u540e\u7684\u9501\u8bb0\u5f55\u89e3\u6790\u5e76\u5b89\u88c5 `brace-expansion@1.1.18`\u3002\u5b89\u88c5\u8282\u70b9\u8bb0\u5f55\u548c\u4f9d\u8d56\u6620\u5c04\u540c\u65f6\u66f4\u65b0\uff0c\u53ef\u907f\u514d\u9501\u6587\u4ef6\u5185\u90e8\u5bf9\u540c\u4e00\u5305\u7ed9\u51fa\u4e0d\u4e00\u81f4\u7248\u672c\u3002\u5305\u4ecd\u88ab\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u5dee\u5f02\u4e2d\u6ca1\u6709\u663e\u793a\u5176\u8fd0\u884c\u65f6\u4f9d\u8d56\u5c5e\u6027\u53d1\u751f\u53d8\u5316\u3002\n\n### \u5305\u6765\u6e90\u3001\u5b8c\u6574\u6027\u4e0e\u8bb8\u53ef\u8bc1\u5143\u6570\u636e\n\n\u9501\u6587\u4ef6\u4e2d\u7684\u4e0b\u8f7d\u5730\u5740\u4ece\u5185\u90e8\u6e90\u4e0a\u7684 `brace-expansion-1.1.11.tgz` \u6539\u4e3a `brace-expansion-1.1.18.tgz`\uff0c\u8bf4\u660e\u5b89\u88c5\u4ecd\u901a\u8fc7\u65e2\u6709\u7684 AzureNotebooksEntry \u5185\u90e8 npm \u6ce8\u518c\u8868\u5b8c\u6210\uff0c\u800c\u4e0d\u662f\u5207\u6362\u5230\u65b0\u7684\u5916\u90e8\u6e90\u3002\n\n\u5b8c\u6574\u6027\u503c\u968f tarball \u66f4\u65b0\uff0c\u4ece SHA-512 \u683c\u5f0f\u53d8\u4e3a SHA-1 \u683c\u5f0f\uff1b\u8fd9\u662f\u9501\u6587\u4ef6\u7528\u4e8e\u6821\u9a8c\u6240\u4e0b\u8f7d\u5305\u5185\u5bb9\u7684\u5143\u6570\u636e\u53d8\u5316\u3002\u65b0\u5b89\u88c5\u8282\u70b9\u8fd8\u663e\u5f0f\u589e\u52a0\u4e86 `MIT` \u8bb8\u53ef\u8bc1\u5b57\u6bb5\u3002\u4f9d\u8d56\u6620\u5c04\u90e8\u5206\u6ca1\u6709\u5bf9\u5e94\u8bb8\u53ef\u8bc1\u5b57\u6bb5\u53d8\u66f4\u3002\n\n### \u5b89\u5168\u544a\u8b66\u5904\u7f6e\n\n\u8be5 PR \u7684\u76f4\u63a5\u76ee\u7684\uff0c\u662f\u901a\u8fc7\u4f9d\u8d56\u7248\u672c\u5347\u7ea7\u5904\u7406 PR \u63cf\u8ff0\u4e2d\u5217\u51fa\u7684\u4e24\u4e2a\u9ad8\u5371 CG \u544a\u8b66\u3002\u5305\u5185\u53ef\u89c1\u7684\u53d1\u5e03\u8bf4\u660e\u7247\u6bb5\u8fd8\u63d0\u5230 1.1.12 \u4fee\u590d\u4e86\u6f5c\u5728 ReDoS/\u4f4e\u6548\u6b63\u5219\u8868\u8fbe\u5f0f\u95ee\u9898\uff1b\u4e0d\u8fc7\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u4e24\u4e2a 2026 CVE \u4e0e\u5177\u4f53\u4e0a\u6e38\u63d0\u4ea4\u4e4b\u95f4\u7684\u5b8c\u6574\u6620\u5c04\uff0c\u56e0\u6b64\u53ea\u80fd\u786e\u8ba4\u6b64\u6b21\u5347\u7ea7\u662f Dependabot \u9488\u5bf9\u544a\u8b66\u751f\u6210\u7684\u5904\u7f6e\uff0c\u4e0d\u80fd\u4ec5\u51ed\u5f53\u524d\u5305\u65ad\u8a00\u6bcf\u4e2a CVE \u7684\u5177\u4f53\u4fee\u590d\u5b9e\u73b0\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n| \u5f71\u54cd\u9762 | \u5206\u6790 |\n|---|---|\n| \u6784\u5efa\u4e0e\u5b89\u88c5 | \u4f7f\u7528\u9501\u6587\u4ef6\u6267\u884c\u786e\u5b9a\u6027\u5b89\u88c5\u65f6\uff0cAzNB.Gather \u7684\u76f8\u5173\u5f00\u53d1\u4f9d\u8d56\u5c06\u89e3\u6790\u4e3a 1.1.18\u3002\u5185\u90e8\u5305\u6e90\u8def\u5f84\u4fdd\u6301\u4e0d\u53d8\uff0c\u901a\u5e38\u4e0d\u9700\u8981\u65b0\u589e\u6e90\u914d\u7f6e\u3002 |\n| \u8fd0\u884c\u65f6 | \u5dee\u5f02\u5c06\u8be5\u5305\u7ee7\u7eed\u6807\u8bb0\u4e3a `dev: true`\uff0c\u4e14\u6ca1\u6709\u5e94\u7528\u6e90\u7801\u53d8\u66f4\uff1b\u56e0\u6b64\u76f4\u63a5\u751f\u4ea7\u8fd0\u884c\u65f6\u5f71\u54cd\u9884\u8ba1\u6709\u9650\u3002\u4f46\u82e5\u6784\u5efa\u5de5\u5177\u5728\u6253\u5305\u6216\u751f\u6210\u9636\u6bb5\u8c03\u7528\u8be5\u4f9d\u8d56\uff0c\u5176\u884c\u4e3a\u4ecd\u53ef\u80fd\u5f71\u54cd\u6784\u5efa\u4ea7\u7269\u3002 |\n| \u529f\u80fd\u884c\u4e3a | `brace-expansion` \u8d1f\u8d23\u5c55\u5f00\u5927\u62ec\u53f7\u8868\u8fbe\u5f0f\u3002\u8865\u4e01\u7248\u672c\u53ef\u80fd\u8c03\u6574\u6076\u610f\u3001\u8d85\u957f\u6216\u8fb9\u754c\u8f93\u5165\u7684\u5904\u7406\u65b9\u5f0f\uff1b\u6b63\u5e38\u8868\u8fbe\u5f0f\u5e94\u4fdd\u6301 1.x \u517c\u5bb9\uff0c\u4f46\u5f53\u524d\u5206\u6790\u5305\u6ca1\u6709\u4e0a\u6e38\u5b8c\u6574\u53d8\u66f4\u96c6\u6216\u672c\u4ed3\u5e93\u8c03\u7528\u70b9\uff0c\u65e0\u6cd5\u8bc1\u660e\u6240\u6709\u8fb9\u754c\u884c\u4e3a\u5b8c\u5168\u4e00\u81f4\u3002 |\n| \u5b89\u5168\u6027 | \u9884\u671f\u51cf\u5c11\u65e7\u7248\u4f9d\u8d56\u89e6\u53d1\u4e24\u4e2a\u9ad8\u5371 CG \u544a\u8b66\u7684\u98ce\u9669\uff0c\u5e76\u5305\u542b\u5305\u5185\u53d1\u5e03\u8bf4\u660e\u7247\u6bb5\u6240\u63d0\u53ca\u7684\u6b63\u5219\u8868\u8fbe\u5f0f\u5b89\u5168\u4fee\u590d\u3002\u6700\u7ec8\u662f\u5426\u6e05\u9664\u544a\u8b66\u4ecd\u5e94\u4ee5\u5408\u5e76\u540e\u7684 CG \u626b\u63cf\u7ed3\u679c\u4e3a\u51c6\u3002 |\n| \u8bb8\u53ef\u8bc1 | \u65b0\u9501\u8bb0\u5f55\u663e\u5f0f\u6807\u6ce8 MIT\uff1b\u5206\u6790\u5305\u6ca1\u6709\u663e\u793a\u8bb8\u53ef\u8bc1\u7c7b\u578b\u53d1\u751f\u5b9e\u8d28\u53d8\u5316\uff0c\u53ea\u80fd\u786e\u8ba4\u65b0\u589e\u4e86\u8be5\u5143\u6570\u636e\u3002 |\n| \u4ee3\u7801\u5ba1\u67e5\u8303\u56f4 | \u4ec5\u6709\u9501\u6587\u4ef6\u53d8\u66f4\uff0c\u6ca1\u6709\u5e94\u7528\u903b\u8f91\u3001\u914d\u7f6e\u903b\u8f91\u6216\u6d4b\u8bd5\u4ee3\u7801\u53d8\u66f4\u3002 |\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n1. **\u5b8c\u6574\u6027\u6458\u8981\u7b97\u6cd5\u53d8\u5316\uff1a** \u65b0\u8bb0\u5f55\u4f7f\u7528 `sha1-...`\uff0c\u65e7\u8bb0\u5f55\u4f7f\u7528 `sha512-...`\u3002\u8fd9\u4e0d\u7b49\u540c\u4e8e\u4e0b\u8f7d\u5185\u5bb9\u672a\u6821\u9a8c\uff0c\u4f46 SHA-1 \u7684\u6297\u78b0\u649e\u5f3a\u5ea6\u5f31\u4e8e SHA-512\u3002\u5e94\u786e\u8ba4\u8fd9\u662f\u5185\u90e8\u6ce8\u518c\u8868\u4e3a 1.1.18 \u8fd4\u56de\u7684\u771f\u5b9e\u5143\u6570\u636e\uff0c\u4e14\u7ec4\u7ec7\u7b56\u7565\u5141\u8bb8\u8be5\u6458\u8981\u683c\u5f0f\u3002\n2. **\u8865\u4e01\u7248\u672c\u884c\u4e3a\u5dee\u5f02\uff1a** \u7248\u672c\u4ecd\u5728 1.x \u8303\u56f4\u5185\uff0c\u4f46\u5b89\u5168\u4fee\u590d\u53ef\u80fd\u6709\u610f\u9650\u5236\u5bfc\u81f4\u8d44\u6e90\u6d88\u8017\u7684\u5c55\u5f00\u6a21\u5f0f\uff0c\u4f9d\u8d56\u6781\u7aef\u6216\u5f02\u5e38\u5927\u62ec\u53f7\u8f93\u5165\u7684\u5de5\u5177\u53ef\u80fd\u89c2\u5bdf\u5230\u7ed3\u679c\u3001\u9519\u8bef\u6216\u6027\u80fd\u53d8\u5316\u3002\n3. **\u4ec5\u66f4\u65b0\u9501\u6587\u4ef6\uff1a** \u5206\u6790\u5305\u4e2d\u6ca1\u6709 `package.json` \u53d8\u66f4\u3002\u8fd9\u9002\u7528\u4e8e\u901a\u8fc7\u4f20\u9012\u4f9d\u8d56\u6216\u65e2\u6709\u7248\u672c\u8303\u56f4\u63d0\u5347\u9501\u5b9a\u7248\u672c\u7684\u573a\u666f\uff0c\u4f46\u540e\u7eed\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u65f6\u80fd\u5426\u7ee7\u7eed\u4fdd\u7559 1.1.18\uff0c\u53d6\u51b3\u4e8e\u5206\u6790\u5305\u672a\u63d0\u4f9b\u7684\u6e05\u5355\u7ea6\u675f\u548c\u4e0a\u6e38\u4f9d\u8d56\u8303\u56f4\u3002\n4. **\u5185\u90e8\u6e90\u53ef\u7528\u6027\uff1a** \u5b89\u88c5\u4f9d\u8d56\u4e8e AzureNotebooksEntry \u6e90\u4e2d\u5b58\u5728 1.1.18 tarball\u3002\u5305\u5185\u6ca1\u6709\u5b89\u88c5\u65e5\u5fd7\uff0c\u65e0\u6cd5\u786e\u8ba4\u6240\u6709\u6784\u5efa\u73af\u5883\u5747\u80fd\u8bbf\u95ee\u5e76\u6210\u529f\u4e0b\u8f7d\u8be5\u7248\u672c\u3002\n5. **\u544a\u8b66\u95ed\u73af\u5c1a\u65e0\u8bc1\u636e\uff1a** PR \u63cf\u8ff0\u8bf4\u660e\u5347\u7ea7\u7528\u4e8e\u4fee\u590d\u4e24\u4e2a\u9ad8\u5371\u544a\u8b66\uff0c\u4f46\u5305\u4e2d\u6ca1\u6709\u5408\u5e76\u540e CG \u626b\u63cf\u6216\u7b56\u7565\u7ed3\u679c\uff0c\u4e0d\u80fd\u58f0\u79f0\u544a\u8b66\u5df2\u7ecf\u5173\u95ed\u3002\n\n## \u6d4b\u8bd5\u60c5\u51b5\u4e0e\u5efa\u8bae\n\n\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u6d4b\u8bd5\u4ee3\u7801\u53d8\u66f4\u3001\u6d4b\u8bd5\u8fd0\u884c\u8bb0\u5f55\u3001\u6784\u5efa\u65e5\u5fd7\u6216 CG \u590d\u626b\u7ed3\u679c\uff1b`errors` \u548c `warnings` \u6570\u7ec4\u4e3a\u7a7a\u53ea\u8868\u793a\u6570\u636e\u5bfc\u51fa\u6ca1\u6709\u62a5\u544a\u8fd9\u4e9b\u95ee\u9898\uff0c\u4e0d\u4ee3\u8868\u6d4b\u8bd5\u5df2\u7ecf\u6267\u884c\u5e76\u901a\u8fc7\u3002\n\n\u5efa\u8bae\u5728\u5408\u5e76\u524d\u81f3\u5c11\u786e\u8ba4\uff1a\n\n1. \u5728\u4e0e CI \u76f8\u540c\u7684 Node/npm \u73af\u5883\u4e2d\u6267\u884c\u9501\u6587\u4ef6\u5b89\u88c5\uff0c\u9a8c\u8bc1\u5185\u90e8\u6e90\u53ef\u8bbf\u95ee\u3001\u5b8c\u6574\u6027\u6821\u9a8c\u6210\u529f\u4e14\u9501\u6587\u4ef6\u4e0d\u4f1a\u518d\u6b21\u6f02\u79fb\u3002\n2. \u8fd0\u884c AzNB.Gather \u5df2\u6709\u7684\u6784\u5efa\u548c\u6d4b\u8bd5\uff0c\u91cd\u70b9\u8986\u76d6\u4f7f\u7528 glob\u3001\u8def\u5f84\u5339\u914d\u6216\u5927\u62ec\u53f7\u5c55\u5f00\u7684\u6784\u5efa\u6b65\u9aa4\u3002\n3. \u589e\u52a0\u6216\u6267\u884c\u6b63\u5e38\u3001\u5d4c\u5957\u3001\u8d85\u957f\u53ca\u6076\u610f\u5927\u62ec\u53f7\u8868\u8fbe\u5f0f\u7528\u4f8b\uff0c\u786e\u8ba4\u5b89\u5168\u9650\u5236\u4e0d\u4f1a\u7834\u574f\u9884\u671f\u8f93\u5165\u3002\n4. \u8fd0\u884c Component Governance/\u4f9d\u8d56\u626b\u63cf\uff0c\u786e\u8ba4 CVE-2026-13149 \u4e0e CVE-2026-14257 \u5bf9 `main` \u7684\u544a\u8b66\u80fd\u591f\u88ab\u89e3\u9664\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\u4e0e\u622a\u65ad\u8bf4\u660e\n\n- \u5206\u6790\u5305\u58f0\u660e\u5168\u5c40\u5dee\u5f02 `diffTruncated: false`\uff0c\u8be5\u6587\u4ef6\u5dee\u5f02\u4e5f\u6807\u8bb0\u4e3a `truncated: false`\uff1b\u56e0\u6b64\u5305\u4e2d\u8bb0\u5f55\u7684 1 \u4e2a\u53d8\u66f4\u6587\u4ef6\u5177\u6709\u5b8c\u6574\u5dee\u5f02\u8986\u76d6\u3002\n- \u5dee\u5f02\u603b\u5927\u5c0f\u4e3a 1,821 \u5b57\u8282\uff0c\u4f4e\u4e8e\u5168\u5c40 524,288 \u5b57\u8282\u548c\u5355\u6587\u4ef6 65,536 \u5b57\u8282\u7684\u5bfc\u51fa\u4e0a\u9650\u3002\n- PR \u63cf\u8ff0\u5b57\u6bb5\u957f\u5ea6\u4e3a 4,000 \u4e2a\u5b57\u7b26\uff0c\u5e76\u5728\u4e0a\u6e38\u63d0\u4ea4\u5217\u8868\u4e2d\u4ee5\u4e0d\u5b8c\u6574\u7684 `.c...` \u7247\u6bb5\u7ed3\u675f\uff1b\u867d\u7136\u5305\u4e2d\u6ca1\u6709\u5355\u72ec\u7684\u201c\u63cf\u8ff0\u5df2\u622a\u65ad\u201d\u6807\u5fd7\uff0c\u4f46\u5176\u5185\u5bb9\u660e\u663e\u672a\u5b8c\u6574\u7ed3\u675f\u3002\u56e0\u6b64\u672c\u6587\u6ca1\u6709\u5206\u6790\u8be5\u4f4d\u7f6e\u4e4b\u540e\u53ef\u80fd\u5b58\u5728\u7684\u53d1\u5e03\u8bf4\u660e\u3001\u63d0\u4ea4\u5217\u8868\u6216\u5176\u4ed6\u63cf\u8ff0\u5185\u5bb9\u3002\n- \u5206\u6790\u5305\u672a\u5305\u542b\u4ed3\u5e93\u5176\u4ed6\u6587\u4ef6\u5185\u5bb9\u3001\u4f9d\u8d56\u8c03\u7528\u70b9\u3001CI \u65e5\u5fd7\u3001\u6d4b\u8bd5\u7ed3\u679c\u6216\u5b8c\u6574\u4e0a\u6e38\u6e90\u7801\u5dee\u5f02\uff1b\u76f8\u5173\u7ed3\u8bba\u5747\u9650\u5b9a\u5728\u6240\u63d0\u4f9b\u7684 PR \u5143\u6570\u636e\u4e0e\u9501\u6587\u4ef6\u5dee\u5f02\u5185\u3002\n", "creation_timestamp": "2026-08-31T00:07:00.466900Z"}, {"uuid": "b4987122-3d15-4251-b587-5cf098bc7d5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/djlan/ba02ee3d4f2be9706182be127e104061", "content": "# PR 767494 \u4e2d\u6587\u8bf4\u660e\uff1a\u5347\u7ea7 AzNB.Spellchecker \u7684 brace-expansion \u4ee5\u4fee\u590d\u5b89\u5168\u6f0f\u6d1e\n\n> **\u4e00\u53e5\u8bdd\u603b\u7ed3\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 AzNB.Spellchecker \u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u5f00\u53d1\u4f9d\u8d56 `brace-expansion` \u4ece 1.1.11 \u5347\u7ea7\u5230 1.1.18\uff0c\u4ee5\u54cd\u5e94\u4e24\u4e2a\u9ad8\u4e25\u91cd\u7ea7\u522b\u7684\u7ec4\u4ef6\u6cbb\u7406\u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u4fdd\u6301\u5176\u4f9d\u8d56\u7ed3\u6784\u4e0d\u53d8\u3002\n\n- **PR\uff1a** [767494](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767494)\n- **\u539f\u59cb\u6807\u9898\uff1a** `[SECURITY] Bump brace-expansion from 1.1.11 to 1.1.18 in /sample/extensions/common-extensions/AzNB.Spellchecker`\n- **\u4f5c\u8005\uff1a** Dependabot\n- **\u72b6\u6001\uff1a** Active\uff0c\u975e\u8349\u7a3f\uff1b\u5305\u4e2d\u8bb0\u5f55\u7684\u5408\u5e76\u72b6\u6001\u4e3a `succeeded`\n- **\u5206\u652f\uff1a** `dependabot/npm_and_yarn/sample%2Fextensions%2Fcommon-extensions%2FAzNB.Spellchecker/brace-expansion-1.1.18-749872` \u2192 `main`\n- **\u53d8\u66f4\u7edf\u8ba1\uff1a** 1 \u4e2a\u6587\u4ef6\u30011 \u4e2a\u63d0\u4ea4\u30011 \u6b21\u8fed\u4ee3\uff1b\u6839\u636e\u6240\u9644 diff \u7edf\u8ba1\u4e3a\u65b0\u589e 7 \u884c\u3001\u5220\u9664 6 \u884c\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae)\n6. [Diff \u8986\u76d6\u8303\u56f4](#diff-\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5 PR \u7531 Dependabot \u521b\u5efa\uff0c\u76ee\u6807\u662f\u5904\u7406\u7ec4\u4ef6\u6cbb\u7406\u62a5\u544a\u7684\u4e24\u4e2a\u9ad8\u4e25\u91cd\u7ea7\u522b\u544a\u8b66\uff1aCVE-2026-13149 \u548c CVE-2026-14257\u3002\u5b9e\u9645\u4ee3\u7801\u6539\u52a8\u96c6\u4e2d\u5728 [AzNB.Spellchecker/package-lock.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767494?path=/sample/extensions/common-extensions/AzNB.Spellchecker/package-lock.json&_a=files)\uff0c\u6ca1\u6709\u4fee\u6539\u6269\u5c55\u6e90\u4ee3\u7801\u6216 `package.json`\u3002\n\n\u9501\u6587\u4ef6\u4e2d `brace-expansion` \u7684\u7248\u672c\u7531 1.1.11 \u66f4\u65b0\u4e3a 1.1.18\uff0c\u5e76\u540c\u6b65\u66f4\u65b0\u5305\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u5b57\u6bb5\u3002PR \u63cf\u8ff0\u6240\u9644\u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u660e\u786e\u63d0\u5230 1.1.12 \u4fee\u590d\u4e86\u6f5c\u5728 ReDoS/\u4f4e\u6548\u6b63\u5219\u8868\u8fbe\u5f0f\u95ee\u9898\uff1b\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u4e24\u4e2a CVE \u4e0e\u5177\u4f53\u4e0a\u6e38\u63d0\u4ea4\u4e4b\u95f4\u66f4\u7ec6\u7c92\u5ea6\u7684\u6620\u5c04\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u6bcf\u4e2a CVE \u5206\u522b\u7531\u54ea\u4e00\u9879\u4ee3\u7801\u4fee\u6539\u4fee\u590d\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u4f9d\u8d56\u5b89\u5168\u5347\u7ea7\n\n**\u4e3a\u4ec0\u4e48\u8981\u6539\uff1a** \u65e7\u7248 `brace-expansion` 1.1.11 \u88ab\u7ec4\u4ef6\u6cbb\u7406\u8bc6\u522b\u4e3a\u6d89\u53ca\u4e24\u4e2a\u9ad8\u4e25\u91cd\u7ea7\u522b\u5b89\u5168\u544a\u8b66\u3002\u5c06\u5176\u5347\u7ea7\u5230 1.1.18\uff0c\u53ef\u8ba9 AzNB.Spellchecker \u5728\u91cd\u65b0\u5b89\u88c5\u4f9d\u8d56\u65f6\u89e3\u6790\u5230\u66f4\u65b0\u540e\u7684 1.x \u7248\u672c\uff0c\u800c\u4e0d\u518d\u9501\u5b9a\u5230\u5b58\u5728\u544a\u8b66\u7684\u65e7\u5305\u3002\n\n**\u5982\u4f55\u751f\u6548\uff1a**\n\n- `node_modules/brace-expansion` \u9501\u8bb0\u5f55\u4ece 1.1.11 \u66f4\u65b0\u5230 1.1.18\u3002\n- npm v7+ \u4f7f\u7528\u7684 `packages` \u533a\u57df\u548c\u517c\u5bb9\u65e7\u9501\u6587\u4ef6\u8bfb\u53d6\u65b9\u5f0f\u7684\u9876\u5c42 `dependencies` \u533a\u57df\u5747\u88ab\u540c\u6b65\u66f4\u65b0\uff0c\u907f\u514d\u540c\u4e00\u9501\u6587\u4ef6\u5185\u51fa\u73b0\u7248\u672c\u4e0d\u4e00\u81f4\u3002\n- `resolved` \u5730\u5740\u6539\u4e3a\u5185\u90e8 Azure Artifacts \u6e90\u4e0a\u7684 1.1.18 tarball\u3002\n- `integrity` \u503c\u968f\u65b0 tarball \u66f4\u65b0\uff0cnpm \u5b89\u88c5\u65f6\u5c06\u4f7f\u7528\u8be5\u503c\u6821\u9a8c\u4e0b\u8f7d\u5185\u5bb9\u3002\n\n### 2. \u4f9d\u8d56\u56fe\u4e0e\u6784\u5efa\u5143\u6570\u636e\n\n`brace-expansion` \u4ecd\u88ab\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff08`dev: true`\uff09\uff0c\u5176\u76f4\u63a5\u4f9d\u8d56\u4ecd\u662f `balanced-match`\uff08`^1.0.0`\uff09\u548c `concat-map`\uff08`0.0.1`\uff09\u3002\u56e0\u6b64\uff0c\u4ece\u5305\u4e2d\u53ef\u89c1\u7684\u9501\u6587\u4ef6\u5185\u5bb9\u770b\uff0c\u672c\u6b21\u5347\u7ea7\u6ca1\u6709\u6539\u53d8\u4e0b\u6e38\u4f9d\u8d56\u540d\u79f0\u6216\u7248\u672c\u7ea6\u675f\u7ed3\u6784\u3002\n\n\u65b0\u7248\u9501\u8bb0\u5f55\u989d\u5916\u5305\u542b `license: MIT` \u5143\u6570\u636e\u3002\u8fd9\u53ea\u8865\u5145\u5305\u7684\u8bb8\u53ef\u8bc1\u4fe1\u606f\uff0c\u4e0d\u4f1a\u76f4\u63a5\u6539\u53d8\u8fd0\u884c\u65f6\u884c\u4e3a\u3002\n\n### 3. \u5e94\u7528\u4e0e\u6269\u5c55\u4ee3\u7801\n\n\u5206\u6790\u5305\u53ea\u5217\u51fa\u5e76\u63d0\u4f9b\u4e86\u4e00\u4e2a\u9501\u6587\u4ef6\u7684\u53d8\u66f4\uff0c\u6ca1\u6709\u5305\u542b AzNB.Spellchecker \u6e90\u4ee3\u7801\u3001\u6e05\u5355\u3001\u6784\u5efa\u811a\u672c\u6216\u6d4b\u8bd5\u4ee3\u7801\u7684\u4fee\u6539\u3002\u56e0\u6b64\uff0c\u6b64 PR \u7684\u5de5\u4f5c\u65b9\u5f0f\u662f\u901a\u8fc7\u4f9d\u8d56\u89e3\u6790\u7ed3\u679c\u751f\u6548\uff0c\u800c\u4e0d\u662f\u901a\u8fc7\u4fee\u6539\u6269\u5c55\u4e1a\u52a1\u903b\u8f91\u751f\u6548\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u5b89\u5168\u5f71\u54cd\n\n\u4e3b\u8981\u6536\u76ca\u662f\u66ff\u6362\u88ab\u5b89\u5168\u544a\u8b66\u547d\u4e2d\u7684\u65e7\u7248\u4f9d\u8d56\u3002\u7531\u4e8e PR \u63cf\u8ff0\u5c06\u6b64\u6b21\u5347\u7ea7\u4e0e\u4e24\u4e2a\u9ad8\u4e25\u91cd\u7ea7\u522b CVE \u5173\u8054\uff0c\u5408\u5e76\u540e\u91cd\u65b0\u5b89\u88c5\u4f9d\u8d56\u5e94\u4f7f\u7528 1.1.18\uff1b\u4f46\u544a\u8b66\u662f\u5426\u5728\u7ec4\u4ef6\u6cbb\u7406\u7cfb\u7edf\u4e2d\u5b8c\u5168\u5173\u95ed\uff0c\u4ecd\u53d6\u51b3\u4e8e\u626b\u63cf\u5668\u91cd\u65b0\u626b\u63cf\u53ca\u5176\u6f0f\u6d1e\u7248\u672c\u5224\u5b9a\u3002\n\n### \u6784\u5efa\u4e0e\u5f00\u53d1\u5f71\u54cd\n\n\u8be5\u5305\u4ecd\u662f\u5f00\u53d1\u4f9d\u8d56\uff0c\u76f4\u63a5\u5f71\u54cd\u66f4\u53ef\u80fd\u51fa\u73b0\u5728 AzNB.Spellchecker \u7684\u4f9d\u8d56\u5b89\u88c5\u3001\u6253\u5305\u6216\u5f00\u53d1\u5de5\u5177\u94fe\u9636\u6bb5\u3002\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b `brace-expansion` \u7684\u8c03\u7528\u94fe\uff0c\u65e0\u6cd5\u786e\u8ba4\u5b83\u7531\u54ea\u4e2a\u76f4\u63a5\u4f9d\u8d56\u5f15\u5165\uff0c\u4e5f\u65e0\u6cd5\u786e\u8ba4\u6700\u7ec8\u53d1\u5e03\u4ea7\u7269\u662f\u5426\u5305\u542b\u8be5\u5305\u3002\n\n### \u8fd0\u884c\u65f6\u884c\u4e3a\n\n`brace-expansion` \u8d1f\u8d23\u5c55\u5f00\u7c7b\u4f3c\u82b1\u62ec\u53f7\u6a21\u5f0f\u7684\u5b57\u7b26\u4e32\u3002\u8865\u4e01\u7248\u672c\u5347\u7ea7\u53ef\u80fd\u6539\u53d8\u6076\u610f\u3001\u8d85\u957f\u6216\u8fb9\u754c\u8f93\u5165\u7684\u5c55\u5f00\u548c\u62d2\u7edd\u884c\u4e3a\uff0c\u8fd9\u662f\u5b89\u5168\u4fee\u590d\u53ef\u80fd\u5e26\u6765\u7684\u9884\u671f\u5dee\u5f02\u3002\u5bf9\u5e38\u89c4\u8f93\u5165\u7684\u517c\u5bb9\u6027\u98ce\u9669\u76f8\u5bf9\u6709\u9650\uff0c\u4f46\u5206\u6790\u5305\u6ca1\u6709\u4e0a\u6e38\u5b8c\u6574\u53d8\u66f4\u5185\u5bb9\u6216\u672c\u4ed3\u5e93\u8c03\u7528\u6837\u4f8b\uff0c\u4e0d\u80fd\u636e\u6b64\u4fdd\u8bc1\u884c\u4e3a\u5b8c\u5168\u4e00\u81f4\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\n\n| \u98ce\u9669\u6216\u5173\u6ce8\u70b9 | \u5177\u4f53\u8bf4\u660e | \u5efa\u8bae |\n|---|---|---|\n| \u8fb9\u754c\u8f93\u5165\u884c\u4e3a\u53d8\u5316 | \u5b89\u5168\u4fee\u590d\u53ef\u80fd\u9650\u5236\u6216\u4f18\u5316\u590d\u6742\u82b1\u62ec\u53f7\u8868\u8fbe\u5f0f\uff0c\u4f9d\u8d56\u65e7\u7248\u5f02\u5e38\u6216\u6781\u7aef\u5c55\u5f00\u884c\u4e3a\u7684\u5de5\u5177\u53ef\u80fd\u51fa\u73b0\u5dee\u5f02\u3002 | \u8fd0\u884c\u6269\u5c55\u73b0\u6709\u6d4b\u8bd5\uff0c\u5e76\u8986\u76d6\u5d4c\u5957\u82b1\u62ec\u53f7\u3001\u8d85\u957f\u8f93\u5165\u3001\u65e0\u6548\u6a21\u5f0f\u548c\u5927\u91cf\u5c55\u5f00\u7ed3\u679c\u3002 |\n| \u9501\u6587\u4ef6\u4e0e\u58f0\u660e\u6587\u4ef6\u4e00\u81f4\u6027 | PR \u53ea\u4fee\u6539 `package-lock.json`\uff0c\u5206\u6790\u5305\u672a\u663e\u793a `package.json` \u4e2d\u7684\u76f4\u63a5\u58f0\u660e\uff1b\u8fd9\u901a\u5e38\u8868\u793a\u5b83\u662f\u4f20\u9012\u4f9d\u8d56\uff0c\u4f46\u5305\u4e2d\u6ca1\u6709\u8db3\u591f\u4fe1\u606f\u786e\u8ba4\u6765\u6e90\u3002 | \u6267\u884c `npm ci` \u548c `npm ls brace-expansion`\uff0c\u786e\u8ba4\u9501\u6587\u4ef6\u53ef\u91cd\u73b0\u4e14\u4f9d\u8d56\u6765\u6e90\u7b26\u5408\u9884\u671f\u3002 |\n| \u5b8c\u6574\u6027\u7b97\u6cd5\u53d8\u5316 | `integrity` \u4ece SHA-512 \u683c\u5f0f\u53d8\u4e3a SHA-1 \u683c\u5f0f\u3002npm \u4ecd\u53ef\u636e\u6b64\u6821\u9a8c tarball\uff0c\u4f46\u7b97\u6cd5\u5f3a\u5ea6\u964d\u4f4e\uff0c\u4e14\u53ef\u80fd\u89e6\u53d1\u4f9b\u5e94\u94fe\u7b56\u7565\u6216\u5408\u89c4\u68c0\u67e5\u3002 | \u786e\u8ba4\u5185\u90e8 Azure Artifacts \u8fd4\u56de\u7684\u5305\u5143\u6570\u636e\u7b26\u5408\u4ed3\u5e93\u7b56\u7565\uff0c\u5e76\u68c0\u67e5\u5b89\u88c5\u65f6\u662f\u5426\u51fa\u73b0\u5b8c\u6574\u6027\u6216\u7b56\u7565\u544a\u8b66\u3002 |\n| \u5185\u90e8\u6e90\u53ef\u7528\u6027 | \u65b0\u7248\u672c\u4e0b\u8f7d\u5730\u5740\u6307\u5411\u5185\u90e8 Azure Artifacts \u4e2d\u7684 1.1.18 \u5305\u3002 | \u5728\u5b9e\u9645 CI \u8eab\u4efd\u548c\u6e90\u914d\u7f6e\u4e0b\u6267\u884c\u5e72\u51c0\u5b89\u88c5\uff0c\u786e\u8ba4\u8be5\u7248\u672c\u53ef\u8bbf\u95ee\u3002 |\n| \u95f4\u63a5\u4f9d\u8d56\u517c\u5bb9\u6027 | \u867d\u7136\u4ecd\u5728 1.x \u7cfb\u5217\u4e14\u4f9d\u8d56\u7ea6\u675f\u672a\u53d8\u5316\uff0c\u4f46 1.1.11 \u5230 1.1.18 \u8de8\u8d8a\u591a\u4e2a\u8865\u4e01\u7248\u672c\u3002 | \u8fd0\u884c AzNB.Spellchecker \u7684\u6784\u5efa\u3001\u6253\u5305\u53ca\u5173\u952e\u529f\u80fd\u6d4b\u8bd5\uff0c\u800c\u4e0d\u53ea\u9a8c\u8bc1\u5b89\u88c5\u6210\u529f\u3002 |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae\n\n\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u6d4b\u8bd5\u7ed3\u679c\u3001\u6d41\u6c34\u7ebf\u72b6\u6001\u3001\u6d4b\u8bd5\u6587\u4ef6\u6539\u52a8\u6216\u6784\u5efa\u65e5\u5fd7\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u8be5\u5347\u7ea7\u5df2\u7ecf\u901a\u8fc7\u4ed3\u5e93\u6d4b\u8bd5\u3002\u5efa\u8bae\u81f3\u5c11\u6267\u884c\uff1a\n\n1. \u5728 `sample/extensions/common-extensions/AzNB.Spellchecker` \u4e2d\u8fdb\u884c\u5e72\u51c0\u7684 `npm ci`\uff0c\u9a8c\u8bc1\u9501\u6587\u4ef6\u3001\u5185\u90e8\u6e90\u548c\u5b8c\u6574\u6027\u6821\u9a8c\u3002\n2. \u6267\u884c\u8be5\u6269\u5c55\u5df2\u6709\u7684\u5355\u5143\u6d4b\u8bd5\u3001\u6784\u5efa\u548c\u6253\u5305\u6d41\u7a0b\u3002\n3. \u4f7f\u7528 `npm ls brace-expansion` \u786e\u8ba4\u5b9e\u9645\u5b89\u88c5\u7248\u672c\u4e3a 1.1.18\uff0c\u4e14\u4e0d\u5b58\u5728\u610f\u5916\u7684 1.1.11 \u526f\u672c\u3002\n4. \u8fd0\u884c\u4f9d\u8d56\u6216\u7ec4\u4ef6\u6cbb\u7406\u626b\u63cf\uff0c\u786e\u8ba4 CVE-2026-13149 \u548c CVE-2026-14257 \u544a\u8b66\u6309\u9884\u671f\u6d88\u9664\u3002\n5. \u5982\u679c\u6269\u5c55\u4f1a\u5904\u7406 glob \u6216\u82b1\u62ec\u53f7\u6a21\u5f0f\uff0c\u589e\u52a0\u6b63\u5e38\u3001\u5d4c\u5957\u3001\u8d85\u957f\u548c\u6076\u610f\u8f93\u5165\u7684\u56de\u5f52\u9a8c\u8bc1\u3002\n\n## Diff \u8986\u76d6\u8303\u56f4\n\n\u5206\u6790\u5305\u58f0\u660e\uff1a\n\n- `diffTruncated: false`\n- \u6587\u4ef6\u7ea7 `truncated: false`\n- 1 \u4e2a\u53d8\u66f4\u6587\u4ef6\uff0c\u4e14\u8be5\u6587\u4ef6\u7684 diff \u5df2\u5305\u542b\u5728\u5305\u4e2d\n- \u603b diff \u5927\u5c0f\u4e3a 1,845 \u5b57\u8282\uff0c\u4f4e\u4e8e\u5bfc\u51fa\u5668\u8bb0\u5f55\u7684\u603b\u91cf\u548c\u5355\u6587\u4ef6\u4e0a\u9650\n- `errors` \u4e0e `warnings` \u5747\u4e3a\u7a7a\n\n\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u4e2d\u5217\u51fa\u7684\u5168\u90e8\u6587\u4ef6\u53d8\u66f4\uff0c\u672a\u53d1\u73b0\u88ab\u622a\u65ad\u7684 diff\u3002\u9700\u8981\u6ce8\u610f\u7684\u662f\uff0c\u8fd9\u53ea\u8868\u793a\u6240\u5bfc\u51fa\u7684 diff \u5b8c\u6574\uff1b\u5305\u672c\u8eab\u672a\u5305\u542b\u4e0a\u6e38 `brace-expansion` 1.1.12 \u81f3 1.1.18 \u7684\u5b8c\u6574\u6e90\u7801\u5dee\u5f02\u3001CI \u65e5\u5fd7\u3001\u6d4b\u8bd5\u7ed3\u679c\u6216\u4f9d\u8d56\u8c03\u7528\u94fe\uff0c\u6240\u4ee5\u672c\u6587\u6ca1\u6709\u5bf9\u8fd9\u4e9b\u7f3a\u5931\u5185\u5bb9\u4f5c\u51fa\u5df2\u5206\u6790\u6216\u5df2\u9a8c\u8bc1\u7684\u58f0\u660e\u3002\n", "creation_timestamp": "2026-08-31T00:09:16.725120Z"}, {"uuid": "3778f69d-30a0-4085-8685-4d12438f4b19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/djlan/486464681c8a0506b1cdee342a0492a4", "content": "# [SECURITY] \u5c06 `/sample/extension-sample` \u4e2d\u7684 `brace-expansion` \u4ece 1.1.11 \u5347\u7ea7\u5230 1.1.18\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0\u6269\u5c55\u793a\u4f8b\u9879\u76ee\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u5f00\u53d1\u4f9d\u8d56 `brace-expansion` \u56fa\u5b9a\u5230 1.1.18\uff0c\u4ee5\u5904\u7406 Component Governance \u62a5\u544a\u7684\u4e24\u4e2a\u9ad8\u5371\u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u4fdd\u6301\u5176\u4e0b\u6e38\u4f9d\u8d56\u5173\u7cfb\u4e0d\u53d8\u3002\n\n- **PR\uff1a** [AzureNotebooks PR 772989](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/772989)\n- **\u4f5c\u8005\uff1a** Dependabot\n- **\u72b6\u6001\uff1a** Active\uff1b\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001\u4e3a `succeeded`\n- **\u5206\u652f\uff1a** `dependabot/npm_and_yarn/sample%2Fextension-sample/brace-expansion-1.1.18-753877` \u2192 `main`\n- **\u521b\u5efa\u65f6\u95f4\uff1a** 2026-08-22 09:43:47\n- **\u53d8\u66f4\u7edf\u8ba1\uff1a** 1 \u4e2a\u63d0\u4ea4\u30011 \u4e2a\u8fed\u4ee3\u30011 \u4e2a\u6587\u4ef6\uff1b\u53ef\u89c1 diff \u5171 1,707 \u5b57\u8282\n- **\u5b89\u5168\u80cc\u666f\uff1a** PR \u63cf\u8ff0\u5173\u8054\u4e24\u4e2a High \u7ea7 Component Governance \u544a\u8b66\uff1aCVE-2026-13149 \u548c CVE-2026-14257\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u60c5\u51b5](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u60c5\u51b5)\n6. [Diff \u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c](#diff-\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u672c\u6b21\u6539\u52a8\u7531 Dependabot \u81ea\u52a8\u751f\u6210\uff0c\u8303\u56f4\u9650\u5b9a\u5728\u6269\u5c55\u793a\u4f8b\u9879\u76ee\u7684 [`sample/extension-sample/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/772989?path=/sample/extension-sample/package-lock.json&_a=files)\u3002\u9501\u6587\u4ef6\u4e2d `brace-expansion` \u7684\u4e24\u4e2a\u5bf9\u5e94\u8bb0\u5f55\u5747\u4ece 1.1.11 \u66f4\u65b0\u5230 1.1.18\uff0c\u5e76\u540c\u6b65\u66f4\u65b0\u5185\u90e8 npm \u6e90\u7684\u5f52\u6863\u5730\u5740\u4e0e\u5b8c\u6574\u6027\u6458\u8981\u3002\n\n\u8be5 PR \u6ca1\u6709\u4fee\u6539\u4e1a\u52a1\u6e90\u4ee3\u7801\uff0c\u4e5f\u6ca1\u6709\u4fee\u6539\u5305\u6e05\u5355\u4e2d\u58f0\u660e\u4f9d\u8d56\u7684\u65b9\u5f0f\u3002\u5176\u4f5c\u7528\u662f\u5728\u540e\u7eed\u6309\u9501\u6587\u4ef6\u5b89\u88c5\u4f9d\u8d56\u65f6\uff0c\u8ba9\u6269\u5c55\u793a\u4f8b\u7684\u4f9d\u8d56\u6811\u53d6\u5f97\u5df2\u5347\u7ea7\u7684 `brace-expansion` \u7248\u672c\uff0c\u4ece\u800c\u5f15\u5165 1.x \u5206\u652f\u540e\u7eed\u7248\u672c\u4e2d\u7684\u5b89\u5168\u4fee\u590d\u3002PR \u63cf\u8ff0\u660e\u786e\u6307\u51fa\u6b64\u5347\u7ea7\u7528\u4e8e\u5904\u7406\u4e24\u4e2a\u9ad8\u5371 CG \u544a\u8b66\uff1b\u5305\u5185\u53d1\u5e03\u8bf4\u660e\u8fd8\u63d0\u5230 1.1.12 \u4fee\u590d\u4e86\u6f5c\u5728 ReDoS/\u4f4e\u6548\u6b63\u5219\u8868\u8fbe\u5f0f\u95ee\u9898\uff0c\u4f46\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u4e24\u4e2a CVE \u4e0e\u5177\u4f53\u4e0a\u6e38\u63d0\u4ea4\u4e4b\u95f4\u7684\u5b8c\u6574\u6620\u5c04\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u6bcf\u4e2a CVE \u5206\u522b\u7531\u54ea\u4e00\u9879\u4ee3\u7801\u4fee\u590d\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u4f9d\u8d56\u89e3\u6790\u4e0e\u5b89\u5168\u5347\u7ea7\n\n\u6587\u4ef6\uff1a[`sample/extension-sample/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/772989?path=/sample/extension-sample/package-lock.json&_a=files)\n\n- `brace-expansion` \u7684\u9501\u5b9a\u7248\u672c\u7531 `1.1.11` \u63d0\u5347\u5230 `1.1.18`\u3002\n- \u4e0b\u8f7d\u5730\u5740\u4ecd\u6307\u5411 Azure Notebooks \u7684\u5185\u90e8 npm Registry\uff0c\u4f46\u5f52\u6863\u6587\u4ef6\u5207\u6362\u4e3a `brace-expansion-1.1.18.tgz`\u3002\n- \u5b8c\u6574\u6027\u6458\u8981\u968f\u5f52\u6863\u5185\u5bb9\u66f4\u65b0\uff0c\u786e\u4fdd\u5305\u7ba1\u7406\u5668\u6821\u9a8c\u7684\u662f\u65b0\u7248\u672c\u5236\u54c1\u3002\n- \u8be5\u4f9d\u8d56\u7ee7\u7eed\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u56e0\u6b64\u76f4\u63a5\u5f71\u54cd\u7684\u662f\u5f00\u53d1\u3001\u6784\u5efa\u6216\u5de5\u5177\u94fe\u4f9d\u8d56\u5b89\u88c5\uff0c\u800c\u4e0d\u662f\u4ece\u6b64\u9501\u6587\u4ef6\u4fe1\u606f\u5373\u53ef\u786e\u8ba4\u7684\u751f\u4ea7\u8fd0\u884c\u65f6\u4ee3\u7801\u3002\n\n**\u4e3a\u4ec0\u4e48\u6709\u6548\uff1a** npm \u4f7f\u7528\u9501\u6587\u4ef6\u786e\u5b9a\u5b9e\u9645\u5b89\u88c5\u7248\u672c\u548c\u5236\u54c1\u5730\u5740\u3002\u7248\u672c\u3001\u4e0b\u8f7d\u5730\u5740\u53ca\u5b8c\u6574\u6027\u6458\u8981\u88ab\u4e00\u8d77\u66f4\u65b0\u540e\uff0c\u57fa\u4e8e\u8be5\u9501\u6587\u4ef6\u7684\u786e\u5b9a\u6027\u5b89\u88c5\u4f1a\u89e3\u6790\u5230 1.1.18\uff0c\u800c\u4e0d\u518d\u590d\u7528\u5b58\u5728\u5b89\u5168\u544a\u8b66\u7684 1.1.11\u3002\n\n### 2. \u9501\u6587\u4ef6\u5185\u90e8\u4e00\u81f4\u6027\n\n\u6587\u4ef6\uff1a[`sample/extension-sample/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/772989?path=/sample/extension-sample/package-lock.json&_a=files)\n\n\u9501\u6587\u4ef6\u4e2d\u9762\u5411 `node_modules/brace-expansion` \u7684\u5305\u8bb0\u5f55\u548c\u4f9d\u8d56\u6620\u5c04\u4e2d\u7684 `brace-expansion` \u8bb0\u5f55\u90fd\u88ab\u540c\u6b65\u66f4\u65b0\u3002\u4e24\u5904\u7248\u672c\u3001\u5236\u54c1\u5730\u5740\u548c\u5b8c\u6574\u6027\u6458\u8981\u4fdd\u6301\u4e00\u81f4\uff0c\u907f\u514d npm \u4ece\u9501\u6587\u4ef6\u7684\u4e0d\u540c\u533a\u6bb5\u8bfb\u53d6\u5230\u51b2\u7a81\u7684\u7248\u672c\u4fe1\u606f\u3002\n\n`node_modules` \u5305\u8bb0\u5f55\u65b0\u589e\u4e86 `MIT` \u8bb8\u53ef\u8bc1\u5143\u6570\u636e\u3002\u8fd9\u5c5e\u4e8e\u65b0\u7248\u672c\u9501\u6587\u4ef6\u5143\u6570\u636e\u7684\u8865\u5145\uff0c\u4e0d\u6539\u53d8\u5b89\u88c5\u903b\u8f91\uff0c\u4f46\u6709\u52a9\u4e8e\u4f9d\u8d56\u6cbb\u7406\u5de5\u5177\u8bc6\u522b\u8bb8\u53ef\u8bc1\u3002\n\n### 3. \u4e0b\u6e38\u4f9d\u8d56\u5173\u7cfb\u4fdd\u6301\n\n\u6587\u4ef6\uff1a[`sample/extension-sample/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/772989?path=/sample/extension-sample/package-lock.json&_a=files)\n\n\u53ef\u89c1\u53d8\u66f4\u4e2d\uff0c`brace-expansion` \u4ecd\u4f9d\u8d56\uff1a\n\n- `balanced-match`\uff1a`^1.0.0`\n- `concat-map`\uff1a`0.0.1`\n\n\u56e0\u6b64\uff0c\u8fd9\u6b21\u66f4\u65b0\u6ca1\u6709\u5728\u5305\u5185\u53ef\u89c1\u4f9d\u8d56\u5173\u7cfb\u4e0a\u5f15\u5165\u65b0\u7684\u4e0b\u6e38\u5305\uff0c\u4e5f\u6ca1\u6709\u6539\u53d8\u73b0\u6709\u7248\u672c\u7ea6\u675f\u3002\u4e3b\u8981\u884c\u4e3a\u53d8\u5316\u6765\u81ea `brace-expansion` \u81ea\u8eab\u4ece 1.1.11 \u5230 1.1.18 \u7684\u5b9e\u73b0\u66f4\u65b0\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u5b89\u5168\u5f71\u54cd\n\n\u8be5\u5347\u7ea7\u7684\u76f4\u63a5\u76ee\u6807\u662f\u6d88\u9664\u65e7\u7248 `brace-expansion` \u5bf9\u5e94\u7684\u4e24\u4e2a\u9ad8\u5371 Component Governance \u544a\u8b66\u3002\u7531\u4e8e\u5b83\u662f\u4f9d\u8d56\u6811\u4e2d\u7684\u5f00\u53d1\u4f9d\u8d56\uff0c\u4e3b\u8981\u964d\u4f4e\u6269\u5c55\u793a\u4f8b\u7684\u4f9d\u8d56\u5b89\u88c5\u3001\u6784\u5efa\u548c\u5f00\u53d1\u5de5\u5177\u5904\u7406\u6076\u610f\u6216\u5f02\u5e38\u82b1\u62ec\u53f7\u8868\u8fbe\u5f0f\u65f6\u7684\u98ce\u9669\u3002\n\n### \u529f\u80fd\u5f71\u54cd\n\n\u4ed3\u5e93\u4e1a\u52a1\u4ee3\u7801\u6ca1\u6709\u53d8\u5316\u3002\u53ef\u80fd\u53d7\u5230\u5f71\u54cd\u7684\u662f\u4efb\u4f55\u95f4\u63a5\u8c03\u7528 `brace-expansion` \u7684\u5f00\u53d1\u5de5\u5177\u6216\u6784\u5efa\u6b65\u9aa4\uff0c\u5c24\u5176\u662f\u4f9d\u8d56 glob\u3001\u8def\u5f84\u5c55\u5f00\u6216\u6a21\u5f0f\u5339\u914d\u7684\u6d41\u7a0b\u3002\u5347\u7ea7\u4ecd\u4f4d\u4e8e 1.x \u7248\u672c\u7ebf\uff0c\u4e14\u53ef\u89c1\u7684\u4e0b\u6e38\u4f9d\u8d56\u672a\u53d8\u5316\uff0c\u9884\u8ba1\u517c\u5bb9\u6027\u98ce\u9669\u4f4e\u4e8e\u8de8\u4e3b\u7248\u672c\u5347\u7ea7\uff0c\u4f46\u4e0d\u80fd\u4ec5\u51ed\u9501\u6587\u4ef6\u8bc1\u660e\u884c\u4e3a\u5b8c\u5168\u7b49\u4ef7\u3002\n\n### \u6784\u5efa\u4e0e\u53d1\u5e03\u5f71\u54cd\n\n\u5b89\u88c5\u4f9d\u8d56\u65f6\u4f1a\u4ece\u73b0\u6709\u5185\u90e8\u6e90\u4e0b\u8f7d\u65b0\u7684 1.1.18 \u5236\u54c1\u3002\u82e5\u5185\u90e8\u6e90\u53ef\u7528\u4e14\u5236\u54c1\u4e0e\u9501\u6587\u4ef6\u6458\u8981\u5339\u914d\uff0c\u6784\u5efa\u6d41\u7a0b\u65e0\u9700\u989d\u5916\u914d\u7f6e\uff1b\u82e5\u5185\u90e8\u6e90\u5c1a\u672a\u540c\u6b65\u8be5\u5236\u54c1\u6216\u5176\u6458\u8981\u4e0d\u4e00\u81f4\uff0c\u5b89\u88c5\u4f1a\u5931\u8d25\u3002\n\n### \u8303\u56f4\u5f71\u54cd\n\n\u53d8\u66f4\u4ec5\u4f4d\u4e8e `sample/extension-sample`\uff0c\u5206\u6790\u5305\u672a\u663e\u793a\u5176\u4ed6\u793a\u4f8b\u3001\u670d\u52a1\u3001\u5e94\u7528\u6216\u5171\u4eab\u4f9d\u8d56\u9501\u6587\u4ef6\u88ab\u66f4\u65b0\u3002\u56e0\u6b64\u4e0d\u80fd\u8ba4\u4e3a\u4ed3\u5e93\u4e2d\u5176\u4ed6\u4f4d\u7f6e\u4f7f\u7528\u7684 `brace-expansion` \u4e5f\u5df2\u88ab\u4fee\u590d\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n| \u98ce\u9669/\u5173\u6ce8\u70b9 | \u5177\u4f53\u8bf4\u660e | \u5efa\u8bae |\n|---|---|---|\n| \u95f4\u63a5\u5de5\u5177\u884c\u4e3a\u53d8\u5316 | 1.1.18 \u5305\u542b 1.1.11 \u4e4b\u540e\u7684\u591a\u6b21\u4fee\u590d\uff1b\u8fb9\u754c\u8f93\u5165\u3001\u8d85\u957f\u8868\u8fbe\u5f0f\u6216\u5f02\u5e38\u82b1\u62ec\u53f7\u6a21\u5f0f\u7684\u5c55\u5f00\u7ed3\u679c\u4e0e\u6027\u80fd\u53ef\u80fd\u53d8\u5316\u3002 | \u8fd0\u884c\u6269\u5c55\u793a\u4f8b\u73b0\u6709\u7684\u5b89\u88c5\u3001\u6784\u5efa\u53ca\u6d4b\u8bd5\u6d41\u7a0b\uff0c\u5e76\u91cd\u70b9\u8986\u76d6\u4f7f\u7528 glob/\u6a21\u5f0f\u5c55\u5f00\u7684\u4efb\u52a1\u3002 |\n| \u5b8c\u6574\u6027\u7b97\u6cd5\u53d8\u5316 | \u9501\u6587\u4ef6\u4e2d\u7684\u6458\u8981\u4ece `sha512-...` \u53d8\u4e3a `sha1-...`\u3002\u8fd9\u53ef\u80fd\u662f\u5185\u90e8 Registry \u8fd4\u56de\u7684\u5143\u6570\u636e\u6240\u81f4\uff0c\u4f46\u6821\u9a8c\u5f3a\u5ea6\u4f4e\u4e8e SHA-512\uff0c\u503c\u5f97\u786e\u8ba4\u662f\u5426\u7b26\u5408\u5f53\u524d\u5236\u54c1\u6e90\u4e0e\u4f9b\u5e94\u94fe\u7b56\u7565\u3002 | \u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 npm \u7248\u672c\u91cd\u65b0\u6267\u884c\u9501\u5b9a\u5b89\u88c5\uff0c\u786e\u8ba4\u4e0d\u4f1a\u91cd\u5199\u8be5\u5b57\u6bb5\uff0c\u5e76\u786e\u8ba4\u5185\u90e8\u6e90\u8ba4\u53ef\u8be5\u6458\u8981\u3002 |\n| \u5185\u90e8\u6e90\u53ef\u7528\u6027 | \u65b0\u7248\u672c\u5f52\u6863\u5730\u5740\u4f4d\u4e8e\u5185\u90e8 Azure DevOps npm Registry\uff1b\u7f3a\u5305\u3001\u6743\u9650\u6216\u955c\u50cf\u540c\u6b65\u95ee\u9898\u4f1a\u5bfc\u81f4\u4f9d\u8d56\u5b89\u88c5\u5931\u8d25\u3002 | \u5728\u4e0e CI \u76f8\u540c\u7684\u6e90\u914d\u7f6e\u4e0b\u6267\u884c\u5e72\u51c0\u5b89\u88c5\u3002 |\n| \u9501\u6587\u4ef6\u4e0e\u6e05\u5355\u4e00\u81f4\u6027 | \u5206\u6790\u5305\u53ea\u5c55\u793a\u4e86\u9501\u6587\u4ef6\u53d8\u66f4\uff0c\u6ca1\u6709\u5c55\u793a `package.json` \u4e2d\u4f9d\u8d56\u6765\u6e90\u6216\u7248\u672c\u8303\u56f4\uff1b\u65e0\u6cd5\u4ece\u5305\u5185\u5185\u5bb9\u786e\u8ba4\u4e3a\u4ec0\u4e48\u91cd\u65b0\u89e3\u6790\u540e\u9009\u62e9 1.1.18\uff0c\u4ee5\u53ca\u6e05\u5355\u662f\u5426\u5141\u8bb8\u8be5\u7248\u672c\u3002 | \u901a\u8fc7\u6807\u51c6\u5305\u7ba1\u7406\u547d\u4ee4\u9a8c\u8bc1\u9501\u6587\u4ef6\u4e0e\u6e05\u5355\u4e00\u81f4\uff0c\u786e\u4fdd\u4e0d\u4f1a\u51fa\u73b0 \u201clockfile out of date\u201d \u6216\u989d\u5916\u91cd\u5199\u3002 |\n| \u4fee\u590d\u8303\u56f4\u6709\u9650 | \u53ea\u66f4\u65b0\u6269\u5c55\u793a\u4f8b\u76ee\u5f55\u4e2d\u7684\u4e00\u4e2a\u9501\u6587\u4ef6\uff1b\u4ed3\u5e93\u5176\u4ed6\u4f9d\u8d56\u6811\u662f\u5426\u4ecd\u5305\u542b 1.1.11 \u4e0d\u5728\u672c\u5305\u8986\u76d6\u8303\u56f4\u5185\u3002 | \u4f9d\u8d56\u6cbb\u7406\u7ed3\u679c\u5e94\u6309\u4ed3\u5e93\u5176\u4ed6\u6e05\u5355\u548c\u9501\u6587\u4ef6\u5206\u522b\u786e\u8ba4\u3002 |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u60c5\u51b5\n\n\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u65b0\u589e\u6216\u4fee\u6539\u7684\u6d4b\u8bd5\u6587\u4ef6\uff0c\u4e5f\u6ca1\u6709\u63d0\u4f9b CI\u3001\u6784\u5efa\u3001npm \u5b89\u88c5\u6216\u6d4b\u8bd5\u8fd0\u884c\u7ed3\u679c\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u4e0d\u80fd\u58f0\u79f0\u8be5\u5347\u7ea7\u5df2\u7ecf\u901a\u8fc7\u81ea\u52a8\u5316\u9a8c\u8bc1\u3002\n\n\u5efa\u8bae\u81f3\u5c11\u9a8c\u8bc1\uff1a\n\n1. \u5728 `sample/extension-sample` \u4e2d\u6267\u884c\u9879\u76ee\u65e2\u6709\u7684\u5e72\u51c0\u4f9d\u8d56\u5b89\u88c5\u6d41\u7a0b\uff0c\u786e\u8ba4\u9501\u6587\u4ef6\u53ef\u88ab\u5f53\u524d npm \u7248\u672c\u63a5\u53d7\u4e14\u5185\u90e8\u5236\u54c1\u53ef\u4e0b\u8f7d\u3002\n2. \u6267\u884c\u8be5\u793a\u4f8b\u9879\u76ee\u5df2\u6709\u7684\u6784\u5efa\u3001\u9759\u6001\u68c0\u67e5\u548c\u6d4b\u8bd5\u547d\u4ee4\u3002\n3. \u82e5\u5de5\u5177\u94fe\u5305\u542b glob \u6216\u82b1\u62ec\u53f7\u5c55\u5f00\u573a\u666f\uff0c\u9a8c\u8bc1\u5e38\u89c4\u6a21\u5f0f\u3001\u5d4c\u5957\u6a21\u5f0f\u3001\u5f02\u5e38\u8f93\u5165\u548c\u8d85\u957f\u8f93\u5165\u3002\n4. \u91cd\u65b0\u8fd0\u884c Component Governance \u626b\u63cf\uff0c\u786e\u8ba4\u4e24\u4e2a\u76ee\u6807\u544a\u8b66\u5df2\u89e3\u9664\u4e14\u6ca1\u6709\u5f15\u5165\u65b0\u7684\u4f9d\u8d56\u6216\u8bb8\u53ef\u8bc1\u544a\u8b66\u3002\n\n## Diff \u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c\n\n- \u5305\u4e2d\u5217\u51fa\u7684\u53d8\u66f4\u6587\u4ef6\u6570\u4e3a 1\uff0c\u4e14\u8be5\u6587\u4ef6\u5b58\u5728\u5bf9\u5e94 diff\u3002\n- \u5168\u5c40 `diffTruncated` \u4e3a `false`\uff0c\u6587\u4ef6\u7ea7 `truncated` \u4e5f\u4e3a `false`\uff1b\u56e0\u6b64\u5206\u6790\u5305\u6ca1\u6709\u62a5\u544a diff \u622a\u65ad\u3002\n- \u5305\u4e2d\u6ca1\u6709\u5bfc\u51fa\u9519\u8bef\u6216\u8b66\u544a\u3002\n- \u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u5185\u63d0\u4f9b\u7684\u5168\u90e8\u6587\u4ef6\u53d8\u66f4\uff0c\u4f46\u53ea\u4f9d\u636e\u5206\u6790\u5305\u4e2d\u7684 PR \u5143\u6570\u636e\u3001\u63d0\u4ea4\u4fe1\u606f\u548c diff\u3002\u672a\u63d0\u4f9b\u7684\u6e90\u4ee3\u7801\u3001\u6d41\u6c34\u7ebf\u65e5\u5fd7\u3001\u6d4b\u8bd5\u7ed3\u679c\u3001\u5b8c\u6574\u4f9d\u8d56\u6811\u3001\u544a\u8b66\u8be6\u60c5\u53ca\u4e0a\u6e38\u5305\u5b9e\u73b0\u5747\u672a\u88ab\u5206\u6790\uff0c\u4e5f\u672a\u636e\u6b64\u4f5c\u51fa\u7ed3\u8bba\u3002\n", "creation_timestamp": "2026-08-30T15:22:55.074341Z"}, {"uuid": "dc966bb5-649b-42ae-82ed-1d9b4d2ef228", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/djlan/fbf12d789709a447446f2a22849a57e3", "content": "# [SECURITY] \u5c06 MetadataViewer \u7684 brace-expansion \u4ece 1.1.11 \u5347\u7ea7\u5230 1.1.18\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 MetadataViewer \u793a\u4f8b\u6269\u5c55\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u5f00\u53d1\u4f9d\u8d56\u6811\u4e2d\u7684 `brace-expansion` \u56fa\u5b9a\u7248\u672c\u4ece 1.1.11 \u63d0\u5347\u5230 1.1.18\uff0c\u4ee5\u54cd\u5e94\u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027 Component Governance \u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u4fdd\u6301\u5176\u4f9d\u8d56\u5173\u7cfb\u4e0d\u53d8\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [772988](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/772988) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | Active\uff0c\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001\u4e3a Succeeded |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fextensions%2Fcommon-extensions%2FMetadataViewer/brace-expansion-1.1.18-753871` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-08-22 09:43:44\uff08\u5206\u6790\u5305\u672a\u6ce8\u660e\u65f6\u533a\uff09 |\n| \u53d8\u66f4\u7edf\u8ba1 | 1 \u4e2a\u63d0\u4ea4\u30011 \u4e2a\u6587\u4ef6\u30012 \u5904\u9501\u6587\u4ef6\u8bb0\u5f55\u66f4\u65b0\uff1b\u6309\u53ef\u89c1\u5dee\u5f02\u8ba1 6 \u884c\u65b0\u589e\u30016 \u884c\u5220\u9664 |\n| \u5b89\u5168\u80cc\u666f | PR \u63cf\u8ff0\u5217\u51fa\u4e24\u4e2a High \u544a\u8b66\uff1aCVE-2026-13149\u3001CVE-2026-14257 |\n\n## \u76ee\u5f55\n\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n  - [\u4f9d\u8d56\u9501\u5b9a\u4e0e\u4f9b\u5e94\u94fe\u5143\u6570\u636e](#\u4f9d\u8d56\u9501\u5b9a\u4e0e\u4f9b\u5e94\u94fe\u5143\u6570\u636e)\n  - [\u5b89\u5168\u4fee\u590d\u76ee\u6807](#\u5b89\u5168\u4fee\u590d\u76ee\u6807)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n- [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n- [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae)\n- [\u5206\u6790\u8986\u76d6\u8303\u56f4](#\u5206\u6790\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5\u53d8\u66f4\u7531 Dependabot \u81ea\u52a8\u751f\u6210\uff0c\u76ee\u6807\u662f\u5347\u7ea7 `sample/extensions/common-extensions/MetadataViewer` \u7684\u4f20\u9012\u6027\u5f00\u53d1\u4f9d\u8d56 `brace-expansion`\u3002PR \u6ca1\u6709\u4fee\u6539 `package.json`\u3001\u4e1a\u52a1\u6e90\u7801\u6216\u8fd0\u884c\u65f6\u914d\u7f6e\uff0c\u800c\u662f\u5728 [`sample/extensions/common-extensions/MetadataViewer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/772988?path=/sample/extensions/common-extensions/MetadataViewer/package-lock.json&_a=files) \u4e2d\u540c\u6b65\u66f4\u65b0\u540c\u4e00\u5305\u7684\u4e24\u4efd\u9501\u5b9a\u8bb0\u5f55\uff1a\n\n1. npm \u8f83\u65b0\u9501\u6587\u4ef6\u7ed3\u6784\u4e2d\u7684 `node_modules/brace-expansion` \u6761\u76ee\u3002\n2. \u517c\u5bb9\u65e7\u5f0f\u4f9d\u8d56\u6811\u8868\u793a\u7684\u9876\u5c42 `brace-expansion` \u6761\u76ee\u3002\n\n\u4e24\u5904\u8bb0\u5f55\u90fd\u4ece 1.1.11 \u6307\u5411 1.1.18\uff0c\u5e76\u76f8\u5e94\u66ff\u6362\u5185\u90e8 Azure Artifacts \u5305\u5730\u5740\u548c\u5b8c\u6574\u6027\u6821\u9a8c\u503c\u3002`balanced-match` \u4f9d\u8d56\u7ea6\u675f\u4ecd\u4e3a `^1.0.0`\uff0c\u4e14\u8be5\u5305\u7ee7\u7eed\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u56e0\u6b64\u672c PR \u6ca1\u6709\u4ece\u53ef\u89c1\u5dee\u5f02\u4e2d\u5f15\u5165\u65b0\u7684\u76f4\u63a5\u4f9d\u8d56\u6216\u6539\u53d8\u751f\u4ea7\u4f9d\u8d56\u5206\u7c7b\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### \u4f9d\u8d56\u9501\u5b9a\u4e0e\u4f9b\u5e94\u94fe\u5143\u6570\u636e\n\n**\u4e3a\u4ec0\u4e48\u8981\u540c\u65f6\u4fee\u6539\u4e24\u5904\uff1a** \u5f53\u524d\u9501\u6587\u4ef6\u5305\u542b\u4e24\u79cd\u4f9d\u8d56\u8868\u793a\u3002\u82e5\u53ea\u66f4\u65b0\u5176\u4e2d\u4e00\u5904\uff0cnpm \u5728\u4e0d\u540c\u5b89\u88c5\u8def\u5f84\u6216\u9501\u6587\u4ef6\u89e3\u6790\u903b\u8f91\u4e0b\u53ef\u80fd\u770b\u5230\u4e0d\u4e00\u81f4\u7684\u7248\u672c\u4fe1\u606f\u3002Dependabot \u5c06\u7248\u672c\u3001\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u503c\u6210\u7ec4\u66f4\u65b0\uff0c\u4f7f\u5b89\u88c5\u8fc7\u7a0b\u7a33\u5b9a\u89e3\u6790\u5230\u5185\u90e8\u6e90\u4e2d\u7684\u540c\u4e00\u4e2a 1.1.18 \u5305\u3002\n\n**\u53d8\u66f4\u5982\u4f55\u751f\u6548\uff1a**\n\n- \u540e\u7eed\u6267\u884c\u57fa\u4e8e\u9501\u6587\u4ef6\u7684\u5b89\u88c5\uff08\u4f8b\u5982 `npm ci`\uff09\u65f6\uff0c\u4f1a\u4ece `AzureNotebooksEntry` \u5185\u90e8 npm \u6ce8\u518c\u8868\u83b7\u53d6 `brace-expansion` 1.1.18\uff0c\u800c\u4e0d\u662f 1.1.11\u3002\n- \u66f4\u65b0\u540e\u7684\u5b8c\u6574\u6027\u503c\u7528\u4e8e\u6838\u5bf9\u4e0b\u8f7d\u5185\u5bb9\u662f\u5426\u4e0e\u9501\u6587\u4ef6\u8bb0\u5f55\u4e00\u81f4\u3002\n- \u7531\u4e8e\u4f9d\u8d56\u5b50\u9879\u548c\u5f00\u53d1\u4f9d\u8d56\u6807\u8bb0\u672a\u53d8\uff0c\u6b64\u6b21\u5347\u7ea7\u4e3b\u8981\u66ff\u6362\u65e2\u6709\u4f9d\u8d56\u8282\u70b9\u7684\u5177\u4f53\u5236\u54c1\u7248\u672c\uff0c\u4e0d\u91cd\u5851\u4f9d\u8d56\u6811\u3002\n\n\u76f8\u5173\u6587\u4ef6\uff1a[`sample/extensions/common-extensions/MetadataViewer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/772988?path=/sample/extensions/common-extensions/MetadataViewer/package-lock.json&_a=files)\n\n### \u5b89\u5168\u4fee\u590d\u76ee\u6807\n\nPR \u63cf\u8ff0\u660e\u786e\u5c06\u6b64\u6b21\u5347\u7ea7\u5173\u8054\u5230 CVE-2026-13149 \u548c CVE-2026-14257 \u4e24\u4e2a\u9ad8\u4e25\u91cd\u6027 CG \u544a\u8b66\u3002\u53ef\u89c1\u7684\u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u8fd8\u63d0\u5230 1.1.12 \u4fee\u590d\u4e86\u6f5c\u5728 ReDoS\uff0f\u4f4e\u6548\u6b63\u5219\u8868\u8fbe\u5f0f\u95ee\u9898\uff0c\u56e0\u6b64\u4ece 1.1.11 \u8de8\u8d8a\u5230 1.1.18 \u4f1a\u5305\u542b\u8be5\u4fee\u590d\u53ca\u540e\u7eed 1.x \u8865\u4e01\u3002\n\n\u4e0d\u8fc7\uff0c\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u4e24\u4e2a CVE \u7684\u6f0f\u6d1e\u7ec6\u8282\u3001\u53d7\u5f71\u54cd\u7248\u672c\u8303\u56f4\u6216 1.1.18 \u5bf9\u6bcf\u4e2a CVE \u7684\u9010\u9879\u4fee\u590d\u6620\u5c04\u3002\u56e0\u6b64\u53ef\u4ee5\u786e\u8ba4\u6b64 PR \u7684\u610f\u56fe\u662f\u6d88\u9664\u8fd9\u4e9b\u544a\u8b66\uff0c\u4f46\u4e0d\u80fd\u4ec5\u51ed\u8be5\u5305\u65ad\u8a00\u6bcf\u4e2a\u6f0f\u6d1e\u7684\u89e6\u53d1\u6761\u4ef6\u3001\u53ef\u5229\u7528\u8def\u5f84\u6216\u4fee\u590d\u673a\u5236\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n**\u529f\u80fd\u5f71\u54cd\uff1a** \u5f71\u54cd\u8303\u56f4\u9650\u5b9a\u5728 MetadataViewer \u793a\u4f8b\u6269\u5c55\u7684\u4f9d\u8d56\u5b89\u88c5\u7ed3\u679c\u3002\u6ca1\u6709\u53ef\u89c1\u7684\u4e1a\u52a1\u903b\u8f91\u3001API\u3001UI\u3001\u914d\u7f6e\u6216\u6570\u636e\u683c\u5f0f\u53d8\u5316\u3002`brace-expansion` \u901a\u5e38\u7531 glob\uff0f\u8def\u5f84\u5339\u914d\u5de5\u5177\u94fe\u95f4\u63a5\u4f7f\u7528\uff1b\u5347\u7ea7\u540e\uff0c\u76f8\u5173\u5f00\u53d1\u5de5\u5177\u5728\u5c55\u5f00\u82b1\u62ec\u53f7\u6a21\u5f0f\u65f6\u4f1a\u6267\u884c\u65b0\u7248 1.x \u5b9e\u73b0\u3002\n\n**\u8fd0\u884c\u65f6\u5f71\u54cd\uff1a** \u9501\u6587\u4ef6\u5c06\u8be5\u5305\u6807\u8bb0\u4e3a `dev: true`\uff0c\u6240\u4ee5\u6309\u5305\u5185\u5143\u6570\u636e\u770b\uff0c\u5b83\u4e0d\u5c5e\u4e8e\u751f\u4ea7\u4f9d\u8d56\u3002\u4f46\u5206\u6790\u5305\u672a\u63d0\u4f9b\u8be5\u6269\u5c55\u7684\u6253\u5305\u6d41\u7a0b\uff0c\u65e0\u6cd5\u786e\u8ba4\u6784\u5efa\u4ea7\u7269\u662f\u5426\u4f1a\u628a\u5f00\u53d1\u4f9d\u8d56\u6216\u5176\u884c\u4e3a\u95f4\u63a5\u5e26\u5165\u53d1\u5e03\u5185\u5bb9\u3002\n\n**\u90e8\u7f72\u4e0e\u4f9b\u5e94\u94fe\u5f71\u54cd\uff1a** \u5b89\u88c5\u8fc7\u7a0b\u9700\u8981\u5185\u90e8 Azure Artifacts \u6e90\u80fd\u591f\u63d0\u4f9b\u6307\u5b9a\u7684 1.1.18 tarball\uff0c\u5e76\u4e14\u5176\u5185\u5bb9\u5fc5\u987b\u5339\u914d\u9501\u6587\u4ef6\u4e2d\u7684\u5b8c\u6574\u6027\u503c\u3002\u9664\u8fd9\u4e00\u5236\u54c1\u66ff\u6362\u5916\uff0c\u53ef\u89c1\u5dee\u5f02\u6ca1\u6709\u6539\u53d8\u6ce8\u518c\u8868\u57df\u540d\u6216\u4f9d\u8d56\u6765\u6e90\u3002\n\n**\u5b89\u5168\u5f71\u54cd\uff1a** \u9884\u671f\u6536\u76ca\u662f\u79fb\u9664\u65e7\u7248 `brace-expansion` \u5bf9\u5e94\u7684 CG \u9ad8\u4e25\u91cd\u6027\u544a\u8b66\uff0c\u5e76\u964d\u4f4e\u6076\u610f\u6216\u6781\u7aef\u82b1\u62ec\u53f7\u8868\u8fbe\u5f0f\u5bfc\u81f4\u8d44\u6e90\u6d88\u8017\u95ee\u9898\u7684\u98ce\u9669\u3002\u5b9e\u9645\u544a\u8b66\u5173\u95ed\u4ecd\u53d6\u51b3\u4e8e Component Governance \u91cd\u65b0\u626b\u63cf\u7ed3\u679c\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n| \u98ce\u9669\u6216\u5173\u6ce8\u70b9 | \u5177\u4f53\u8bf4\u660e | \u5efa\u8bae |\n|---|---|---|\n| 1.x \u8865\u4e01\u7248\u672c\u884c\u4e3a\u5dee\u5f02 | \u867d\u7136\u4ecd\u5728\u540c\u4e00\u4e3b\u7248\u672c\u5185\uff0c\u4f46\u5347\u7ea7\u8de8\u8d8a\u591a\u4e2a\u8865\u4e01\u7248\u672c\uff1b\u4f9d\u8d56\u5b83\u7684 glob\uff0f\u5339\u914d\u5de5\u5177\u5bf9\u8fb9\u754c\u8f93\u5165\u7684\u5c55\u5f00\u7ed3\u679c\u6216\u6027\u80fd\u53ef\u80fd\u53d8\u5316\u3002 | \u8fd0\u884c MetadataViewer \u7684\u73b0\u6709\u6784\u5efa\u3001\u6d4b\u8bd5\u53ca\u6d89\u53ca glob/\u8def\u5f84\u6a21\u5f0f\u7684\u4efb\u52a1\u3002 |\n| \u5b8c\u6574\u6027\u7b97\u6cd5\u53d8\u5316 | \u9501\u6587\u4ef6\u4e2d\u7684\u5b8c\u6574\u6027\u503c\u7531 `sha512-...` \u53d8\u4e3a `sha1-...`\u3002\u8fd9\u4e0d\u4ee3\u8868\u5236\u54c1\u4e00\u5b9a\u4e0d\u53ef\u4fe1\uff0c\u4f46 SHA-1 \u7684\u6297\u78b0\u649e\u80fd\u529b\u5f31\u4e8e SHA-512\uff0c\u4e5f\u53ef\u80fd\u89e6\u53d1\u7ec4\u7ec7\u7b56\u7565\u6216\u5ba1\u8ba1\u5173\u6ce8\u3002 | \u7528\u4ed3\u5e93\u5f53\u524d npm \u7248\u672c\u6267\u884c\u5e72\u51c0\u5b89\u88c5\uff0c\u786e\u8ba4\u5185\u90e8\u6e90\u8fd4\u56de\u7684\u5236\u54c1\u4e0e\u9501\u6587\u4ef6\u5339\u914d\uff0c\u5e76\u68c0\u67e5\u5b89\u5168\uff0f\u5305\u7b56\u7565\u662f\u5426\u63a5\u53d7 SHA-1 \u5b8c\u6574\u6027\u8bb0\u5f55\u3002 |\n| \u5185\u90e8\u6e90\u53ef\u7528\u6027 | \u65b0\u7248\u672c\u4e0b\u8f7d\u5730\u5740\u4f9d\u8d56 `AzureNotebooksEntry` \u6e90\u4e2d\u5df2\u6709 1.1.18 \u5236\u54c1\u3002 | \u5728 CI \u6216\u7b49\u4ef7\u73af\u5883\u6267\u884c `npm ci`\uff0c\u9a8c\u8bc1\u65e0 404\u3001\u8ba4\u8bc1\u6216\u5b8c\u6574\u6027\u9519\u8bef\u3002 |\n| Node/npm \u7248\u672c\u517c\u5bb9\u6027 | \u5206\u6790\u5305\u672a\u5305\u542b `package.json`\u3001Node \u7248\u672c\u7ea6\u675f\u6216 CI \u914d\u7f6e\uff0c\u65e0\u6cd5\u5224\u65ad\u8be5\u76ee\u5f55\u4f7f\u7528\u7684 npm \u9501\u6587\u4ef6\u7248\u672c\u53ca\u5de5\u5177\u94fe\u7ec4\u5408\u3002 | \u4f7f\u7528\u9879\u76ee\u89c4\u5b9a\u7684 Node/npm \u7248\u672c\u9a8c\u8bc1\uff0c\u4e0d\u8981\u7528\u672c\u5730\u65b0\u7248 npm \u65e0\u610f\u91cd\u5199\u6574\u4e2a\u9501\u6587\u4ef6\u3002 |\n| \u4f20\u9012\u4f9d\u8d56\u8c03\u7528\u8def\u5f84\u672a\u77e5 | \u5305\u4e2d\u6ca1\u6709\u8c03\u7528\u65b9\u6e90\u7801\u6216\u5b8c\u6574\u4f9d\u8d56\u6811\u5206\u6790\uff0c\u65e0\u6cd5\u786e\u8ba4\u54ea\u4e9b\u5de5\u5177\u5b9e\u9645\u8c03\u7528 `brace-expansion`\uff0c\u4e5f\u65e0\u6cd5\u91cf\u5316\u884c\u4e3a\u53d8\u5316\u8986\u76d6\u9762\u3002 | \u91cd\u70b9\u8986\u76d6\u4f9d\u8d56\u5b89\u88c5\u3001\u6269\u5c55\u6784\u5efa\u548c\u4efb\u4f55\u6587\u4ef6\u5339\u914d\uff0f\u6253\u5305\u6d41\u7a0b\u3002 |\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae\n\n\u5206\u6790\u5305\u672a\u5217\u51fa\u6d4b\u8bd5\u53d8\u66f4\uff0c\u4e5f\u6ca1\u6709\u63d0\u4f9b CI\u3001\u6784\u5efa\u6216\u6d4b\u8bd5\u6267\u884c\u7ed3\u679c\u3002\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u6b64 PR \u5df2\u901a\u8fc7\u529f\u80fd\u9a8c\u8bc1\u3002\u5408\u5e76\u524d\u5efa\u8bae\u81f3\u5c11\u5b8c\u6210\uff1a\n\n1. \u5728 `sample/extensions/common-extensions/MetadataViewer` \u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 Node/npm \u7248\u672c\u6267\u884c\u5e72\u51c0\u7684\u9501\u6587\u4ef6\u5b89\u88c5\uff0c\u786e\u8ba4\u65b0\u7248\u5305\u53ef\u4ece\u5185\u90e8\u6e90\u4e0b\u8f7d\u4e14\u5b8c\u6574\u6027\u6821\u9a8c\u901a\u8fc7\u3002\n2. \u8fd0\u884c\u8be5\u6269\u5c55\u73b0\u6709\u7684\u5355\u5143\u6d4b\u8bd5\u3001\u6784\u5efa\u548c\u6253\u5305\u6d41\u7a0b\uff0c\u786e\u8ba4\u5347\u7ea7\u6ca1\u6709\u6539\u53d8\u9884\u671f\u6587\u4ef6\u5339\u914d\u7ed3\u679c\u3002\n3. \u68c0\u67e5\u5b89\u88c5\u540e\u7684\u4f9d\u8d56\u6811\uff0c\u786e\u8ba4\u89e3\u6790\u5230\u7684 `brace-expansion` \u4e3a 1.1.18\uff0c\u4e14\u6ca1\u6709\u989d\u5916\u9501\u6587\u4ef6\u6f02\u79fb\u3002\n4. \u89e6\u53d1\u6216\u7b49\u5f85 Component Governance \u91cd\u65b0\u626b\u63cf\uff0c\u786e\u8ba4 CVE-2026-13149 \u4e0e CVE-2026-14257 \u544a\u8b66\u6309\u9884\u671f\u89e3\u9664\u3002\n\n## \u5206\u6790\u8986\u76d6\u8303\u56f4\n\n- \u5dee\u5f02\u7531\u672c\u5730 Git \u65b9\u6cd5\u5bfc\u51fa\uff1b\u7edf\u8ba1\u4fe1\u606f\u6807\u8bb0 `diffTruncated: false`\uff0c\u552f\u4e00\u53d8\u66f4\u6587\u4ef6\u7684 `truncated` \u4e5f\u4e3a `false`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5206\u6790\u5305\u4e2d\u58f0\u660e\u7684\u5168\u90e8\u4ee3\u7801\u5dee\u5f02\u3002\n- \u552f\u4e00\u6587\u4ef6\u7684\u53ef\u89c1\u5dee\u5f02\u4ec5\u6d89\u53ca\u4e24\u7ec4\u7248\u672c\u3001\u5236\u54c1\u5730\u5740\u548c\u5b8c\u6574\u6027\u503c\u66f4\u65b0\uff1b\u6ca1\u6709\u539f\u59cb\u5dee\u5f02\u5757\u5728\u672c\u6587\u4e2d\u590d\u8ff0\u3002\n- PR \u63cf\u8ff0\u5185\u5bb9\u5728\u4e0a\u6e38\u63d0\u4ea4\u5217\u8868\u4e2d\u9014\u7ed3\u675f\uff0c\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u5176\u4f59\u63cf\u8ff0\u6587\u672c\u3002\u56e0\u6b64\u672c\u6587\u53ea\u5f15\u7528\u4e86\u53ef\u89c1\u7684\u53d1\u5e03\u8bf4\u660e\u548c\u5b89\u5168\u544a\u8b66\u4fe1\u606f\uff0c\u4e0d\u5bf9\u7f3a\u5931\u7684\u63d0\u4ea4\u5217\u8868\u5185\u5bb9\u4f5c\u63a8\u65ad\u3002\n- \u5206\u6790\u5305\u672a\u5305\u542b `package.json`\u3001\u8c03\u7528\u65b9\u6e90\u7801\u3001\u6d41\u6c34\u7ebf\u7ed3\u679c\u3001\u6d4b\u8bd5\u65e5\u5fd7\u6216 CG \u544a\u8b66\u8be6\u60c5\uff1b\u76f8\u5e94\u7ed3\u8bba\u5747\u660e\u786e\u4fdd\u7559\uff0c\u4e0d\u5c06\u8fd9\u4e9b\u7f3a\u5931\u5185\u5bb9\u89c6\u4e3a\u5df2\u5206\u6790\u3002\n", "creation_timestamp": "2026-08-30T15:24:45.335893Z"}, {"uuid": "3b65038d-b63e-448c-b6f8-c7c7aec9e217", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/djlan/a84bdb8b9421e3bbf12558087062d9a0", "content": "# [SECURITY] \u5347\u7ea7 `/sample/angular-host-app` \u4e2d\u7684 `brace-expansion`\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 Angular \u793a\u4f8b\u5bbf\u4e3b\u5e94\u7528\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u4e24\u6761\u4f9d\u8d56\u94fe\u4e2d\u7684 `brace-expansion` \u4ece `1.1.12` \u5347\u7ea7\u5230 `1.1.18`\u3001\u4ece `5.0.6` \u5347\u7ea7\u5230 `5.0.9`\uff0c\u4ee5\u5904\u7406\u4e24\u4e2a\u9ad8\u5371\u7ec4\u4ef6\u6cbb\u7406\u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u4f7f 5.x \u4f9d\u8d56\u5b9e\u4f8b\u4e0d\u518d\u58f0\u660e\u652f\u6301 Node.js 18\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [AzureNotebooks PR 767498](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767498) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | Active\uff1b\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001\u4e3a Succeeded |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Fangular-host-app/brace-expansion-1.1.18-749871` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-08-07 09:45:19\uff08\u5206\u6790\u5305\u539f\u59cb\u65f6\u95f4\uff0c\u672a\u6ce8\u660e\u65f6\u533a\uff09 |\n| \u53d8\u66f4\u7edf\u8ba1 | 1 \u4e2a\u6587\u4ef6\u30011 \u4e2a\u63d0\u4ea4\u30011 \u4e2a\u8fed\u4ee3\uff1b\u6240\u63d0\u4f9b diff \u4e2d\u7ea6 11 \u884c\u65b0\u589e\u300111 \u884c\u5220\u9664 |\n| \u5b89\u5168\u80cc\u666f | Component Governance \u9ad8\u5371\u544a\u8b66 15400036\uff08CVE-2026-13149\uff09\u548c 15766347\uff08CVE-2026-14257\uff09 |\n\n## \u76ee\u5f55\n\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n  - [\u5b89\u5168\u4f9d\u8d56\u5347\u7ea7](#\u5b89\u5168\u4f9d\u8d56\u5347\u7ea7)\n  - [\u9501\u6587\u4ef6\u89e3\u6790\u4e0e\u4f9b\u5e94\u94fe\u56fa\u5b9a](#\u9501\u6587\u4ef6\u89e3\u6790\u4e0e\u4f9b\u5e94\u94fe\u56fa\u5b9a)\n  - [Nodejs-\u8fd0\u884c\u65f6\u517c\u5bb9\u6027\u5143\u6570\u636e](#nodejs-\u8fd0\u884c\u65f6\u517c\u5bb9\u6027\u5143\u6570\u636e)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n- [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9)\n- [\u6d4b\u8bd5\u60c5\u51b5\u4e0e\u5efa\u8bae](#\u6d4b\u8bd5\u60c5\u51b5\u4e0e\u5efa\u8bae)\n- [\u5dee\u5f02\u8986\u76d6\u8303\u56f4](#\u5dee\u5f02\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u672c\u6b21\u6539\u52a8\u96c6\u4e2d\u5728 [`sample/angular-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767498?path=/sample/angular-host-app/package-lock.json&_a=files)\uff0c\u6ca1\u6709\u4fee\u6539\u5e94\u7528\u6e90\u7801\u6216 `package.json`\u3002\u9501\u6587\u4ef6\u4e2d\u7684\u4e09\u4e2a `brace-expansion` \u5b89\u88c5\u5b9e\u4f8b\u88ab\u66f4\u65b0\uff1a\n\n| \u4f9d\u8d56\u4f4d\u7f6e | \u65e7\u7248\u672c | \u65b0\u7248\u672c | \u4f9d\u8d56\u5c5e\u6027 |\n|---|---:|---:|---|\n| \u9876\u5c42 `node_modules/brace-expansion` | 1.1.12 | 1.1.18 | `devOptional: true` |\n| `@tufjs/models` \u5185\u5d4c\u4f9d\u8d56 | 5.0.6 | 5.0.9 | `dev: true` |\n| `ignore-walk` \u5185\u5d4c\u4f9d\u8d56 | 5.0.6 | 5.0.9 | `dev: true` |\n\n\u66f4\u65b0\u540c\u65f6\u66ff\u6362\u4e86\u5bf9\u5e94\u5305\u7684\u5185\u90e8 Azure Artifacts \u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\uff0c\u4f7f npm \u6309\u9501\u6587\u4ef6\u5b89\u88c5\u65f6\u83b7\u53d6\u5e76\u6821\u9a8c\u65b0\u7248\u672c\u3002PR \u63cf\u8ff0\u660e\u786e\u6307\u51fa\u5347\u7ea7\u7528\u4e8e\u5904\u7406\u4e24\u4e2a\u9ad8\u5371\u5b89\u5168\u544a\u8b66\uff1b\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u6f0f\u6d1e\u89e6\u53d1\u8def\u5f84\u3001\u5229\u7528\u6761\u4ef6\u6216\u8865\u4e01\u5185\u90e8\u5b9e\u73b0\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u5e94\u7528\u662f\u5426\u53ef\u76f4\u63a5\u5229\u7528\u8fd9\u4e9b\u6f0f\u6d1e\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n**\u4e3a\u4ec0\u4e48\u6539\uff1a** Dependabot \u6839\u636e Component Governance \u544a\u8b66\u521b\u5efa\u6b64 PR\uff0c\u76ee\u6807\u662f\u8ba9\u4ed3\u5e93\u4e0d\u518d\u9501\u5b9a\u53d7\u544a\u8b66\u5f71\u54cd\u7684 `brace-expansion` \u7248\u672c\u3002\u8be5\u5305\u8d1f\u8d23\u5c55\u5f00\u7c7b\u4f3c `{a,b}` \u6216\u6570\u503c\u8303\u56f4\u5f62\u5f0f\u7684\u6a21\u5f0f\uff0c\u901a\u5e38\u7531\u6587\u4ef6\u5339\u914d\u3001\u6253\u5305\u6216\u4f9d\u8d56\u7ba1\u7406\u5de5\u5177\u95f4\u63a5\u4f7f\u7528\u3002\n\n**\u5982\u4f55\u5de5\u4f5c\uff1a**\n\n- 1.x \u4f9d\u8d56\u5b9e\u4f8b\u4ece `1.1.12` \u63d0\u5347\u5230 `1.1.18`\u3002\n- \u4e24\u4e2a\u72ec\u7acb\u7684 5.x \u5d4c\u5957\u4f9d\u8d56\u5b9e\u4f8b\u5747\u4ece `5.0.6` \u63d0\u5347\u5230 `5.0.9`\u3002\n- npm \u4f7f\u7528\u9501\u6587\u4ef6\u6784\u5efa\u4f9d\u8d56\u6811\u65f6\uff0c\u4f1a\u89e3\u6790\u5230\u8fd9\u4e9b\u65b0\u7248\u672c\uff0c\u800c\u4e0d\u662f\u65e7\u7684\u544a\u8b66\u7248\u672c\u3002\n- \u7531\u4e8e\u4e09\u4e2a\u5b9e\u4f8b\u90fd\u6807\u8bb0\u4e3a\u5f00\u53d1\u76f8\u5173\u4f9d\u8d56\uff08`dev` \u6216 `devOptional`\uff09\uff0c\u76f4\u63a5\u5f71\u54cd\u66f4\u53ef\u80fd\u51fa\u73b0\u5728\u5b89\u88c5\u3001\u6784\u5efa\u3001\u6253\u5305\u6216\u5f00\u53d1\u5de5\u5177\u94fe\u9636\u6bb5\uff0c\u800c\u975e\u5e94\u7528\u4e1a\u52a1\u6e90\u7801\u6267\u884c\u8def\u5f84\uff1b\u4f46\u5206\u6790\u5305\u672a\u5305\u542b\u5b8c\u6574\u4f9d\u8d56\u8c03\u7528\u94fe\uff0c\u65e0\u6cd5\u636e\u6b64\u6392\u9664\u751f\u4ea7\u6784\u5efa\u4ea7\u7269\u53d7\u5f71\u54cd\u7684\u53ef\u80fd\u6027\u3002\n\n### \u9501\u6587\u4ef6\u89e3\u6790\u4e0e\u4f9b\u5e94\u94fe\u56fa\u5b9a\n\n**\u4e3a\u4ec0\u4e48\u6539\uff1a** \u4ec5\u4fee\u6539\u7248\u672c\u53f7\u4e0d\u8db3\u4ee5\u6784\u6210\u6709\u6548\u7684 npm \u9501\u6587\u4ef6\u66f4\u65b0\uff1b\u4e0b\u8f7d\u6e90\u548c\u5b8c\u6574\u6027\u6821\u9a8c\u503c\u4e5f\u5fc5\u987b\u4e0e\u65b0\u5236\u54c1\u4e00\u81f4\u3002\n\n**\u5982\u4f55\u5de5\u4f5c\uff1a**\n\n- \u6bcf\u4e2a\u5347\u7ea7\u5b9e\u4f8b\u7684 `resolved` \u5730\u5740\u5747\u6539\u4e3a AzureNotebooks \u5185\u90e8 Azure Artifacts \u6e90\u4e0a\u7684\u65b0\u7248\u672c tarball\u3002\n- \u6bcf\u4e2a\u5347\u7ea7\u5b9e\u4f8b\u7684 `integrity` \u503c\u968f\u5236\u54c1\u66f4\u65b0\uff0cnpm \u5b89\u88c5\u65f6\u53ef\u9a8c\u8bc1\u4e0b\u8f7d\u5185\u5bb9\u4e0e\u9501\u6587\u4ef6\u8bb0\u5f55\u4e00\u81f4\u3002\n- \u4f9d\u8d56\u58f0\u660e `balanced-match: ^4.0.2` \u4fdd\u6301\u4e0d\u53d8\uff0c\u8bf4\u660e\u6240\u63d0\u4f9b\u5dee\u5f02\u4e2d\u6ca1\u6709\u8c03\u6574\u8be5\u76f4\u63a5\u5b50\u4f9d\u8d56\u3002\n- `package.json` \u672a\u53d1\u751f\u53d8\u5316\uff0c\u8868\u660e\u8fd9\u662f\u4f20\u9012\u4f9d\u8d56\u9501\u5b9a\u7ed3\u679c\u7684\u5b89\u5168\u4fee\u590d\uff0c\u800c\u4e0d\u662f\u65b0\u589e\u6216\u66f4\u6539\u9876\u5c42\u4f9d\u8d56\u8303\u56f4\u3002\n\n### Node.js \u8fd0\u884c\u65f6\u517c\u5bb9\u6027\u5143\u6570\u636e\n\n\u4e24\u4e2a 5.x \u5b9e\u4f8b\u7684 `engines.node` \u4ece `18 || 20 || >=22` \u53d8\u4e3a `20 || >=22`\u3002\u8fd9\u662f\u65b0\u7248\u672c\u5305\u5143\u6570\u636e\u968f\u5347\u7ea7\u5e26\u6765\u7684\u5b9e\u9645\u517c\u5bb9\u6027\u53d8\u5316\uff1a\n\n- Node.js 20 \u548c 22 \u53ca\u66f4\u9ad8\u7248\u672c\u4ecd\u6ee1\u8db3\u58f0\u660e\u8981\u6c42\u3002\n- Node.js 18 \u4e0d\u518d\u5904\u4e8e\u5305\u58f0\u660e\u7684\u652f\u6301\u8303\u56f4\u3002\n- \u5728\u9ed8\u8ba4 npm \u914d\u7f6e\u4e0b\uff0c\u8fd9\u901a\u5e38\u53ef\u80fd\u8868\u73b0\u4e3a\u5f15\u64ce\u4e0d\u5339\u914d\u8b66\u544a\uff1b\u82e5\u73af\u5883\u542f\u7528\u4e86\u4e25\u683c\u5f15\u64ce\u68c0\u67e5\uff0c\u5219\u53ef\u80fd\u963b\u6b62\u5b89\u88c5\u3002\u5b9e\u9645\u884c\u4e3a\u53d6\u51b3\u4e8e npm \u7248\u672c\u548c\u4ed3\u5e93/CI \u7684\u914d\u7f6e\uff0c\u800c\u8fd9\u4e9b\u4fe1\u606f\u672a\u5305\u542b\u5728\u5206\u6790\u5305\u4e2d\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n| \u5f71\u54cd\u9762 | \u5206\u6790 |\n|---|---|\n| \u5b89\u5168\u6027 | \u901a\u8fc7\u66ff\u6362\u53d7 Component Governance \u9ad8\u5371\u544a\u8b66\u5f71\u54cd\u7684\u9501\u5b9a\u7248\u672c\uff0c\u76ee\u6807\u662f\u6d88\u9664\u5bf9\u5e94\u4f9d\u8d56\u7248\u672c\u5e26\u6765\u7684\u98ce\u9669\u3002\u662f\u5426\u5df2\u5b8c\u5168\u5173\u95ed\u544a\u8b66\u4ecd\u9700\u7531 CG \u626b\u63cf\u6216\u7b56\u7565\u7ed3\u679c\u786e\u8ba4\uff0c\u5206\u6790\u5305\u672a\u5305\u542b\u4fee\u590d\u540e\u7684\u626b\u63cf\u7ed3\u679c\u3002 |\n| \u5e94\u7528\u884c\u4e3a | \u6ca1\u6709\u5e94\u7528\u6e90\u7801\u53d8\u66f4\u3002\u6f5c\u5728\u884c\u4e3a\u5dee\u5f02\u6765\u81ea `brace-expansion` \u65b0\u7248\u672c\u5bf9\u6a21\u5f0f\u5c55\u5f00\u548c\u5f02\u5e38\u8f93\u5165\u7684\u5904\u7406\u53d8\u5316\uff1b\u5305\u5185\u90e8\u4ee3\u7801\u672a\u5305\u542b\u5728\u5206\u6790\u5305\u4e2d\uff0c\u4e0d\u80fd\u5bf9\u5177\u4f53\u8bed\u4e49\u5dee\u5f02\u4f5c\u8fdb\u4e00\u6b65\u7ed3\u8bba\u3002 |\n| \u6784\u5efa\u4e0e\u5f00\u53d1\u5de5\u5177\u94fe | \u4e09\u4e2a\u53d8\u66f4\u5b9e\u4f8b\u5747\u4e3a\u5f00\u53d1\u76f8\u5173\u4f9d\u8d56\uff0c\u5b89\u88c5\u3001\u6784\u5efa\u3001\u6253\u5305\u3001\u6d4b\u8bd5\u6216\u6587\u4ef6\u904d\u5386\u5de5\u5177\u6700\u53ef\u80fd\u53d7\u5230\u5f71\u54cd\u3002 |\n| \u90e8\u7f72\u4ea7\u7269 | \u672a\u63d0\u4f9b\u6784\u5efa\u4ea7\u7269\u6216\u4f9d\u8d56\u88c1\u526a\u4fe1\u606f\uff0c\u65e0\u6cd5\u786e\u8ba4\u8fd9\u4e9b\u5f00\u53d1\u4f9d\u8d56\u662f\u5426\u8fdb\u5165\u6700\u7ec8\u90e8\u7f72\u5305\u3002 |\n| \u4f9b\u5e94\u94fe | \u4ecd\u4ece\u73b0\u6709 AzureNotebooks \u5185\u90e8\u5305\u6e90\u4e0b\u8f7d\uff0c\u4ec5\u7248\u672c\u8def\u5f84\u548c\u54c8\u5e0c\u53d8\u5316\uff1b\u6ca1\u6709\u663e\u793a\u5207\u6362\u6ce8\u518c\u8868\u6216\u65b0\u589e\u5916\u90e8\u6e90\u3002 |\n| \u56de\u6eda | \u903b\u8f91\u4e0a\u53ef\u901a\u8fc7\u6062\u590d\u65e7\u9501\u6587\u4ef6\u6761\u76ee\u56de\u6eda\uff0c\u4f46\u8fd9\u4f1a\u91cd\u65b0\u5f15\u5165\u88ab\u5b89\u5168\u544a\u8b66\u6807\u8bb0\u7684\u7248\u672c\uff0c\u4e0d\u5e94\u4f5c\u4e3a\u957f\u671f\u65b9\u6848\u3002 |\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\u70b9\n\n1. **Node.js 18 \u517c\u5bb9\u6027\u98ce\u9669\uff1a** `brace-expansion@5.0.9` \u58f0\u660e\u4ec5\u652f\u6301 Node.js 20 \u6216 `>=22`\u3002\u5982\u679c\u8be5\u793a\u4f8b\u3001CI \u6216\u5f00\u53d1\u73af\u5883\u4ecd\u8fd0\u884c Node.js 18\uff0c\u5b89\u88c5\u53ef\u80fd\u4ea7\u751f\u8b66\u544a\uff0c\u4e25\u683c\u6a21\u5f0f\u4e0b\u53ef\u80fd\u5931\u8d25\u3002\n2. **\u6a21\u5f0f\u5c55\u5f00\u884c\u4e3a\u53d8\u5316\uff1a** \u5b89\u5168\u8865\u4e01\u53ef\u80fd\u6536\u7d27\u6781\u7aef\u6216\u6076\u610f\u8f93\u5165\u7684\u5904\u7406\u3002\u4f9d\u8d56 `minimatch`\u3001\u6587\u4ef6\u904d\u5386\u6216\u6253\u5305\u6d41\u7a0b\u82e5\u4f9d\u8d56\u65e7\u7684\u8fb9\u754c\u884c\u4e3a\uff0c\u53ef\u80fd\u51fa\u73b0\u5339\u914d\u7ed3\u679c\u53d8\u5316\uff1b\u5206\u6790\u5305\u6ca1\u6709\u76f8\u5173\u8c03\u7528\u4ee3\u7801\u6216\u4e0a\u6e38\u53d8\u66f4\u5185\u5bb9\uff0c\u65e0\u6cd5\u5224\u65ad\u662f\u5426\u4f1a\u89e6\u53d1\u3002\n3. **\u9501\u6587\u4ef6\u4e0e\u5b89\u88c5\u5668\u7248\u672c\u5dee\u5f02\uff1a** \u53ea\u66f4\u65b0 `package-lock.json` \u80fd\u8ba9\u9075\u5faa\u8be5\u9501\u6587\u4ef6\u7684 npm \u5b89\u88c5\u83b7\u5f97\u4fee\u590d\u7248\u672c\uff0c\u4f46\u4e0d\u540c npm \u7248\u672c\u3001\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u6216\u5ffd\u7565\u9501\u6587\u4ef6\u7684\u5b89\u88c5\u65b9\u5f0f\u53ef\u80fd\u4ea7\u751f\u4e0d\u540c\u4f9d\u8d56\u6811\u3002\n4. **\u5185\u90e8\u5236\u54c1\u53ef\u7528\u6027\uff1a** \u65b0 tarball \u5fc5\u987b\u5df2\u540c\u6b65\u5230\u6240\u8bb0\u5f55\u7684 Azure Artifacts feed\uff0c\u4e14 CI \u8eab\u4efd\u5177\u5907\u8bfb\u53d6\u6743\u9650\uff1b\u5305\u4e2d\u6ca1\u6709\u5b89\u88c5\u65e5\u5fd7\u53ef\u786e\u8ba4\u8fd9\u4e00\u70b9\u3002\n5. **\u544a\u8b66\u5173\u95ed\u5c1a\u672a\u88ab\u8bc1\u660e\uff1a** PR \u7684\u76ee\u6807\u662f\u4fee\u590d CVE-2026-13149 \u548c CVE-2026-14257\uff0c\u4f46\u5206\u6790\u5305\u4e0d\u5305\u542b\u5408\u5e76\u540e\u6216\u5f53\u524d\u63d0\u4ea4\u4e0a\u7684 CG \u91cd\u65b0\u626b\u63cf\u7ed3\u679c\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u544a\u8b66\u5df2\u7ecf\u5173\u95ed\u3002\n\n## \u6d4b\u8bd5\u60c5\u51b5\u4e0e\u5efa\u8bae\n\n\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\u3001\u6d4b\u8bd5\u6267\u884c\u8bb0\u5f55\u3001\u6784\u5efa\u65e5\u5fd7\u6216\u7b56\u7565\u68c0\u67e5\u8be6\u60c5\uff0c\u56e0\u6b64\u6ca1\u6709\u8bc1\u636e\u8868\u660e\u672c\u6b21\u5347\u7ea7\u5df2\u901a\u8fc7\u9879\u76ee\u6d4b\u8bd5\u3002\u5efa\u8bae\u81f3\u5c11\u9a8c\u8bc1\uff1a\n\n1. \u5728\u4ed3\u5e93\u5b9e\u9645\u652f\u6301\u7684 Node.js \u7248\u672c\u4e0a\u6267\u884c\u9501\u6587\u4ef6\u5b89\u88c5\uff0c\u91cd\u70b9\u786e\u8ba4\u5185\u90e8 feed \u4e0b\u8f7d\u548c\u5b8c\u6574\u6027\u6821\u9a8c\u6210\u529f\u3002\n2. \u5728 Node.js 20 \u4e0e\u5f53\u524d\u4e3b\u529b Node.js 22+ \u73af\u5883\u8fd0\u884c Angular \u793a\u4f8b\u5e94\u7528\u7684\u73b0\u6709\u6784\u5efa\u548c\u6d4b\u8bd5\u3002\n3. \u5982\u679c Node.js 18 \u4ecd\u5c5e\u4e8e\u652f\u6301\u77e9\u9635\uff0c\u4e13\u95e8\u786e\u8ba4\u5b89\u88c5\u884c\u4e3a\uff1b\u82e5\u5931\u8d25\uff0c\u5e94\u5347\u7ea7\u8fd0\u884c\u65f6\u6216\u8bc4\u4f30\u4f9d\u8d56\u94fe\u7684\u517c\u5bb9\u7248\u672c\uff0c\u800c\u4e0d\u662f\u5ffd\u7565\u4e25\u683c\u5f15\u64ce\u9519\u8bef\u3002\n4. \u8fd0\u884c\u6d89\u53ca glob\u3001\u6587\u4ef6\u904d\u5386\u3001\u6253\u5305\u6216 npm \u6253\u5305\u6d41\u7a0b\u7684\u6d4b\u8bd5\uff0c\u8986\u76d6 `brace-expansion` \u95f4\u63a5\u53c2\u4e0e\u7684\u6a21\u5f0f\u5339\u914d\u8def\u5f84\u3002\n5. \u91cd\u65b0\u8fd0\u884c Component Governance/\u5b89\u5168\u7b56\u7565\uff0c\u786e\u8ba4\u4e24\u4e2a\u9ad8\u5371\u544a\u8b66\u5728\u8be5\u63d0\u4ea4\u5bf9\u5e94\u7684\u4f9d\u8d56\u56fe\u4e2d\u5f97\u5230\u89e3\u51b3\u3002\n\n## \u5dee\u5f02\u8986\u76d6\u8303\u56f4\n\n\u5206\u6790\u5305\u5217\u51fa **1 \u4e2a\u53d8\u66f4\u6587\u4ef6**\uff0c\u5e76\u63d0\u4f9b\u8be5\u6587\u4ef6\u7684 git \u672c\u5730\u5dee\u5f02\uff1b\u5168\u5c40 `diffTruncated` \u4e3a `false`\uff0c\u6587\u4ef6\u7ea7 `truncated` \u4e5f\u4e3a `false`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u5185\u5217\u51fa\u7684\u5168\u90e8\u4ee3\u7801\u5dee\u5f02\uff0c\u6ca1\u6709\u56e0 diff \u622a\u65ad\u800c\u9057\u6f0f\u5176\u4ed6\u53d8\u66f4\u5757\u3002\n\n\u8986\u76d6\u8fb9\u754c\u4ecd\u9700\u660e\u786e\uff1a\u5206\u6790\u5305\u53ea\u5305\u542b\u9501\u6587\u4ef6\u5dee\u5f02\u548c PR \u5143\u6570\u636e\uff0c\u4e0d\u5305\u542b\u4f9d\u8d56\u5305\u6e90\u7801\u3001\u5b8c\u6574\u6f0f\u6d1e\u8bf4\u660e\u3001CI/\u6d4b\u8bd5\u7ed3\u679c\u3001\u6784\u5efa\u4ea7\u7269\u6216\u8fd0\u884c\u65f6\u914d\u7f6e\uff1b\u672c\u6587\u672a\u5bf9\u8fd9\u4e9b\u7f3a\u5931\u5185\u5bb9\u4f5c\u672a\u7ecf\u8bc1\u5b9e\u7684\u5206\u6790\u3002\n", "creation_timestamp": "2026-08-30T16:27:59.173723Z"}, {"uuid": "b59c3437-4bbc-42ac-9bfd-6f3513a6c96d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/djlan/d0b5d62b498894d793a58be38d8f85e5", "content": "# [SECURITY] \u5c06 ReverseSelection \u4e2d\u7684 brace-expansion \u4ece 1.1.11 \u5347\u7ea7\u5230 1.1.18\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 ReverseSelection \u793a\u4f8b\u6269\u5c55\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u5f00\u53d1\u4f9d\u8d56\u94fe\u4e2d\u7684 `brace-expansion` \u56fa\u5b9a\u5230 1.1.18\uff0c\u4ee5\u5904\u7406 Component Governance \u62a5\u544a\u7684\u4e24\u4e2a\u9ad8\u5371\u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u4fdd\u6301\u4f9d\u8d56\u6765\u6e90\u548c\u4f9d\u8d56\u5173\u7cfb\u4e0d\u53d8\u3002\n\n- **PR\uff1a** [AzureNotebooks PR 767497](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767497)\n- **\u4f5c\u8005\uff1a** Dependabot\n- **\u72b6\u6001\uff1a** Active\uff0c\u975e\u8349\u7a3f\uff1b\u5305\u5185\u8bb0\u5f55\u7684\u5408\u5e76\u72b6\u6001\u4e3a `succeeded`\n- **\u5206\u652f\uff1a** `dependabot/npm_and_yarn/sample%2Fextensions%2Fcommon-extensions%2FReverseSelection/brace-expansion-1.1.18-749879` \u2192 `main`\n- **\u521b\u5efa\u65f6\u95f4\uff1a** 2026-08-07 09:45:17\n- **\u53d8\u66f4\u7edf\u8ba1\uff1a** 1 \u4e2a\u6587\u4ef6\u30011 \u4e2a\u63d0\u4ea4\u30011 \u4e2a\u8fed\u4ee3\uff1b\u6839\u636e\u5b8c\u6574\u5dee\u5f02\u8ba1\u6570\u4e3a 6 \u884c\u65b0\u589e\u30016 \u884c\u5220\u9664\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n4. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027)\n5. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n6. [\u5dee\u5f02\u8986\u76d6\u8303\u56f4](#\u5dee\u5f02\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u6b64 PR \u7531 Dependabot \u521b\u5efa\uff0c\u76ee\u6807\u662f\u89e3\u51b3 Component Governance \u6807\u8bb0\u7684\u4e24\u4e2a\u9ad8\u5371\u544a\u8b66\uff1aCVE-2026-13149 \u548c CVE-2026-14257\u3002\u5b9e\u9645\u4ee3\u7801\u53d8\u66f4\u4ec5\u4f4d\u4e8e [sample/extensions/common-extensions/ReverseSelection/package-lock.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767497?path=/sample/extensions/common-extensions/ReverseSelection/package-lock.json&_a=files)\u3002\n\n\u9501\u6587\u4ef6\u4e2d\u7684 `brace-expansion` \u4ece 1.1.11 \u5347\u7ea7\u4e3a 1.1.18\u3002\u5305\u5185\u9644\u5e26\u7684\u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u660e\u786e\u63d0\u5230 1.1.12 \u4fee\u590d\u4e86\u6f5c\u5728 ReDoS\uff08\u6b63\u5219\u8868\u8fbe\u5f0f\u62d2\u7edd\u670d\u52a1\uff09\u6216\u4f4e\u6548\u6b63\u5219\u8868\u8fbe\u5f0f\u95ee\u9898\uff1b\u4e0d\u8fc7\uff0c\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u4e24\u4e2a CVE \u4e0e\u5177\u4f53\u4e0a\u6e38\u63d0\u4ea4\u4e4b\u95f4\u7684\u9010\u9879\u6620\u5c04\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u6bcf\u4e2a CVE \u5206\u522b\u7531\u54ea\u4e2a\u63d0\u4ea4\u4fee\u590d\u3002\n\n## \u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n**\u4e3a\u4ec0\u4e48\u8981\u6539\uff1a** \u65e7\u7248\u672c `brace-expansion` 1.1.11 \u89e6\u53d1\u4e86\u4e24\u4e2a\u9ad8\u5371\u7ec4\u4ef6\u6cbb\u7406\u544a\u8b66\u3002\u8be5\u5e93\u8d1f\u8d23\u89e3\u6790\u548c\u5c55\u5f00\u7c7b\u4f3c `{a,b}`\u3001`{1..3}` \u7684 brace \u8868\u8fbe\u5f0f\uff1b\u6b64\u7c7b\u89e3\u6790\u903b\u8f91\u82e5\u5bf9\u7279\u5236\u8f93\u5165\u4f7f\u7528\u4f4e\u6548\u6b63\u5219\u8868\u8fbe\u5f0f\uff0c\u53ef\u80fd\u4ea7\u751f\u8fc7\u9ad8\u7684 CPU \u6d88\u8017\u3002\n\n**\u5982\u4f55\u751f\u6548\uff1a** \u9501\u6587\u4ef6\u540c\u65f6\u66f4\u65b0\u4e86 npm \u65b0\u5f0f `node_modules/brace-expansion` \u6761\u76ee\u548c\u65e7\u5f0f\u4f9d\u8d56\u6620\u5c04\u4e2d\u7684 `brace-expansion` \u6761\u76ee\uff0c\u4f7f\u4e24\u79cd\u9501\u6587\u4ef6\u8868\u793a\u90fd\u6307\u5411 1.1.18\u3002\u540e\u7eed\u4f7f\u7528\u8be5\u9501\u6587\u4ef6\u6267\u884c\u786e\u5b9a\u6027\u5b89\u88c5\u65f6\uff0c\u5305\u7ba1\u7406\u5668\u4f1a\u83b7\u53d6\u65b0\u7248\u672c\uff0c\u800c\u4e0d\u662f\u7ee7\u7eed\u5b89\u88c5 1.1.11\u3002\n\n### 2. \u9501\u6587\u4ef6\u89e3\u6790\u4e0e\u6784\u5efa\u53ef\u91cd\u590d\u6027\n\n\u5347\u7ea7\u540c\u6b65\u4fee\u6539\u4e86\u4e09\u9879\u5b89\u88c5\u5143\u6570\u636e\uff1a\n\n- `version`\uff1a\u4ece 1.1.11 \u6539\u4e3a 1.1.18\u3002\n- `resolved`\uff1a\u4ecd\u4f7f\u7528\u5185\u90e8 `AzureNotebooksEntry` npm \u6e90\uff0c\u4f46\u4e0b\u8f7d\u76ee\u6807\u6539\u4e3a 1.1.18 \u7684 tarball\u3002\n- `integrity`\uff1a\u66f4\u65b0\u4e3a\u65b0 tarball \u5bf9\u5e94\u7684\u5b8c\u6574\u6027\u6458\u8981\uff0c\u4f9b npm \u5728\u5b89\u88c5\u65f6\u6821\u9a8c\u4e0b\u8f7d\u5185\u5bb9\u3002\n\n`dev: true`\u3001MIT \u8bb8\u53ef\u8bc1\u4fe1\u606f\u4ee5\u53ca\u5bf9 `balanced-match` \u7684\u4f9d\u8d56\u8981\u6c42\u5747\u672a\u6539\u53d8\u3002\u8fd9\u8bf4\u660e\u672c\u6b21\u53d8\u66f4\u6ca1\u6709\u628a\u8be5\u5305\u4ece\u5f00\u53d1\u4f9d\u8d56\u63d0\u5347\u4e3a\u751f\u4ea7\u4f9d\u8d56\uff0c\u4e5f\u6ca1\u6709\u5728\u53ef\u89c1\u5dee\u5f02\u4e2d\u6539\u53d8\u5176\u76f4\u63a5\u4f9d\u8d56\u7ed3\u6784\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n| \u5f71\u54cd\u9762 | \u5206\u6790 |\n|---|---|\n| \u5b89\u5168\u6027 | \u4e3b\u8981\u6536\u76ca\u662f\u79fb\u9664\u88ab\u7ec4\u4ef6\u6cbb\u7406\u6807\u8bb0\u7684 1.1.11\uff0c\u5e76\u91c7\u7528\u5305\u542b\u4e0a\u6e38\u5b89\u5168\u4fee\u590d\u7684 1.1.18\u3002 |\n| \u8fd0\u884c\u65f6 | \u9501\u6587\u4ef6\u5c06\u8be5\u5305\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u56e0\u6b64\u76f4\u63a5\u751f\u4ea7\u8fd0\u884c\u65f6\u5f71\u54cd\u9884\u8ba1\u6709\u9650\uff1b\u4f46\u5206\u6790\u5305\u672a\u63d0\u4f9b\u5b8c\u6574\u4f9d\u8d56\u6811\u8c03\u7528\u8def\u5f84\uff0c\u4e0d\u80fd\u786e\u8ba4\u5b83\u4ec5\u5728\u6d4b\u8bd5\u6216\u6784\u5efa\u9636\u6bb5\u6267\u884c\u3002 |\n| \u6784\u5efa\u4e0e\u5f00\u53d1\u5de5\u5177 | \u4efb\u4f55\u901a\u8fc7\u9501\u6587\u4ef6\u6062\u590d ReverseSelection \u4f9d\u8d56\u7684\u5b89\u88c5\u3001\u6784\u5efa\u6216\u6d4b\u8bd5\u6d41\u7a0b\u90fd\u4f1a\u4f7f\u7528 1.1.18\u3002 |\n| \u4f9d\u8d56\u6765\u6e90 | \u4ecd\u4ece\u73b0\u6709\u5185\u90e8 Azure Artifacts \u6e90\u4e0b\u8f7d\uff0c\u6ca1\u6709\u5f15\u5165\u65b0\u7684\u5916\u90e8\u6ce8\u518c\u8868\u3002 |\n| \u4ee3\u7801\u4e0e API | \u6ca1\u6709\u5e94\u7528\u4ee3\u7801\u3001\u6269\u5c55\u6e05\u5355\u6216\u516c\u5f00 API \u53d8\u66f4\uff1b\u53ef\u89c1\u53d8\u66f4\u53ea\u6d89\u53ca\u89e3\u6790\u540e\u7684\u4f9d\u8d56\u7248\u672c\u548c\u6821\u9a8c\u5143\u6570\u636e\u3002 |\n| \u5ba1\u67e5\u8303\u56f4 | \u5355\u6587\u4ef6\u3001\u5355\u5305\u3001\u540c\u4e00 1.x \u7cfb\u5217\u5185\u5347\u7ea7\uff0c\u6574\u4f53\u53d8\u66f4\u9762\u8f83\u5c0f\u3002 |\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\n\n1. **brace \u5c55\u5f00\u884c\u4e3a\u53d8\u5316\uff1a** \u5c3d\u7ba1\u662f 1.x \u5185\u7684\u5c0f\u7248\u672c\u5347\u7ea7\uff0c\u5b89\u5168\u4fee\u590d\u53ef\u80fd\u8c03\u6574\u5bf9\u5f02\u5e38\u3001\u8d85\u957f\u6216\u6076\u610f brace \u8868\u8fbe\u5f0f\u7684\u5904\u7406\u65b9\u5f0f\u3002\u82e5 ReverseSelection \u7684\u6784\u5efa\u5de5\u5177\u94fe\u95f4\u63a5\u4f9d\u8d56\u65e7\u7248\u672c\u5728\u8fb9\u754c\u8f93\u5165\u4e0a\u7684\u884c\u4e3a\uff0c\u53ef\u80fd\u51fa\u73b0\u8f93\u51fa\u6216\u6027\u80fd\u5dee\u5f02\u3002\n2. **\u4f20\u9012\u4f9d\u8d56\u517c\u5bb9\u6027\uff1a** PR \u6ca1\u6709\u4fee\u6539 `package.json`\uff0c\u8bf4\u660e `brace-expansion` \u5f88\u53ef\u80fd\u662f\u4f20\u9012\u4f9d\u8d56\u6216\u4ec5\u7531\u9501\u6587\u4ef6\u7ea6\u675f\u3002\u9501\u6587\u4ef6\u80fd\u56fa\u5b9a\u5b89\u88c5\u7ed3\u679c\uff0c\u4f46\u4e0a\u6e38\u8c03\u7528\u8005\u4e0e 1.1.18 \u7684\u5b9e\u9645\u517c\u5bb9\u6027\u4ecd\u9700\u901a\u8fc7\u5b89\u88c5\u548c\u6784\u5efa\u9a8c\u8bc1\u3002\n3. **\u5b8c\u6574\u6027\u6458\u8981\u683c\u5f0f\u53d8\u5316\uff1a** `integrity` \u4ece SHA-512 \u683c\u5f0f\u53d8\u4e3a SHA-1 \u683c\u5f0f\u3002\u8be5\u503c\u5e94\u5f53\u662f\u53d1\u5e03\u5305\u5143\u6570\u636e\u6240\u5bf9\u5e94\u7684\u6821\u9a8c\u503c\uff0cnpm \u901a\u5e38\u53ef\u6b63\u5e38\u8bc6\u522b\uff1b\u4f46 SHA-1 \u7684\u6297\u78b0\u649e\u80fd\u529b\u5f31\u4e8e SHA-512\uff0c\u4e14\u90e8\u5206\u4e25\u683c\u4f9b\u5e94\u94fe\u7b56\u7565\u53ef\u80fd\u62d2\u7edd\u8f83\u5f31\u6458\u8981\uff0c\u56e0\u6b64\u5e94\u786e\u8ba4\u5f53\u524d npm \u7248\u672c\u548c\u7ec4\u7ec7\u7b56\u7565\u5141\u8bb8\u8be5\u683c\u5f0f\u3002\n4. **\u5185\u90e8\u6e90\u53ef\u7528\u6027\uff1a** \u5b89\u88c5\u4f9d\u8d56\u4e8e\u5185\u90e8\u6e90\u4e2d\u5b58\u5728\u5e76\u53ef\u8bbf\u95ee `brace-expansion` 1.1.18 tarball\u3002\u82e5\u5305\u5c1a\u672a\u540c\u6b65\u3001\u6743\u9650\u4e0d\u8db3\u6216\u6e90\u7f13\u5b58\u5f02\u5e38\uff0c\u786e\u5b9a\u6027\u5b89\u88c5\u4f1a\u5931\u8d25\u3002\n5. **\u544a\u8b66\u5173\u95ed\u4f9d\u8d56\u626b\u63cf\u7ed3\u679c\uff1a** \u7248\u672c\u5347\u7ea7\u610f\u56fe\u660e\u786e\uff0c\u4f46\u5206\u6790\u5305\u672a\u5305\u542b Component Governance \u7684\u91cd\u65b0\u626b\u63cf\u7ed3\u679c\uff0c\u4e0d\u80fd\u786e\u8ba4\u4e24\u4e2a\u544a\u8b66\u5df2\u7ecf\u5728\u5e73\u53f0\u4fa7\u5173\u95ed\u3002\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\u3001\u6d41\u6c34\u7ebf\u7ed3\u679c\u3001\u6784\u5efa\u65e5\u5fd7\u6216\u4eba\u5de5\u9a8c\u8bc1\u8bb0\u5f55\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u73b0\u6709\u6d4b\u8bd5\u5df2\u7ecf\u8986\u76d6\u6216\u901a\u8fc7\u3002\u5efa\u8bae\u81f3\u5c11\u6267\u884c\uff1a\n\n1. \u5728 `sample/extensions/common-extensions/ReverseSelection` \u4e0b\u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 Node.js/npm \u7248\u672c\u8fdb\u884c\u9501\u6587\u4ef6\u5b89\u88c5\uff08\u4f18\u5148\u4f7f\u7528 `npm ci`\uff09\uff0c\u786e\u8ba4\u5185\u90e8\u6e90\u4e0b\u8f7d\u4e0e\u5b8c\u6574\u6027\u6821\u9a8c\u6210\u529f\u3002\n2. \u8fd0\u884c\u8be5\u6269\u5c55\u73b0\u6709\u7684\u6784\u5efa\u3001lint \u548c\u6d4b\u8bd5\u547d\u4ee4\uff0c\u786e\u8ba4\u4f20\u9012\u4f9d\u8d56\u5347\u7ea7\u6ca1\u6709\u5f71\u54cd\u6253\u5305\u6216\u5f00\u53d1\u5de5\u5177\u94fe\u3002\n3. \u82e5\u9879\u76ee\u76f4\u63a5\u6216\u95f4\u63a5\u5904\u7406 brace/glob \u6a21\u5f0f\uff0c\u8865\u5145\u6216\u8fd0\u884c\u6b63\u5e38\u6a21\u5f0f\u3001\u5d4c\u5957\u6a21\u5f0f\u3001\u8d85\u957f\u8f93\u5165\u53ca\u6076\u610f\u8f93\u5165\u7528\u4f8b\uff0c\u786e\u8ba4\u7ed3\u679c\u517c\u5bb9\u4e14\u4e0d\u5b58\u5728\u660e\u663e\u6027\u80fd\u56de\u9000\u3002\n4. \u5728\u5408\u5e76\u524d\u786e\u8ba4 Component Governance \u91cd\u65b0\u626b\u63cf\u540e\uff0cCVE-2026-13149 \u4e0e CVE-2026-14257 \u5bf9\u5e94\u544a\u8b66\u5747\u5df2\u6d88\u9664\u3002\n\n## \u5dee\u5f02\u8986\u76d6\u8303\u56f4\n\n\u5206\u6790\u5305\u58f0\u660e\uff1a\n\n- `diffTruncated: false`\n- \u552f\u4e00\u6587\u4ef6\u5dee\u5f02\u7684 `truncated: false`\n- \u5dee\u5f02\u63d0\u53d6\u65b9\u5f0f\u4e3a `git-local`\n- \u65e0\u5bfc\u51fa\u9519\u8bef\u6216\u8b66\u544a\n\n\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u5185\u63d0\u4f9b\u7684\u5168\u90e8\u6587\u4ef6\u5dee\u5f02\uff1a\u4ec5 [sample/extensions/common-extensions/ReverseSelection/package-lock.json](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767497?path=/sample/extensions/common-extensions/ReverseSelection/package-lock.json&_a=files)\u3002PR \u63cf\u8ff0\u672c\u8eab\u5728\u5206\u6790\u5305\u4e2d\u4ee5\u622a\u65ad\u6587\u672c\u7ed3\u5c3e\uff0c\u56e0\u6b64\u672c\u8bf4\u660e\u6ca1\u6709\u5206\u6790\u6216\u5f15\u7528\u5176\u88ab\u622a\u65ad\u90e8\u5206\uff0c\u4e5f\u6ca1\u6709\u636e\u6b64\u63a8\u65ad\u989d\u5916\u53d1\u5e03\u8bf4\u660e\u3001\u63d0\u4ea4\u5185\u5bb9\u6216\u9a8c\u8bc1\u7ed3\u8bba\u3002\n", "creation_timestamp": "2026-08-30T16:29:34.727092Z"}, {"uuid": "80fbc3fe-84ce-4bb4-b485-68c506b05744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpiqqalrc32y", "content": "CVE-2026-13149 - brace-expansion Denial of Service\nCVE ID : CVE-2026-13149\n \n Published : June 30, 2026, 8:30 a.m. | 1\u00a0hour, 15\u00a0minutes ago\n \n Description : brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time comple...", "creation_timestamp": "2026-06-30T10:02:33.032630Z"}, {"uuid": "88c3ac68-0757-4b74-b802-46604ae7b7b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/alon710/8cb13493a0f92ed662f2d6291bd0d794", "content": "# CVE-2026-13149: CVE-2026-13149: Algorithmic Complexity Denial of Service in brace-expansion\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-13149\n\n## Summary\nCVE-2026-13149 is a highly severe algorithmic complexity vulnerability in the brace-expansion Node.js library prior to version 5.0.7. When parsing consecutive non-expanding brace groups, the library exhibits exponential-time complexity, leading to process-level Denial of Service in single-threaded runtimes.\n\n## TL;DR\nAn algorithmic complexity flaw in brace-expansion prior to version 5.0.7 allows unauthenticated remote attackers to trigger an exponential-time O(2^n) execution path using short, crafted strings, causing complete thread starvation and Denial of Service in Node.js applications.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407 (Inefficient Algorithmic Complexity)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0**: 7.7 (High)\n- **EPSS Score**: 0.00361\n- **Impact**: Denial of Service (Thread Starvation)\n- **Exploit Status**: Proof of Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications running brace-expansion <= 1.1.15\n- Node.js applications running brace-expansion versions 2.0.0 through 2.1.1\n- Node.js applications running brace-expansion versions 3.0.0 through 5.0.6\n- Downstream packages consuming vulnerable versions of minimatch or glob\n- **brace-expansion**: < 1.1.16 (Fixed in: `1.1.16`)\n- **brace-expansion**: >= 2.0.0 < 2.1.2 (Fixed in: `2.1.2`)\n- **brace-expansion**: >= 3.0.0 <= 5.0.6 (Fixed in: `5.0.7`)\n\n## Mitigation\n\n- Upgrade brace-expansion library to patched versions 1.1.16, 2.1.2, or 5.0.7.\n- Implement dependency overrides in package.json to resolve transitive sub-dependencies.\n- Deploy input-validation filters to reject consecutive non-expanding brace groups.\n- Apply Web Application Firewall (WAF) regex patterns to drop exploitation payloads at the network edge.\n\n**Remediation Steps:**\n1. Scan the codebase with 'npm ls brace-expansion' to locate affected instances.\n2. Add a 'resolutions' or 'overrides' block in your package.json pointing 'brace-expansion' to '^5.0.7' (or appropriate backported versions).\n3. Run your package manager install command ('npm install' or 'yarn install') to rebuild the dependency tree.\n4. Verify the application event-loop behavior using the 30-group proof-of-concept payload in a test environment.\n\n## References\n\n- [GitHub Security Advisory GHSA-3jxr-9vmj-r5cp](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp)\n- [NVD CVE-2026-13149 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-13149)\n- [CVE.org CVE-2026-13149 Record](https://www.cve.org/CVERecord?id=CVE-2026-13149)\n- [NPM brace-expansion Package Homepage](https://www.npmjs.com/package/brace-expansion)\n- [Upstream Git Repository](https://github.com/juliangruber/brace-expansion)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-13149) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-20T21:31:31.996864Z"}, {"uuid": "92cef96e-9e02-410a-bb6b-a47a428c30ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-13149", "type": "published-proof-of-concept", "source": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp", "content": "", "creation_timestamp": "2026-07-20T22:37:51.543651Z"}, {"uuid": "3d6687cf-98ec-4590-9bfa-aa68ffaa6b59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/djlan/4e47cd0e6c9ac9925a6efe5c077883fe", "content": "# [SECURITY] \u66f4\u65b0 `/sample/react-host-app` \u4e2d\u7684 `brace-expansion`\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0 React Host App \u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u4e24\u6761\u4f20\u9012\u4f9d\u8d56\u94fe\u4e2d\u7684 `brace-expansion` \u5206\u522b\u4ece `1.1.11` \u5347\u7ea7\u5230 `1.1.18`\u3001\u4ece `2.0.1` \u5347\u7ea7\u5230 `2.1.4`\uff0c\u4ee5\u5904\u7406 Component Governance \u62a5\u544a\u7684\u4e24\u4e2a\u9ad8\u5371\u5b89\u5168\u544a\u8b66\u3002\n\n| \u9879\u76ee | \u4fe1\u606f |\n|---|---|\n| PR | [767496](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767496) |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | Active\uff0c\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001\u4e3a Succeeded |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Freact-host-app/brace-expansion-1.1.18-749884` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-08-07 09:45:17 |\n| \u53d8\u66f4\u7edf\u8ba1 | 1 \u4e2a\u6587\u4ef6\u30011 \u4e2a\u63d0\u4ea4\u30011 \u4e2a\u8fed\u4ee3\uff1b\u53ef\u89c1\u5dee\u5f02\u7ea6 `+6 / -6` \u884c |\n| \u5b89\u5168\u80cc\u666f | CG Alert 15400181\uff08CVE-2026-13149\uff09\u4e0e CG Alert 15766343\uff08CVE-2026-14257\uff09\uff0c\u5747\u6807\u8bb0\u4e3a High |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u5de5\u4f5c\u539f\u7406](#\u5de5\u4f5c\u539f\u7406)\n4. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n5. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027)\n6. [\u6d4b\u8bd5\u5efa\u8bae\u4e0e\u73b0\u6709\u8bc1\u636e](#\u6d4b\u8bd5\u5efa\u8bae\u4e0e\u73b0\u6709\u8bc1\u636e)\n7. [\u5dee\u5f02\u8986\u76d6\u8303\u56f4](#\u5dee\u5f02\u8986\u76d6\u8303\u56f4)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u6b64 PR \u6ca1\u6709\u4fee\u6539\u5e94\u7528\u6e90\u7801\u3001\u6784\u5efa\u811a\u672c\u6216\u4f9d\u8d56\u58f0\u660e\u6587\u4ef6\uff0c\u800c\u662f\u66f4\u65b0 [`sample/react-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767496?path=/sample/react-host-app/package-lock.json&_a=files) \u4e2d\u5df2\u7ecf\u89e3\u6790\u597d\u7684\u4f20\u9012\u4f9d\u8d56\u7248\u672c\u3001\u5185\u90e8 npm \u6e90\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u6821\u9a8c\u503c\u3002\n\n\u9501\u6587\u4ef6\u4e2d\u5b58\u5728\u4e24\u4efd\u5904\u4e8e\u4e0d\u540c\u4f9d\u8d56\u5c42\u7ea7\u3001\u4e0d\u540c\u4e3b\u7248\u672c\u7ebf\u7684 `brace-expansion`\uff1a\n\n| \u4f9d\u8d56\u4f4d\u7f6e | \u539f\u7248\u672c | \u65b0\u7248\u672c | \u6027\u8d28 |\n|---|---:|---:|---|\n| \u9876\u5c42 `node_modules/brace-expansion` | `1.1.11` | `1.1.18` | \u5f00\u53d1\u4f9d\u8d56\u94fe\u4e2d\u7684 1.x \u7248\u672c |\n| `node_modules/filelist/node_modules/brace-expansion` | `2.0.1` | `2.1.4` | `filelist` \u79c1\u6709\u4f9d\u8d56\u6811\u4e2d\u7684 2.x \u7248\u672c |\n\n\u4e24\u4e2a\u7248\u672c\u5206\u522b\u5728\u5404\u81ea\u7684\u4e3b\u7248\u672c\u8303\u56f4\u5185\u5347\u7ea7\uff0c\u907f\u514d\u628a\u4f9d\u8d56\u94fe\u5f3a\u884c\u7edf\u4e00\u5230\u4e0d\u517c\u5bb9\u7684\u4e3b\u7248\u672c\uff0c\u540c\u65f6\u8986\u76d6\u540c\u4e00\u9501\u6587\u4ef6\u5185\u7684\u4e24\u4efd\u6613\u53d7\u5f71\u54cd\u7ec4\u4ef6\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. React Host App \u4f9d\u8d56\u9501\u5b9a\n\n\u53d8\u66f4\u96c6\u4e2d\u5728 [`sample/react-host-app/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/767496?path=/sample/react-host-app/package-lock.json&_a=files)\u3002\n\n- `brace-expansion` 1.x \u6761\u76ee\u5347\u7ea7\u5230 `1.1.18`\u3002\n- `filelist` \u5d4c\u5957\u4f9d\u8d56\u4e2d\u7684 `brace-expansion` 2.x \u6761\u76ee\u5347\u7ea7\u5230 `2.1.4`\u3002\n- \u4e24\u4e2a\u6761\u76ee\u7684 `resolved` \u5730\u5740\u540c\u6b65\u6307\u5411 Azure DevOps \u5185\u90e8\u5305\u6e90\u4e2d\u7684\u65b0 tarball\u3002\n- \u4e24\u4e2a\u6761\u76ee\u7684 `integrity` \u503c\u540c\u6b65\u66f4\u65b0\uff0c\u4f7f npm \u80fd\u9a8c\u8bc1\u65b0\u5305\u5185\u5bb9\u3002\n- `dev: true` \u548c\u73b0\u6709\u4f9d\u8d56\u5173\u7cfb\u4fdd\u6301\u4e0d\u53d8\uff0c\u56e0\u6b64\u4ece\u9501\u6587\u4ef6\u53ef\u89c1\u4fe1\u606f\u5224\u65ad\uff0c\u8be5\u7ec4\u4ef6\u4ecd\u53ea\u4f4d\u4e8e\u5f00\u53d1\u4f9d\u8d56\u8def\u5f84\uff0c\u4e0d\u4f1a\u56e0\u4e3a\u672c\u6b21\u53d8\u66f4\u88ab\u76f4\u63a5\u63d0\u5347\u4e3a\u751f\u4ea7\u4f9d\u8d56\u3002\n\n### 2. \u5b89\u5168\u4fee\u590d\n\nPR \u63cf\u8ff0\u5c06\u6b64\u5347\u7ea7\u5173\u8054\u5230\u4e24\u4e2a\u9ad8\u5371 Component Governance \u544a\u8b66\uff1aCVE-2026-13149 \u548c CVE-2026-14257\u3002`brace-expansion` \u7528\u4e8e\u5c55\u5f00\u82b1\u62ec\u53f7\u8868\u8fbe\u5f0f\uff1bPR \u63d0\u4f9b\u7684\u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u660e\u786e\u63d0\u5230 1.x \u7248\u672c\u5305\u542b\u9488\u5bf9\u6f5c\u5728 ReDoS \u6216\u4f4e\u6548\u6b63\u5219\u8868\u8fbe\u5f0f\u95ee\u9898\u7684\u4fee\u590d\u3002\n\n\u6b64 PR \u7684\u76ee\u7684\u4e0d\u662f\u6539\u53d8 React Host App \u7684\u4e1a\u52a1\u884c\u4e3a\uff0c\u800c\u662f\u8ba9\u540e\u7eed\u57fa\u4e8e\u9501\u6587\u4ef6\u7684 npm \u5b89\u88c5\u89e3\u6790\u5230\u4fee\u590d\u540e\u7684\u8865\u4e01/\u6b21\u7248\u672c\uff0c\u964d\u4f4e\u6076\u610f\u6216\u6781\u7aef\u6a21\u5f0f\u8f93\u5165\u9020\u6210\u8fc7\u91cf CPU \u6d88\u8017\u7684\u98ce\u9669\u3002\n\n## \u5de5\u4f5c\u539f\u7406\n\n1. npm \u5728\u6267\u884c\u786e\u5b9a\u6027\u5b89\u88c5\uff08\u4f8b\u5982 `npm ci`\uff09\u65f6\u8bfb\u53d6\u9501\u6587\u4ef6\uff0c\u800c\u4e0d\u662f\u91cd\u65b0\u81ea\u7531\u9009\u62e9\u6ee1\u8db3\u7248\u672c\u8303\u56f4\u7684\u4efb\u610f\u7248\u672c\u3002\n2. \u66f4\u65b0\u540e\u7684\u9501\u6587\u4ef6\u8981\u6c42 npm \u4e0b\u8f7d `brace-expansion@1.1.18` \u548c\u5d4c\u5957\u7684 `brace-expansion@2.1.4`\u3002\n3. `resolved` \u5b57\u6bb5\u7ee7\u7eed\u4f7f\u7528\u73b0\u6709 Azure DevOps \u5185\u90e8 registry\uff0c\u672a\u6539\u53d8\u5305\u5206\u53d1\u6e20\u9053\u3002\n4. npm \u4f7f\u7528\u65b0\u7684 `integrity` \u503c\u9a8c\u8bc1\u4e0b\u8f7d\u5185\u5bb9\uff0c\u907f\u514d\u65b0\u7248\u672c\u5730\u5740\u4e0e\u65e7\u7248\u672c\u54c8\u5e0c\u4e0d\u5339\u914d\u3002\n5. \u4e24\u6761\u4f9d\u8d56\u94fe\u4fdd\u7559\u5404\u81ea\u7684 1.x/2.x \u4e3b\u7248\u672c\uff0c\u56e0\u6b64\u4fee\u590d\u901a\u8fc7\u540c\u4e3b\u7248\u672c\u5185\u5347\u7ea7\u843d\u5730\uff0c\u517c\u5bb9\u6027\u98ce\u9669\u4f4e\u4e8e\u8de8\u4e3b\u7248\u672c\u66ff\u6362\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u6b63\u9762\u5f71\u54cd\n\n- \u5904\u7406 PR \u63cf\u8ff0\u4e2d\u5217\u51fa\u7684\u4e24\u4e2a\u9ad8\u5371\u5f00\u6e90\u7ec4\u4ef6\u544a\u8b66\u3002\n- \u56fa\u5b9a\u5b89\u5168\u7248\u672c\uff0c\u4f7f\u672c\u5730\u5f00\u53d1\u3001CI \u548c\u5176\u4ed6\u4f7f\u7528\u9501\u6587\u4ef6\u7684\u73af\u5883\u83b7\u5f97\u4e00\u81f4\u4f9d\u8d56\u7ed3\u679c\u3002\n- \u4e0d\u6d89\u53ca\u4e1a\u52a1\u6e90\u7801\u6216\u516c\u5f00 API\uff0c\u9884\u671f\u4e0d\u4f1a\u6539\u53d8\u4ea7\u54c1\u529f\u80fd\u3002\n- \u4e0d\u6539\u53d8\u5185\u90e8 npm \u6e90\uff0c\u73b0\u6709\u5236\u54c1\u83b7\u53d6\u4e0e\u5408\u89c4\u8def\u5f84\u4fdd\u6301\u4e00\u81f4\u3002\n\n### \u5f71\u54cd\u8303\u56f4\n\n- \u76f4\u63a5\u5f71\u54cd `/sample/react-host-app` \u7684\u4f9d\u8d56\u5b89\u88c5\u7ed3\u679c\u3002\n- \u4e3b\u8981\u5f71\u54cd\u5f00\u53d1\u3001\u6784\u5efa\u6216\u6d4b\u8bd5\u5de5\u5177\u94fe\uff0c\u56e0\u4e3a\u4e24\u4e2a\u6761\u76ee\u5747\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\u3002\n- \u5305\u5206\u6790\u6750\u6599\u6ca1\u6709\u63d0\u4f9b\u5b9e\u9645\u8c03\u7528\u8def\u5f84\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u54ea\u4e9b\u5177\u4f53\u547d\u4ee4\u6216\u6784\u5efa\u9636\u6bb5\u4f1a\u6267\u884c `brace-expansion`\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\n\n| \u98ce\u9669/\u5173\u6ce8\u70b9 | \u5177\u4f53\u8bf4\u660e | \u5efa\u8bae |\n|---|---|---|\n| \u4f20\u9012\u4f9d\u8d56\u884c\u4e3a\u53d8\u5316 | \u5373\u4f7f\u672a\u8de8\u4e3b\u7248\u672c\uff0c\u8865\u4e01\u548c\u6b21\u7248\u672c\u4ecd\u53ef\u80fd\u6539\u53d8\u8fb9\u754c\u8f93\u5165\u3001\u9519\u8bef\u5904\u7406\u6216\u8868\u8fbe\u5f0f\u5c55\u5f00\u7ed3\u679c\u3002 | \u8fd0\u884c React Host App \u7684\u73b0\u6709\u6784\u5efa\u4e0e\u6d4b\u8bd5\uff0c\u91cd\u70b9\u8986\u76d6\u4f7f\u7528 glob\u3001\u6587\u4ef6\u5217\u8868\u6216\u82b1\u62ec\u53f7\u8868\u8fbe\u5f0f\u7684\u5de5\u5177\u3002 |\n| \u53cc\u7248\u672c\u5171\u5b58 | \u4f9d\u8d56\u6811\u4ecd\u540c\u65f6\u5305\u542b 1.x \u4e0e 2.x\uff1b\u8fd9\u662f\u7531\u4e0d\u540c\u7236\u4f9d\u8d56\u8981\u6c42\u9020\u6210\u7684\u6b63\u5e38\u5d4c\u5957\uff0c\u4f46\u5b89\u5168\u626b\u63cf\u5fc5\u987b\u786e\u8ba4\u4e24\u4e2a\u65b0\u7248\u672c\u90fd\u4e0d\u518d\u89e6\u53d1\u76ee\u6807\u544a\u8b66\u3002 | \u91cd\u65b0\u8fd0\u884c Component Governance/\u4f9d\u8d56\u626b\u63cf\uff0c\u5e76\u68c0\u67e5\u9501\u6587\u4ef6\u89e3\u6790\u7ed3\u679c\u3002 |\n| \u5185\u90e8\u6e90\u53ef\u7528\u6027 | \u65b0\u7684 `resolved` URL \u6307\u5411\u5185\u90e8 Azure DevOps \u5305\u6e90\uff1b\u82e5\u955c\u50cf\u5c1a\u672a\u540c\u6b65\u6216\u6743\u9650\u914d\u7f6e\u5f02\u5e38\uff0c`npm ci` \u4f1a\u5931\u8d25\u3002 | \u5728\u4e0e CI \u76f8\u540c\u51ed\u636e\u548c registry \u914d\u7f6e\u4e0b\u6267\u884c\u4e00\u6b21\u5e72\u51c0\u5b89\u88c5\u3002 |\n| \u5b8c\u6574\u6027\u6821\u9a8c | \u54c8\u5e0c\u503c\u5df2\u968f\u7248\u672c\u66f4\u65b0\uff1b\u4efb\u4f55\u4ee3\u7406\u7f13\u5b58\u6216\u5236\u54c1\u5185\u5bb9\u4e0d\u4e00\u81f4\u90fd\u4f1a\u8868\u73b0\u4e3a integrity \u9519\u8bef\u3002 | \u4f7f\u7528\u7a7a npm \u7f13\u5b58\u6216\u5e72\u51c0\u4ee3\u7406\u73af\u5883\u9a8c\u8bc1\u5b89\u88c5\u3002 |\n| Node/npm \u517c\u5bb9\u6027 | \u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b\u9879\u76ee\u4f7f\u7528\u7684 Node.js/npm \u7248\u672c\uff0c\u4e5f\u6ca1\u6709\u63d0\u4f9b\u65b0\u4f9d\u8d56\u7684 engines \u4fe1\u606f\u3002 | \u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 Node.js/npm \u7248\u672c\u6267\u884c\u9a8c\u8bc1\uff0c\u4e0d\u80fd\u4ec5\u4f9d\u636e\u9501\u6587\u4ef6\u65ad\u8a00\u6240\u6709\u8fd0\u884c\u65f6\u7248\u672c\u5747\u517c\u5bb9\u3002 |\n| \u9501\u6587\u4ef6\u4e0e\u6e05\u5355\u4e00\u81f4\u6027 | \u672c\u6b21\u53ea\u770b\u5230 `package-lock.json` \u53d8\u5316\uff1b\u4f20\u9012\u4f9d\u8d56\u5347\u7ea7\u901a\u5e38\u53ef\u4ee5\u53ea\u6539\u9501\u6587\u4ef6\uff0c\u4f46\u4ecd\u9700\u786e\u8ba4\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u4e0d\u4f1a\u4ea7\u751f\u989d\u5916\u6f02\u79fb\u3002 | \u5728\u76f8\u540c npm \u7248\u672c\u4e0b\u91cd\u65b0\u751f\u6210\u6216\u6267\u884c `npm install --package-lock-only`\uff0c\u786e\u8ba4\u6ca1\u6709\u610f\u5916\u5dee\u5f02\u3002 |\n\n## \u6d4b\u8bd5\u5efa\u8bae\u4e0e\u73b0\u6709\u8bc1\u636e\n\n\u5206\u6790\u5305\u4e2d**\u6ca1\u6709\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\u3001\u6d4b\u8bd5\u8fd0\u884c\u7ed3\u679c\u6216\u6784\u5efa\u65e5\u5fd7**\uff0c\u56e0\u6b64\u4e0d\u80fd\u58f0\u79f0\u6b64 PR \u5df2\u901a\u8fc7 React Host App \u7684\u5b89\u88c5\u3001\u6784\u5efa\u6216\u6d4b\u8bd5\u3002\n\n\u5efa\u8bae\u81f3\u5c11\u9a8c\u8bc1\uff1a\n\n1. \u5728 `/sample/react-host-app` \u4e2d\u6267\u884c\u5e72\u51c0\u7684 `npm ci`\uff0c\u786e\u8ba4\u5185\u90e8\u6e90\u4e0b\u8f7d\u4e0e integrity \u6821\u9a8c\u6210\u529f\u3002\n2. \u8fd0\u884c\u8be5\u793a\u4f8b\u73b0\u6709\u7684\u6784\u5efa\u3001\u5355\u5143\u6d4b\u8bd5\u548c lint \u547d\u4ee4\uff0c\u786e\u8ba4\u5de5\u5177\u94fe\u884c\u4e3a\u672a\u56de\u5f52\u3002\n3. \u68c0\u67e5\u5b9e\u9645\u5b89\u88c5\u6811\uff0c\u786e\u8ba4\u4e24\u5904 `brace-expansion` \u5206\u522b\u89e3\u6790\u4e3a `1.1.18` \u548c `2.1.4`\u3002\n4. \u91cd\u65b0\u8fd0\u884c Component Governance \u6216\u7b49\u6548\u4f9d\u8d56\u626b\u63cf\uff0c\u786e\u8ba4\u4e24\u4e2a\u76ee\u6807\u544a\u8b66\u88ab\u5173\u95ed\uff0c\u4e14\u6ca1\u6709\u5f15\u5165\u65b0\u7684\u5df2\u77e5\u6f0f\u6d1e\u3002\n5. \u5982\u9879\u76ee\u5b58\u5728 glob/\u6587\u4ef6\u679a\u4e3e\u76f8\u5173\u6d4b\u8bd5\uff0c\u52a0\u5165\u6216\u6267\u884c\u5305\u542b\u6df1\u5c42\u5d4c\u5957\u82b1\u62ec\u53f7\u3001\u8d85\u957f\u8f93\u5165\u53ca\u5f02\u5e38\u8868\u8fbe\u5f0f\u7684\u7528\u4f8b\uff0c\u4ee5\u8986\u76d6\u6b64\u6b21\u5b89\u5168\u4fee\u590d\u6700\u76f8\u5173\u7684\u8fb9\u754c\u3002\n\n## \u5dee\u5f02\u8986\u76d6\u8303\u56f4\n\n- \u5206\u6790\u5305\u58f0\u660e\u672c PR \u5171\u53d8\u66f4 1 \u4e2a\u6587\u4ef6\uff0c\u5305\u5185\u4e5f\u63d0\u4f9b\u4e86\u8be5\u6587\u4ef6\u7684\u5dee\u5f02\u3002\n- \u6587\u4ef6\u7ea7 `truncated` \u4e3a `false`\uff0c\u5168\u5c40 `diffTruncated` \u4e5f\u4e3a `false`\uff1b\u56e0\u6b64\u5305\u4e2d\u62a5\u544a\u7684\u552f\u4e00\u6587\u4ef6\u5dee\u5f02\u672a\u88ab\u622a\u65ad\u3002\n- PR \u63cf\u8ff0\u6587\u672c\u672c\u8eab\u5728\u5bfc\u51fa\u5305\u4e2d\u4ee5\u7701\u7565\u53f7\u7ed3\u5c3e\uff0c\u8868\u793a\u5176\u4e0a\u6e38\u63d0\u4ea4\u5217\u8868\u7b49\u63cf\u8ff0\u5185\u5bb9\u6ca1\u6709\u5b8c\u6574\u6536\u5f55\uff1b\u672c\u8bf4\u660e\u672a\u636e\u6b64\u63a8\u65ad\u7f3a\u5931\u7684\u53d1\u5e03\u8bf4\u660e\u6216\u63d0\u4ea4\u7ec6\u8282\u3002\n- \u5206\u6790\u4ec5\u8986\u76d6\u5305\u4e2d\u63d0\u4f9b\u7684\u9501\u6587\u4ef6\u5dee\u5f02\u548c\u5143\u6570\u636e\u3002\u7531\u4e8e\u6ca1\u6709\u6e90\u7801\u8c03\u7528\u94fe\u3001\u5b8c\u6574\u4f9d\u8d56\u6e05\u5355\u3001\u6d41\u6c34\u7ebf\u7ed3\u679c\u6216\u5b89\u5168\u626b\u63cf\u590d\u68c0\u7ed3\u679c\uff0c\u672c\u8bf4\u660e\u4e0d\u5bf9\u8fd9\u4e9b\u7f3a\u5931\u5185\u5bb9\u4f5c\u5df2\u9a8c\u8bc1\u7ed3\u8bba\u3002\n", "creation_timestamp": "2026-08-31T00:04:37.349996Z"}, {"uuid": "bcecf167-5d90-44a3-bbec-92bb375f6860", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmlbm2c24", "content": "\n\ud83d\udea8 New HIGH CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-13149 impacts brace-expansion in 3 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/626\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-07-22T12:01:09.387002Z"}, {"uuid": "0aff0715-a674-4bf9-89a8-ab769af255c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/djlan/743daa778bbfdc3d824ba9bb99839c6f", "content": "# [SECURITY][SFI] \u4fee\u590d brace-expansion \u6f0f\u6d1e\uff08CVE-2026-13149\uff09\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u5728\u4e09\u4e2a npm \u9879\u76ee\u4e2d\u901a\u8fc7 `overrides`\uff08\u793a\u4f8b\u9879\u76ee\u540c\u65f6\u4f7f\u7528 `resolutions`\uff09\u5f3a\u5236\u5c06\u4f20\u9012\u4f9d\u8d56 `brace-expansion` \u7684 2.x \u548c 5.x \u5206\u652f\u56fa\u5b9a\u5230\u5df2\u4fee\u590d\u7248\u672c\uff0c\u5e76\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\uff1b\u4f46 NotebookExtensions \u7684\u9501\u6587\u4ef6\u8fd8\u5305\u542b\u5927\u91cf\u53ef\u89c1\u7684\u4f34\u968f\u4f9d\u8d56\u53d8\u66f4\uff0c\u4e14\u5176\u5dee\u5f02\u5728\u5206\u6790\u5305\u4e2d\u88ab\u622a\u65ad\uff0c\u9700\u8981\u91cd\u70b9\u590d\u6838\u3002\n\n| \u9879\u76ee | \u4fe1\u606f |\n|---|---|\n| PR | [766454](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454) |\n| \u4f5c\u8005 | Agency |\n| \u72b6\u6001 | Active\uff0c\u975e\u8349\u7a3f\uff1b\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u5206\u652f | `copilot/api-690bd71d-4a5b24c4` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-08-05 09:49:58\uff08\u5206\u6790\u5305\u539f\u59cb\u65f6\u95f4\u683c\u5f0f\uff09 |\n| \u63d0\u4ea4 | 1 |\n| \u8fed\u4ee3 | 2 |\n| \u6587\u4ef6\u53d8\u66f4 | 6 \u4e2a\u6587\u4ef6\uff0c\u5168\u90e8\u4e3a\u7f16\u8f91 |\n| \u5dee\u5f02\u7edf\u8ba1 | \u5206\u6790\u5305\u8bb0\u5f55\u603b\u5dee\u5f02 77,622 \u5b57\u8282\uff1b\u672a\u63d0\u4f9b\u53ef\u9760\u7684\u65b0\u589e/\u5220\u9664\u884c\u6570 |\n| \u8986\u76d6\u72b6\u6001 | 5 \u4e2a\u6587\u4ef6\u5dee\u5f02\u5b8c\u6574\uff1b1 \u4e2a\u6587\u4ef6\u5dee\u5f02\u88ab\u622a\u65ad\uff0c\u56e0\u6b64\u6574\u4f53 `diffTruncated=true` |\n\n## \u76ee\u5f55\n\n- [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n- [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n  - [\u793a\u4f8b\u8f93\u51fa\u6e32\u67d3\u5668](#1-\u793a\u4f8b\u8f93\u51fa\u6e32\u67d3\u5668)\n  - [Web \u5ba2\u6237\u7aef](#2-web-\u5ba2\u6237\u7aef)\n  - [NotebookExtensions \u670d\u52a1\u4e0e\u6269\u5c55\u5de5\u4f5c\u533a](#3-notebookextensions-\u670d\u52a1\u4e0e\u6269\u5c55\u5de5\u4f5c\u533a)\n- [\u5b9e\u73b0\u673a\u5236](#\u5b9e\u73b0\u673a\u5236)\n- [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1)\n- [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n- [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8)\n- [\u5dee\u5f02\u8986\u76d6\u8303\u56f4\u4e0e\u9650\u5236](#\u5dee\u5f02\u8986\u76d6\u8303\u56f4\u4e0e\u9650\u5236)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u8be5 PR \u9488\u5bf9 npm \u4f20\u9012\u4f9d\u8d56 `brace-expansion` \u7684 Component Governance \u5b89\u5168\u544a\u8b66\u3002PR \u63cf\u8ff0\u5217\u51fa 6 \u4e2a\u544a\u8b66\uff0c\u6d89\u53ca CVE-2026-13149 \u548c CVE-2026-14257\uff0c\u76ee\u6807\u7248\u672c\u4e3a\uff1a\n\n- `brace-expansion` 2.x \u2192 `2.1.3`\n- `brace-expansion` 5.x \u2192 `5.0.8`\n\n\u53d8\u66f4\u6ca1\u6709\u4fee\u6539\u4e1a\u52a1 TypeScript/JavaScript \u6e90\u7801\uff0c\u800c\u662f\u5728\u4e09\u4e2a\u72ec\u7acb npm \u4f9d\u8d56\u6811\u7684\u9876\u5c42\u6e05\u5355\u4e2d\u589e\u52a0\u7248\u672c\u8986\u76d6\u89c4\u5219\uff0c\u5e76\u66f4\u65b0\u5bf9\u5e94\u9501\u6587\u4ef6\uff0c\u4f7f\u5b89\u88c5\u5668\u4e0d\u518d\u4ec5\u4f9d\u8d56\u4e0a\u6e38\u5305\u58f0\u660e\u7684\u5bbd\u6cdb semver \u8303\u56f4\u6765\u9009\u62e9\u6613\u53d7\u5f71\u54cd\u7248\u672c\u3002\n\n\u6d89\u53ca\u6587\u4ef6\uff1a\n\n| \u6a21\u5757 | \u6e05\u5355\u6587\u4ef6 | \u9501\u6587\u4ef6 |\n|---|---|---|\n| \u793a\u4f8b\u8f93\u51fa\u6e32\u67d3\u5668 | [`sample/aznb-helloworld-output-renderer/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package.json&_a=files) | [`sample/aznb-helloworld-output-renderer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package-lock.json&_a=files) |\n| Web \u5ba2\u6237\u7aef | [`src/client/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package.json&_a=files) | [`src/client/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package-lock.json&_a=files) |\n| NotebookExtensions | [`src/service/aznb/NotebookExtensions/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package.json&_a=files) | [`src/service/aznb/NotebookExtensions/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package-lock.json&_a=files) |\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u793a\u4f8b\u8f93\u51fa\u6e32\u67d3\u5668\n\n\u5728 [`package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package.json&_a=files) \u4e2d\uff0c\u73b0\u6709\u7684 `resolutions` \u548c `overrides` \u90fd\u65b0\u589e\u4e86 `brace-expansion@2 = 2.1.3`\u3002\n\n**\u4e3a\u4ec0\u4e48\u540c\u65f6\u4fee\u6539\u4e24\u5904\uff1a**\n\n- `overrides` \u662f npm \u539f\u751f\u7684\u4f20\u9012\u4f9d\u8d56\u8986\u76d6\u673a\u5236\u3002\n- \u8be5\u9879\u76ee\u539f\u672c\u5df2\u540c\u65f6\u7ef4\u62a4 `resolutions`\uff0c\u56e0\u6b64\u540c\u6b65\u6dfb\u52a0\u540c\u4e00\u89c4\u5219\u53ef\u4fdd\u6301\u73b0\u6709\u5305\u7ba1\u7406\u7ea6\u5b9a\u4e00\u81f4\uff0c\u5e76\u964d\u4f4e\u4f7f\u7528\u4e0d\u540c\u5b89\u88c5\u5de5\u5177\u65f6\u89e3\u6790\u7ed3\u679c\u5206\u53c9\u7684\u53ef\u80fd\u6027\u3002\n\n\u5bf9\u5e94\u7684 [`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package-lock.json&_a=files) \u5c06\u53ef\u89c1\u7684 `brace-expansion` \u4ece `2.0.1` \u66f4\u65b0\u5230 `2.1.3`\uff0c\u540c\u65f6\u66f4\u65b0\u4e0b\u8f7d\u5730\u5740\u3001\u5b8c\u6574\u6027\u54c8\u5e0c\u548c\u8bb8\u53ef\u8bc1\u5143\u6570\u636e\uff1b\u4f9d\u8d56\u5b83\u7684\u82e5\u5e72\u9501\u6587\u4ef6\u8282\u70b9\u4e5f\u4ece\u8303\u56f4\u58f0\u660e\u6536\u7d27\u4e3a `2.1.3`\u3002\u6b64\u5916\uff0c\u9501\u6587\u4ef6\u4e2d\u51fa\u73b0\u4e86\u82e5\u5e72\u7a7a `requires` \u5bf9\u8c61\u7b49\u5e8f\u5217\u5316\u53d8\u5316\uff0c\u8fd9\u4e9b\u770b\u8d77\u6765\u662f\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u4ea7\u751f\u7684\u5143\u6570\u636e\u566a\u58f0\uff0c\u800c\u975e\u4e1a\u52a1\u884c\u4e3a\u4fee\u6539\u3002\n\n### 2. Web \u5ba2\u6237\u7aef\n\n\u5728 [`src/client/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package.json&_a=files) \u7684\u73b0\u6709 `overrides` \u4e2d\u540c\u65f6\u52a0\u5165\uff1a\n\n- `brace-expansion@2 = 2.1.3`\n- `brace-expansion@5 = 5.0.8`\n\n\u8fd9\u8868\u793a\u5ba2\u6237\u7aef\u4f9d\u8d56\u6811\u540c\u65f6\u5b58\u5728 2.x \u548c 5.x \u4e24\u6761\u4f20\u9012\u4f9d\u8d56\u94fe\uff0c\u9700\u8981\u5206\u522b\u8986\u76d6\uff0c\u4e0d\u80fd\u7528\u5355\u4e00\u7248\u672c\u66ff\u6362\u6240\u6709\u4e3b\u7248\u672c\u3002\n\n\u5bf9\u5e94\u7684 [`src/client/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package-lock.json&_a=files) \u4e2d\uff0c\u53ef\u89c1\u7684\u9876\u5c42 5.x \u8282\u70b9\u4ece `5.0.3` \u66f4\u65b0\u5230 `5.0.8`\uff0c`filelist` \u4e0b\u5d4c\u5957\u7684 2.x \u8282\u70b9\u4ece `2.0.2` \u66f4\u65b0\u5230 `2.1.3`\u3002\u9501\u6587\u4ef6\u8fd8\u663e\u793a\uff1a\n\n- `brace-expansion@5.0.8` \u7684 Node \u5f15\u64ce\u8981\u6c42\u53d8\u4e3a `20 || >=22`\uff0c\u4e0d\u518d\u5305\u542b Node 18\u3002\n- \u591a\u4e2a\u53ef\u9009\u539f\u751f\u5305\u548c\u8f85\u52a9\u5305\u7684 `dev` / `devOptional` \u6807\u8bb0\u53d1\u751f\u53d8\u5316\u3002\n\n\u8fd9\u4e9b\u53d8\u5316\u8bf4\u660e\u9501\u6587\u4ef6\u786e\u5b9e\u7ecf\u8fc7\u91cd\u65b0\u89e3\u6790\uff1b\u5b89\u5168\u7248\u672c\u5df2\u88ab\u9501\u5b9a\uff0c\u4f46 Node \u8fd0\u884c\u65f6\u517c\u5bb9\u6027\u548c\u751f\u4ea7\u4f9d\u8d56\u88c1\u526a\u884c\u4e3a\u9700\u8981\u7ed3\u5408\u9879\u76ee\u5b9e\u9645\u5b89\u88c5\u73af\u5883\u68c0\u67e5\u3002\n\n### 3. NotebookExtensions \u670d\u52a1\u4e0e\u6269\u5c55\u5de5\u4f5c\u533a\n\n\u5728 [`src/service/aznb/NotebookExtensions/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package.json&_a=files) \u7684 `overrides` \u4e2d\u52a0\u5165 2.x \u4e0e 5.x \u4e24\u6761\u56fa\u5b9a\u89c4\u5219\uff0c\u4e0e\u5ba2\u6237\u7aef\u7b56\u7565\u4e00\u81f4\u3002\n\n\u8be5\u6a21\u5757\u7684 [`package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package-lock.json&_a=files) \u662f\u672c PR \u98ce\u9669\u6700\u9ad8\u7684\u90e8\u5206\u3002\u5206\u6790\u5305\u4e2d\u53ef\u89c1\u7684\u5185\u5bb9\u4e0d\u53ea\u662f `brace-expansion`\uff1a\n\n- \u591a\u4e2a\u5185\u90e8 workspace \u5305\u7248\u672c\u4ece `1.7.8-dev.20260531.1` \u53d8\u4e3a `1.7.9-dev.20260624.1`\uff0c\u5185\u90e8\u4f9d\u8d56\u5f15\u7528\u4e5f\u540c\u6b65\u53d8\u5316\u3002\n- \u5927\u91cf Babel\u3001ESLint\u3001API Extractor\u3001TypeScript \u53ca\u5176\u4ed6\u5de5\u5177\u94fe\u5305\u53d1\u751f\u5347\u7ea7\u3001\u964d\u7ea7\u3001\u53bb\u91cd\u6216\u91cd\u65b0\u5e03\u5c40\u3002\n- \u4e00\u4e9b\u5d4c\u5957\u4f9d\u8d56\u8282\u70b9\u88ab\u5220\u9664\uff0c\u53e6\u4e00\u4e9b 1.x `brace-expansion` \u8282\u70b9\u88ab\u91cd\u65b0\u5f15\u5165\u5230\u7279\u5b9a\u65e7\u7248 `minimatch` \u4f9d\u8d56\u6811\u4e2d\u3002\n- \u53ef\u89c1\u7684\u82e5\u5e72\u5305\u63d0\u9ad8\u4e86 Node \u5f15\u64ce\u8981\u6c42\uff0c\u4f8b\u5982\u90e8\u5206\u5de5\u5177\u94fe\u4f9d\u8d56\u8981\u6c42 Node 20 \u7684\u8f83\u65b0\u7248\u672c\u3002\n\n\u8fd9\u8868\u660e\u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u65f6\uff0c\u4f9d\u8d56\u6811\u53d7\u5230\u5f53\u524d\u6e05\u5355\u3001workspace \u72b6\u6001\u3001npm \u7248\u672c\u6216\u89e3\u6790\u73af\u5883\u5f71\u54cd\uff0c\u4ea7\u751f\u4e86\u8fdc\u8d85\u4e24\u6761\u5b89\u5168\u8986\u76d6\u89c4\u5219\u7684\u53d8\u5316\u3002\u7531\u4e8e\u8be5\u6587\u4ef6\u5dee\u5f02\u88ab\u622a\u65ad\uff0c\u65e0\u6cd5\u4ece\u5206\u6790\u5305\u786e\u8ba4\u6240\u6709\u6700\u7ec8\u7248\u672c\u3001\u6240\u6709\u65b0\u589e/\u5220\u9664\u8282\u70b9\u4ee5\u53ca\u5b8c\u6574\u7684\u5b89\u5168\u4fee\u590d\u8986\u76d6\u60c5\u51b5\u3002\n\n## \u5b9e\u73b0\u673a\u5236\n\n\u6b64\u6b21\u4fee\u6539\u4f9d\u8d56 npm \u7684\u9876\u5c42\u8986\u76d6\u673a\u5236\u5de5\u4f5c\uff1a\n\n1. \u4e0a\u6e38\u5de5\u5177\u5305\uff08\u4f8b\u5982 `minimatch`\u3001`glob`\u3001`rimraf`\u3001`filelist` \u4ee5\u53ca PR \u63cf\u8ff0\u4e2d\u5217\u51fa\u7684\u5176\u4ed6\u5de5\u5177\u94fe\uff09\u95f4\u63a5\u58f0\u660e\u5bf9 `brace-expansion` \u7684\u4f9d\u8d56\u3002\n2. \u9879\u76ee\u9876\u5c42 `package.json` \u7528\u5e26\u4e3b\u7248\u672c\u9009\u62e9\u5668\u7684\u8986\u76d6\u89c4\u5219\uff0c\u5c06 2.x \u548c 5.x \u5206\u522b\u7ea6\u675f\u5230\u4fee\u590d\u7248\u672c\u3002\n3. \u91cd\u65b0\u751f\u6210\u7684 `package-lock.json` \u8bb0\u5f55\u5b9e\u9645\u89e3\u6790\u540e\u7684\u7cbe\u786e\u7248\u672c\u3001\u5305\u5730\u5740\u548c\u5b8c\u6574\u6027\u54c8\u5e0c\u3002\n4. \u540e\u7eed\u4f7f\u7528\u9501\u6587\u4ef6\u5b89\u88c5\u65f6\uff0cnpm \u5e94\u590d\u7528\u8be5\u89e3\u6790\u7ed3\u679c\uff0c\u4ece\u800c\u907f\u514d\u91cd\u65b0\u9009\u62e9\u88ab\u544a\u8b66\u7248\u672c\u3002\n\n\u6309\u4e3b\u7248\u672c\u5206\u522b\u8986\u76d6\u662f\u5fc5\u8981\u7684\uff1a2.x \u4e0e 5.x \u5177\u6709\u4e0d\u540c\u4f9d\u8d56\u548c\u8fd0\u884c\u65f6\u7ea6\u675f\uff0c\u5f3a\u884c\u7edf\u4e00\u6210\u4e00\u4e2a\u4e3b\u7248\u672c\u53ef\u80fd\u7834\u574f\u8c03\u7528\u65b9\u517c\u5bb9\u6027\u3002\u6b64\u6b21\u505a\u6cd5\u4fdd\u7559\u4e3b\u7248\u672c\u8fb9\u754c\uff0c\u53ea\u5728\u5404\u81ea\u5206\u652f\u5185\u5347\u7ea7\u5230\u4fee\u590d\u7248\u672c\uff0c\u539f\u5219\u4e0a\u6bd4\u8de8\u4e3b\u7248\u672c\u66ff\u6362\u66f4\u5b89\u5168\u3002\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\n\n\u5206\u6790\u5305\u4e2d\u6ca1\u6709\u6d4b\u8bd5\u4ee3\u7801\u53d8\u66f4\uff0c\u4e5f\u6ca1\u6709\u5305\u542b\u6d41\u6c34\u7ebf\u8fd0\u884c\u8bb0\u5f55\u6216\u6d4b\u8bd5\u65e5\u5fd7\u3002\n\nPR \u63cf\u8ff0\u58f0\u79f0\u4e09\u4e2a\u9501\u6587\u4ef6\u5df2\u91cd\u65b0\u751f\u6210\u5e76\u4f7f\u7528 `npm ci` \u9a8c\u8bc1\uff0c\u4f46\u63cf\u8ff0\u7684\u201cVerification\u201d\u8868\u683c\u5728\u5305\u5185\u6587\u672c\u4e2d\u9014\u5f02\u5e38\u4e2d\u65ad\uff0c\u56e0\u6b64\u53ea\u80fd\u786e\u8ba4\u5b58\u5728\u8fd9\u9879\u58f0\u660e\uff0c\u4e0d\u80fd\u4ece\u672c\u5206\u6790\u5305\u72ec\u7acb\u786e\u8ba4\uff1a\n\n- \u6bcf\u4e2a\u76ee\u5f55\u662f\u5426\u90fd\u6267\u884c\u4e86 `npm ci`\uff1b\n- \u4f7f\u7528\u7684 npm \u4e0e Node \u7248\u672c\uff1b\n- \u6784\u5efa\u3001\u5355\u5143\u6d4b\u8bd5\u3001\u96c6\u6210\u6d4b\u8bd5\u6216\u7aef\u5230\u7aef\u6d4b\u8bd5\u662f\u5426\u901a\u8fc7\uff1b\n- Component Governance \u662f\u5426\u5df2\u91cd\u65b0\u626b\u63cf\u5e76\u5173\u95ed\u5168\u90e8 6 \u4e2a\u544a\u8b66\u3002\n\n\u5efa\u8bae\u8bc4\u5ba1\u65f6\u81f3\u5c11\u6838\u5bf9\u4e09\u4e2a\u76ee\u5f55\u7684\u5e72\u51c0\u73af\u5883\u5b89\u88c5\u7ed3\u679c\uff0c\u5e76\u5bf9 NotebookExtensions \u8fd0\u884c\u5176\u73b0\u6709\u6784\u5efa\u548c\u6d4b\u8bd5\u6d41\u7a0b\uff1b\u540c\u65f6\u786e\u8ba4\u5b89\u5168\u626b\u63cf\u7ed3\u679c\u786e\u5b9e\u4e0d\u518d\u62a5\u544a\u76ee\u6807 2.x/5.x \u8282\u70b9\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u5b89\u5168\u5f71\u54cd\n\n\u76ee\u6807\u662f\u6d88\u9664\u4e24\u4e2a\u53d7\u5f71\u54cd\u4e3b\u7248\u672c\u4e2d\u7684\u5df2\u77e5\u6f0f\u6d1e\u8282\u70b9\u3002\u8986\u76d6\u89c4\u5219\u4f4d\u4e8e\u9876\u5c42\uff0c\u53ef\u4f5c\u7528\u4e8e\u591a\u6761\u4f20\u9012\u4f9d\u8d56\u8def\u5f84\uff0c\u907f\u514d\u9010\u4e2a\u5347\u7ea7\u6240\u6709\u76f4\u63a5\u4f9d\u8d56\uff0c\u9002\u5408\u7d27\u6025\u5b89\u5168\u4fee\u590d\u3002\n\n### \u8fd0\u884c\u65f6\u4e0e\u4ea7\u54c1\u884c\u4e3a\n\nPR \u6ca1\u6709\u76f4\u63a5\u4fee\u6539\u4ea7\u54c1\u4ee3\u7801\u3002`brace-expansion` \u4e3b\u8981\u7531\u6587\u4ef6\u5339\u914d\u3001glob\u3001\u6e05\u7406\u3001\u6784\u5efa\u548c\u5305\u7ba1\u7406\u5de5\u5177\u94fe\u95f4\u63a5\u4f7f\u7528\uff0c\u56e0\u6b64\u9884\u671f\u4e3b\u8981\u5f71\u54cd\u5f00\u53d1\u3001\u6784\u5efa\u3001\u6d4b\u8bd5\u548c\u5b89\u88c5\u6d41\u7a0b\u3002\u4e0d\u8fc7\uff0c\u5982\u679c\u67d0\u6761\u751f\u4ea7\u4f9d\u8d56\u8def\u5f84\u5728\u8fd0\u884c\u65f6\u4f7f\u7528 glob/\u6a21\u5f0f\u5c55\u5f00\uff0c\u56fa\u5b9a\u7248\u672c\u4ecd\u53ef\u80fd\u6539\u53d8\u8fb9\u754c\u8f93\u5165\u7684\u5339\u914d\u884c\u4e3a\uff0c\u4e0d\u80fd\u4ec5\u56e0\u5176\u662f\u4f20\u9012\u4f9d\u8d56\u5c31\u65ad\u8a00\u5b8c\u5168\u6ca1\u6709\u8fd0\u884c\u65f6\u5f71\u54cd\u3002\n\n### \u6784\u5efa\u4e0e\u5f00\u53d1\u73af\u5883\n\n\u5ba2\u6237\u7aef\u53ef\u89c1\u7684 `brace-expansion@5.0.8` \u8981\u6c42 Node 20 \u6216\u66f4\u9ad8\u7248\u672c\uff08\u5141\u8bb8 >=22\uff09\u3002NotebookExtensions \u7684\u53ef\u89c1\u9501\u6587\u4ef6\u53d8\u5316\u8fd8\u5f15\u5165\u4e86\u5176\u4ed6\u66f4\u9ad8 Node \u5f15\u64ce\u8981\u6c42\u7684\u5de5\u5177\u5305\u3002\u56e0\u6b64\uff0c\u4ecd\u4f7f\u7528 Node 18 \u6216\u8f83\u65e7 Node 20 \u5c0f\u7248\u672c\u7684\u672c\u5730\u73af\u5883\u3001CI \u4ee3\u7406\u6216\u53d1\u5e03\u6784\u5efa\u53ef\u80fd\u9047\u5230\u5f15\u64ce\u8b66\u544a\u6216\u5b89\u88c5\u5931\u8d25\u3002\n\n### \u4f9d\u8d56\u53ef\u91cd\u590d\u6027\n\n\u63d0\u4ea4\u66f4\u65b0\u540e\u7684\u9501\u6587\u4ef6\u6709\u52a9\u4e8e\u786e\u4fdd\u540e\u7eed\u5b89\u88c5\u5f97\u5230\u56fa\u5b9a\u7684\u5b89\u5168\u7248\u672c\u3002\u4f46 NotebookExtensions \u9501\u6587\u4ef6\u7684\u5927\u8303\u56f4\u6f02\u79fb\u964d\u4f4e\u4e86\u6b64\u6b21\u5b89\u5168\u4fee\u590d\u7684\u53ef\u5ba1\u8ba1\u6027\uff0c\u4e5f\u6269\u5927\u4e86\u53ef\u91cd\u590d\u6027\u53d8\u5316\u7684\u8303\u56f4\uff1a\u5373\u4f7f\u5b89\u5168\u8986\u76d6\u672c\u8eab\u6b63\u786e\uff0c\u5176\u4ed6\u5de5\u5177\u94fe\u5347\u7ea7\u4e5f\u53ef\u80fd\u6539\u53d8\u7f16\u8bd1\u8f93\u51fa\u3001lint \u89c4\u5219\u3001API \u62bd\u53d6\u7ed3\u679c\u6216\u6d4b\u8bd5\u884c\u4e3a\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\u5173\u6ce8\n\n| \u98ce\u9669 | \u5177\u4f53\u4f9d\u636e | \u5efa\u8bae\u5173\u6ce8 |\n|---|---|---|\n| NotebookExtensions \u9501\u6587\u4ef6\u53d1\u751f\u975e\u76ee\u6807\u4f9d\u8d56\u6f02\u79fb | \u53ef\u89c1\u5dee\u5f02\u5305\u542b workspace \u7248\u672c\u3001Babel\u3001ESLint\u3001API Extractor\u3001TypeScript \u7b49\u5927\u91cf\u53d8\u5316 | \u5224\u65ad\u8fd9\u4e9b\u53d8\u5316\u662f\u5426\u9884\u671f\uff1b\u82e5\u4e0d\u662f\uff0c\u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 Node/npm \u7248\u672c\u91cd\u65b0\u751f\u6210\u6700\u5c0f\u9501\u6587\u4ef6 |\n| Node 18 \u517c\u5bb9\u6027 | \u5ba2\u6237\u7aef\u9501\u6587\u4ef6\u4e2d `brace-expansion@5.0.8` \u7684\u5f15\u64ce\u8981\u6c42\u4e3a Node 20 \u6216 >=22\uff1bNotebookExtensions \u53ef\u89c1\u5de5\u5177\u94fe\u4e5f\u6709\u66f4\u9ad8\u8981\u6c42 | \u6838\u5bf9\u6240\u6709 CI\u3001\u5f00\u53d1\u673a\u548c\u53d1\u5e03\u4ee3\u7406\u7684 Node \u7248\u672c |\n| \u9501\u6587\u4ef6\u8bed\u4e49\u6807\u8bb0\u53d8\u5316 | \u5ba2\u6237\u7aef\u51fa\u73b0 `devOptional` \u2192 `dev`\uff0c\u591a\u4e2a\u53ef\u9009\u5305\u65b0\u589e `dev` \u6807\u8bb0 | \u9a8c\u8bc1\u751f\u4ea7\u5b89\u88c5\u3001`npm ci --omit=dev` \u6216\u7c7b\u4f3c\u88c1\u526a\u6d41\u7a0b\u6ca1\u6709\u9057\u6f0f/\u989d\u5916\u643a\u5e26\u4f9d\u8d56 |\n| npm/Yarn \u89e3\u6790\u4e00\u81f4\u6027 | \u793a\u4f8b\u9879\u76ee\u540c\u65f6\u7ef4\u62a4 `resolutions` \u4e0e `overrides`\uff0c\u53e6\u5916\u4e24\u4e2a\u9879\u76ee\u53ea\u4f7f\u7528 `overrides` | \u786e\u8ba4\u5404\u76ee\u5f55\u5b9e\u9645\u4f7f\u7528\u7684\u5305\u7ba1\u7406\u5668\u4e0e\u4ed3\u5e93\u7ea6\u5b9a\u4e00\u81f4 |\n| \u8986\u76d6\u89c4\u5219\u53ef\u80fd\u5f71\u54cd\u6240\u6709\u540c\u4e3b\u7248\u672c\u8c03\u7528\u65b9 | \u9876\u5c42\u89c4\u5219\u4f1a\u7edf\u4e00\u66ff\u6362\u4f9d\u8d56\u6811\u4e2d\u76f8\u5e94\u4e3b\u7248\u672c | \u8fd0\u884c glob\u3001\u6e05\u7406\u3001lint\u3001\u6253\u5305\u53ca\u76f8\u5173\u6d4b\u8bd5\uff0c\u5173\u6ce8\u6a21\u5f0f\u5c55\u5f00\u8fb9\u754c\u884c\u4e3a |\n| 1.x \u8282\u70b9\u4ecd\u5b58\u5728 | NotebookExtensions \u53ef\u89c1\u5dee\u5f02\u5305\u542b `brace-expansion@1.1.18` | PR \u63cf\u8ff0\u79f0 1.x \u4e0d\u5728\u544a\u8b66\u8303\u56f4\uff1b\u5e94\u4ee5 Component Governance \u626b\u63cf\u7ed3\u679c\u786e\u8ba4\uff0c\u800c\u975e\u5047\u8bbe\u6240\u6709 `brace-expansion` \u90fd\u5df2\u6d88\u5931 |\n| \u5b89\u5168\u4fee\u590d\u8986\u76d6\u65e0\u6cd5\u4ece\u622a\u65ad\u5dee\u5f02\u5b8c\u6574\u8bc1\u660e | \u6700\u5927\u6587\u4ef6\u5dee\u5f02\u88ab\u622a\u65ad | \u5728 Azure DevOps \u5b8c\u6574\u6587\u4ef6\u89c6\u56fe\u4e2d\u6838\u67e5\u6240\u6709 2.x/5.x \u8282\u70b9\u53ca\u6700\u7ec8\u89e3\u6790\u7248\u672c |\n\n## \u5dee\u5f02\u8986\u76d6\u8303\u56f4\u4e0e\u9650\u5236\n\n\u5206\u6790\u5305\u5217\u51fa\u7684 6 \u4e2a\u53d8\u66f4\u6587\u4ef6\u5747\u6709\u5dee\u5f02\u8bb0\u5f55\uff0c\u5176\u4e2d\u4ee5\u4e0b 5 \u4e2a\u6587\u4ef6\u7684\u5dee\u5f02\u6807\u8bb0\u4e3a\u5b8c\u6574\uff1a\n\n- [`sample/aznb-helloworld-output-renderer/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package.json&_a=files)\n- [`sample/aznb-helloworld-output-renderer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/sample/aznb-helloworld-output-renderer/package-lock.json&_a=files)\n- [`src/client/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package.json&_a=files)\n- [`src/client/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/client/package-lock.json&_a=files)\n- [`src/service/aznb/NotebookExtensions/package.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package.json&_a=files)\n\n[`src/service/aznb/NotebookExtensions/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766454?path=/src/service/aznb/NotebookExtensions/package-lock.json&_a=files) \u7684\u539f\u59cb\u5dee\u5f02\u7ea6 322,703 \u5b57\u8282\uff0c\u4f46\u5206\u6790\u5305\u4ec5\u4fdd\u7559\u4e86\u53d7\u5355\u6587\u4ef6\u4e0a\u9650\u7ea6\u675f\u7684\u4e00\u90e8\u5206\uff0c\u5e76\u660e\u786e\u6807\u8bb0 `truncated=true`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u53ea\u8ba8\u8bba\u622a\u65ad\u524d\u5b9e\u9645\u53ef\u89c1\u7684\u53d8\u66f4\uff0c\u672a\u5bf9\u8be5\u9501\u6587\u4ef6\u672a\u5305\u542b\u90e8\u5206\u7684\u5177\u4f53\u5305\u7248\u672c\u3001\u4f9d\u8d56\u5173\u7cfb\u3001\u5b89\u5168\u72b6\u6001\u6216\u517c\u5bb9\u6027\u4f5c\u51fa\u7ed3\u8bba\u3002\n\n\u6b64\u5916\uff0c\u5305\u5185\u6ca1\u6709\u9519\u8bef\u6216\u8b66\u544a\u8bb0\u5f55\uff0c\u4f46\u8fd9\u53ea\u8868\u793a\u5bfc\u51fa\u8fc7\u7a0b\u672a\u62a5\u544a\u9519\u8bef\uff0c\u4e0d\u7b49\u540c\u4e8e PR \u6784\u5efa\u3001\u6d4b\u8bd5\u6216\u5b89\u5168\u626b\u63cf\u5747\u5df2\u901a\u8fc7\u3002\n", "creation_timestamp": "2026-08-31T16:11:35.445529Z"}, {"uuid": "5d2140f0-3475-4ac1-bd7a-20788e379fdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/djlan/34664e5b040495766cc5c696521f5a4f", "content": "# PR 766449 \u4e2d\u6587\u8bf4\u660e\uff1a\u5347\u7ea7 `brace-expansion` \u4ee5\u5904\u7406\u5b89\u5168\u544a\u8b66\n\n> **\u4e00\u53e5\u8bdd\u6458\u8981\uff1a** \u6b64 PR \u4ec5\u66f4\u65b0\u793a\u4f8b\u8f93\u51fa\u6e32\u67d3\u5668\u7684 npm \u9501\u6587\u4ef6\uff0c\u5c06\u4e24\u6761\u4f20\u9012\u4f9d\u8d56\u94fe\u4e2d\u7684 `brace-expansion` \u5206\u522b\u4ece 1.1.11 \u5347\u7ea7\u5230 1.1.18\u3001\u4ece 2.0.1 \u5347\u7ea7\u5230 2.1.4\uff0c\u4ee5\u54cd\u5e94 Component Governance \u62a5\u544a\u7684 CVE-2026-13149 \u9ad8\u5371\u5b89\u5168\u544a\u8b66\uff0c\u540c\u65f6\u91cd\u65b0\u6574\u7406\u90e8\u5206\u91cd\u590d\u7684\u9501\u6587\u4ef6\u4f9d\u8d56\u8bb0\u5f55\u3002\n\n| \u9879\u76ee | \u5185\u5bb9 |\n|---|---|\n| PR | [766449](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766449) |\n| \u539f\u59cb\u6807\u9898 | `[SECURITY] Bump brace-expansion in /sample/aznb-helloworld-output-renderer` |\n| \u4f5c\u8005 | Dependabot |\n| \u72b6\u6001 | Active\uff0c\u975e Draft\uff1b\u5305\u4e2d\u8bb0\u5f55\u7684\u5408\u5e76\u72b6\u6001\u4e3a `succeeded` |\n| \u5206\u652f | `dependabot/npm_and_yarn/sample%2Faznb-helloworld-output-renderer/brace-expansion-1.1.18-749289` \u2192 `main` |\n| \u521b\u5efa\u65f6\u95f4 | 2026-08-05 09:43:44\uff08\u5206\u6790\u5305\u539f\u59cb\u65f6\u95f4\u683c\u5f0f\u672a\u6ce8\u660e\u65f6\u533a\uff09 |\n| \u63d0\u4ea4 / \u8fed\u4ee3 | 1 \u4e2a\u63d0\u4ea4\uff0c1 \u4e2a\u8fed\u4ee3 |\n| \u53d8\u66f4\u7edf\u8ba1 | 1 \u4e2a\u6587\u4ef6\uff1b\u65b0\u589e 29 \u884c\u3001\u5220\u9664 64 \u884c\u3001\u51c0\u51cf\u5c11 35 \u884c\uff1b\u5dee\u5f02\u6570\u636e 9,407 \u5b57\u8282 |\n| \u53d8\u66f4\u6587\u4ef6 | [`sample/aznb-helloworld-output-renderer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766449?path=/sample/aznb-helloworld-output-renderer/package-lock.json&_a=files) |\n\n## \u76ee\u5f55\n\n1. [\u53d8\u66f4\u6982\u89c8](#\u53d8\u66f4\u6982\u89c8)\n2. [\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e](#\u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e)\n3. [\u4e3a\u4ec0\u4e48\u8fd9\u6837\u4fee\u6539](#\u4e3a\u4ec0\u4e48\u8fd9\u6837\u4fee\u6539)\n4. [\u5f71\u54cd\u5206\u6790](#\u5f71\u54cd\u5206\u6790)\n5. [\u98ce\u9669\u4e0e\u517c\u5bb9\u6027](#\u98ce\u9669\u4e0e\u517c\u5bb9\u6027)\n6. [\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae](#\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae)\n7. [\u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c](#\u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c)\n\n## \u53d8\u66f4\u6982\u89c8\n\n\u672c\u6b21\u53d8\u66f4\u6ca1\u6709\u4fee\u6539\u5e94\u7528\u6e90\u4ee3\u7801\u3001\u914d\u7f6e\u5165\u53e3\u6216 `package.json`\uff0c\u800c\u662f\u66f4\u65b0 [`sample/aznb-helloworld-output-renderer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766449?path=/sample/aznb-helloworld-output-renderer/package-lock.json&_a=files) \u4e2d\u5df2\u7ecf\u89e3\u6790\u5b8c\u6210\u7684\u4f20\u9012\u4f9d\u8d56\u7248\u672c\u3002PR \u63cf\u8ff0\u6307\u51fa\uff0c\u8fd9\u6b21\u5347\u7ea7\u7531 Dependabot \u9488\u5bf9 Component Governance \u7684\u9ad8\u5371\u5b89\u5168\u544a\u8b66\u81ea\u52a8\u521b\u5efa\uff0c\u544a\u8b66\u5173\u8054 CVE-2026-13149\u3002\n\n\u9501\u6587\u4ef6\u4e2d\u540c\u65f6\u5b58\u5728 `brace-expansion` 1.x \u548c 2.x \u4e24\u6761\u4f9d\u8d56\u94fe\uff0c\u56e0\u6b64\u9700\u8981\u5206\u522b\u5347\u7ea7\uff1a\n\n- `minimatch` \u79c1\u6709\u4f9d\u8d56\u94fe\u4e2d\u7684 `brace-expansion`\uff1a1.1.11 \u2192 1.1.18\u3002\n- \u9876\u5c42\u89e3\u6790\u5230\u7684 `brace-expansion`\uff1a2.0.1 \u2192 2.1.4\u3002\n\n\u9664\u7248\u672c\u3001\u5305\u4e0b\u8f7d\u5730\u5740\u548c\u5b8c\u6574\u6027\u6458\u8981\u540c\u6b65\u66f4\u65b0\u5916\uff0cnpm \u91cd\u65b0\u751f\u6210\u9501\u6587\u4ef6\u65f6\u8fd8\u8865\u5145\u4e86\u8bb8\u53ef\u8bc1\u4e0e\u82e5\u5e72\u7a7a `requires` \u5143\u6570\u636e\uff0c\u5e76\u5c06\u4e09\u4e2a\u5305\u4e0b\u9762\u91cd\u590d\u9501\u5b9a\u7684 `graceful-fs` \u5b50\u4f9d\u8d56\u8bb0\u5f55\u79fb\u9664\uff0c\u6539\u4e3a\u590d\u7528\u4f9d\u8d56\u6811\u4e2d\u517c\u5bb9\u7684\u516c\u5171\u7248\u672c\u3002\n\n## \u6309\u529f\u80fd\u6a21\u5757\u8bf4\u660e\n\n### 1. \u5b89\u5168\u4f9d\u8d56\u5347\u7ea7\n\n\u6838\u5fc3\u4fee\u6539\u662f\u66ff\u6362\u9501\u6587\u4ef6\u4e2d\u7684\u4e24\u4e2a\u6613\u53d7\u5f71\u54cd\u7248\u672c\uff1a\n\n| \u4f9d\u8d56\u4f4d\u7f6e | \u539f\u7248\u672c | \u65b0\u7248\u672c | \u4f5c\u7528 |\n|---|---:|---:|---|\n| `minimatch` \u7684\u5d4c\u5957\u4f9d\u8d56 | 1.1.11 | 1.1.18 | \u4fdd\u6301 1.x \u517c\u5bb9\u8303\u56f4\uff0c\u540c\u65f6\u7eb3\u5165\u8be5\u7ef4\u62a4\u5206\u652f\u4e2d\u7684\u5b89\u5168\u4fee\u590d |\n| \u53e6\u4e00\u6761\u5df2\u89e3\u6790\u4f9d\u8d56\u94fe | 2.0.1 | 2.1.4 | \u5728 2.x \u517c\u5bb9\u8303\u56f4\u5185\u5347\u7ea7\u5230\u5305\u542b\u5b89\u5168\u4fee\u590d\u7684\u7248\u672c |\n\n`brace-expansion` \u7528\u4e8e\u5c55\u5f00\u7c7b\u4f3c\u82b1\u62ec\u53f7\u8868\u8fbe\u5f0f\u7684\u6a21\u5f0f\uff0c\u5e76\u5e38\u7531 glob/minimatch \u4e00\u7c7b\u6587\u4ef6\u5339\u914d\u5de5\u5177\u95f4\u63a5\u4f7f\u7528\u3002PR \u63cf\u8ff0\u6240\u9644\u4e0a\u6e38\u53d1\u5e03\u8bf4\u660e\u660e\u786e\u63d0\u5230 1.x \u5206\u652f\u5305\u542b\u9488\u5bf9\u6f5c\u5728 ReDoS\uff08\u6b63\u5219\u8868\u8fbe\u5f0f\u62d2\u7edd\u670d\u52a1\uff09\u6216\u4f4e\u6548\u6b63\u5219\u8868\u8fbe\u5f0f\u7684\u4fee\u590d\uff1b\u5206\u6790\u5305\u6ca1\u6709\u63d0\u4f9b CVE \u7684\u5b8c\u6574\u6280\u672f\u7ec6\u8282\uff0c\u56e0\u6b64\u4e0d\u80fd\u8fdb\u4e00\u6b65\u65ad\u8a00\u5177\u4f53\u653b\u51fb\u8f93\u5165\u3001\u53d7\u5f71\u54cd\u8c03\u7528\u8def\u5f84\u6216\u4fee\u590d\u5b9e\u73b0\u3002\n\n### 2. \u5305\u6765\u6e90\u4e0e\u5b8c\u6574\u6027\u5143\u6570\u636e\n\n\u4e24\u4e2a\u65b0\u7248\u672c\u7684 `resolved` \u5730\u5740\u7ee7\u7eed\u6307\u5411 Azure Notebooks \u7684\u5185\u90e8 npm \u6ce8\u518c\u6e90\uff0c\u8bf4\u660e\u5b89\u88c5\u6765\u6e90\u7b56\u7565\u672a\u6539\u53d8\u3002\u5bf9\u5e94\u7684 `integrity` \u503c\u4e5f\u968f\u5305\u5185\u5bb9\u66f4\u65b0\uff0c\u4f7f npm \u5b89\u88c5\u65f6\u80fd\u591f\u6821\u9a8c\u4e0b\u8f7d\u4ea7\u7269\u4e0e\u9501\u6587\u4ef6\u8bb0\u5f55\u662f\u5426\u4e00\u81f4\u3002\n\n\u65b0\u6761\u76ee\u589e\u52a0\u4e86 `license: MIT` \u5143\u6570\u636e\u3002\u8fd9\u662f\u9501\u6587\u4ef6\u63cf\u8ff0\u4fe1\u606f\u7684\u8865\u5168\uff0c\u4e0d\u4f1a\u76f4\u63a5\u6539\u53d8\u7a0b\u5e8f\u8fd0\u884c\u903b\u8f91\u3002\n\n### 3. \u4f9d\u8d56\u6811\u53bb\u91cd\n\n\u91cd\u65b0\u751f\u6210\u540e\u7684\u9501\u6587\u4ef6\u5220\u9664\u4e86\u4ee5\u4e0b\u4f9d\u8d56\u8def\u5f84\u4e0b\u91cd\u590d\u7684 `graceful-fs` 4.2.10 \u8282\u70b9\uff1a\n\n- `fs-extra`\n- `jsonfile`\n- `unzipper`\n\n\u8fd9\u4e9b\u7236\u4f9d\u8d56\u58f0\u660e\u7684\u7248\u672c\u8303\u56f4\u80fd\u591f\u7531\u4f9d\u8d56\u6811\u4e2d\u7684\u5171\u4eab `graceful-fs` \u5b9e\u4f8b\u6ee1\u8db3\uff0c\u56e0\u6b64 npm \u4e0d\u518d\u4e3a\u5b83\u4eec\u4fdd\u7559\u5355\u72ec\u7684\u5d4c\u5957\u526f\u672c\u3002\u6b64\u53d8\u5316\u51cf\u5c11\u4e86\u9501\u6587\u4ef6\u5197\u4f59\u548c\u6f5c\u5728\u5b89\u88c5\u526f\u672c\u6570\uff1b\u5305\u4e2d\u672a\u663e\u793a `graceful-fs` \u672c\u8eab\u88ab\u5347\u7ea7\u6216\u964d\u7ea7\u3002\n\n### 4. npm \u9501\u6587\u4ef6\u683c\u5f0f\u5f52\u4e00\u5316\n\n\u82e5\u5e72\u65e2\u6709\u5f00\u53d1\u4f9d\u8d56\u65b0\u589e\u4e86\u7a7a\u7684 `requires: {}` \u5b57\u6bb5\uff0c\u5305\u62ec webpack CLI \u8f85\u52a9\u5305\u3001`acorn-jsx`\u3001`ajv-keywords`\u3001`icss-utils`\u3001PostCSS \u8f85\u52a9\u5305\u548c `style-loader`\u3002\u8fd9\u4e9b\u5b57\u6bb5\u6ca1\u6709\u65b0\u589e\u5b9e\u9645\u4f9d\u8d56\uff0c\u5c5e\u4e8e\u9501\u6587\u4ef6\u751f\u6210\u5668\u5bf9\u5143\u6570\u636e\u7684\u5e8f\u5217\u5316\u8c03\u6574\u3002\n\n## \u4e3a\u4ec0\u4e48\u8fd9\u6837\u4fee\u6539\n\n\u5355\u72ec\u66f4\u65b0\u4e00\u4e2a\u9501\u6587\u4ef6\u4f4d\u7f6e\u4e0d\u8db3\u4ee5\u89e3\u51b3\u95ee\u9898\uff0c\u56e0\u4e3a\u4ed3\u5e93\u5f53\u524d\u4f9d\u8d56\u56fe\u540c\u65f6\u89e3\u6790\u51fa\u4e86 `brace-expansion` 1.x \u4e0e 2.x\u3002\u82e5\u53ea\u5347\u7ea7\u5176\u4e2d\u4e00\u6761\u94fe\uff0c\u53e6\u4e00\u6761\u65e7\u7248\u672c\u4ecd\u4f1a\u4fdd\u7559\u5728\u5b89\u88c5\u7ed3\u679c\u548c\u5b89\u5168\u626b\u63cf\u6e05\u5355\u4e2d\uff0c\u76f8\u5173\u544a\u8b66\u53ef\u80fd\u7ee7\u7eed\u5b58\u5728\u3002\n\n\u6b64 PR \u9009\u62e9\u5728\u5404\u81ea\u4e3b\u7248\u672c\u8303\u56f4\u5185\u5347\u7ea7\uff0c\u800c\u4e0d\u662f\u5f3a\u5236\u7edf\u4e00\u4e3a\u540c\u4e00\u4e2a\u4e3b\u7248\u672c\uff1a\n\n- 1.x \u4f9d\u8d56\u94fe\u4fdd\u6301\u5728 1.x\uff0c\u53ef\u907f\u514d\u8981\u6c42\u4e0a\u6e38 `minimatch` \u63a5\u53d7\u8de8\u4e3b\u7248\u672c\u4f9d\u8d56\u3002\n- 2.x \u4f9d\u8d56\u94fe\u4fdd\u6301\u5728 2.x\uff0c\u53ef\u83b7\u53d6\u4fee\u590d\u800c\u4e0d\u5f15\u5165\u65b0\u7684\u4e3b\u7248\u672c\u517c\u5bb9\u98ce\u9669\u3002\n- \u53ea\u4fee\u6539\u9501\u6587\u4ef6\uff0c\u610f\u5473\u7740\u76f4\u63a5\u4f9d\u8d56\u58f0\u660e\u548c\u5e94\u7528\u4ee3\u7801\u63a5\u53e3\u4e0d\u53d8\uff1b\u5b89\u88c5\u65f6\u901a\u8fc7\u9501\u6587\u4ef6\u7a33\u5b9a\u89e3\u6790\u5230\u4fee\u590d\u540e\u7684\u4f20\u9012\u7248\u672c\u3002\n\n## \u5f71\u54cd\u5206\u6790\n\n### \u5b89\u5168\u5f71\u54cd\n\n\u9884\u671f\u6b63\u9762\u5f71\u54cd\u662f\u8ba9\u8be5\u793a\u4f8b\u9879\u76ee\u4e0d\u518d\u5b89\u88c5\u5206\u6790\u5305\u4e2d\u6807\u8bb0\u7684\u4e24\u4e2a\u65e7\u7248 `brace-expansion`\uff0c\u4ece\u800c\u5904\u7406 Dependabot/Component Governance \u6307\u5411 CVE-2026-13149 \u7684\u544a\u8b66\u3002PR \u63cf\u8ff0\u5217\u51fa\u4e24\u4e2a\u5177\u4f53\u9ad8\u5371\u544a\u8b66\u5e76\u6ce8\u660e\u53e6\u6709\u4e24\u4e2a\u544a\u8b66\uff0c\u4f46\u5206\u6790\u5305\u6ca1\u6709\u5305\u542b\u6240\u6709\u544a\u8b66\u8be6\u60c5\uff0c\u56e0\u6b64\u65e0\u6cd5\u786e\u8ba4\u6bcf\u4e2a\u544a\u8b66\u5bf9\u5e94\u7684\u5b8c\u6574\u4f9d\u8d56\u8def\u5f84\u3002\n\n### \u6784\u5efa\u4e0e\u5f00\u53d1\u6d41\u7a0b\n\n\u4e24\u4e2a `brace-expansion` \u6761\u76ee\u5747\u6807\u8bb0\u4e3a\u5f00\u53d1\u4f9d\u8d56\uff0c\u76f4\u63a5\u751f\u4ea7\u8fd0\u884c\u65f6\u5f71\u54cd\u9884\u8ba1\u8f83\u4f4e\u3002\u66f4\u53ef\u80fd\u53d7\u5230\u5f71\u54cd\u7684\u662f\u4f7f\u7528 glob\u3001minimatch \u6216\u76f8\u5173\u5de5\u5177\u626b\u63cf\u6587\u4ef6\u7684\u5b89\u88c5\u3001\u6784\u5efa\u3001\u6253\u5305\u3001\u6d4b\u8bd5\u548c\u5f00\u53d1\u547d\u4ee4\u3002\u6b63\u5e38\u6a21\u5f0f\u5e94\u4fdd\u6301\u517c\u5bb9\uff0c\u4f46\u8fb9\u754c\u82b1\u62ec\u53f7\u8868\u8fbe\u5f0f\u7684\u5c55\u5f00\u7ed3\u679c\u3001\u6027\u80fd\u6216\u9519\u8bef\u5904\u7406\u53ef\u80fd\u56e0\u5b89\u5168\u4fee\u590d\u800c\u53d8\u5316\u3002\n\n### \u5b89\u88c5\u7ed3\u679c\n\n\u4ece\u540c\u4e00\u5185\u90e8\u6ce8\u518c\u6e90\u6267\u884c\u57fa\u4e8e\u9501\u6587\u4ef6\u7684\u5b89\u88c5\u65f6\uff0c\u5c06\u4e0b\u8f7d\u65b0\u7248\u672c\u5e76\u91c7\u7528\u65b0\u7684\u5b8c\u6574\u6027\u6458\u8981\u3002\u91cd\u590d `graceful-fs` \u8282\u70b9\u88ab\u53bb\u91cd\u540e\uff0c\u7269\u7406\u4f9d\u8d56\u6811\u53ef\u80fd\u66f4\u6241\u5e73\uff0c\u4f46\u7236\u5305\u58f0\u660e\u7684\u517c\u5bb9\u7248\u672c\u8303\u56f4\u6ca1\u6709\u5728\u5305\u4e2d\u663e\u793a\u53d1\u751f\u53d8\u5316\u3002\n\n### \u4ee3\u7801\u4e0e\u63a5\u53e3\n\n\u6ca1\u6709\u4e1a\u52a1\u6e90\u4ee3\u7801\u3001\u516c\u5f00 API \u6216\u914d\u7f6e\u6587\u4ef6\u53d8\u66f4\uff0c\u4e5f\u6ca1\u6709\u76f4\u63a5\u4f9d\u8d56\u58f0\u660e\u53d8\u66f4\u3002\u56e0\u6b64\uff0c\u672c PR \u4e0d\u5f15\u5165\u53ef\u89c1\u4ea7\u54c1\u529f\u80fd\uff1b\u5176\u4ef7\u503c\u96c6\u4e2d\u5728\u4f9b\u5e94\u94fe\u5b89\u5168\u548c\u4f9d\u8d56\u89e3\u6790\u7ed3\u679c\u4e0a\u3002\n\n## \u98ce\u9669\u4e0e\u517c\u5bb9\u6027\n\n| \u98ce\u9669 / \u5173\u6ce8\u70b9 | \u5177\u4f53\u8bf4\u660e | \u5efa\u8bae |\n|---|---|---|\n| \u6a21\u5f0f\u5c55\u5f00\u884c\u4e3a\u53d8\u5316 | \u5b89\u5168\u4fee\u590d\u53ef\u80fd\u6539\u53d8\u5f02\u5e38\u3001\u8d85\u957f\u6216\u9ad8\u5ea6\u5d4c\u5957\u82b1\u62ec\u53f7\u6a21\u5f0f\u7684\u5904\u7406\u65b9\u5f0f\uff1b\u4f9d\u8d56 glob/minimatch \u7684\u811a\u672c\u53ef\u80fd\u51fa\u73b0\u8fb9\u754c\u884c\u4e3a\u5dee\u5f02\u3002 | \u8fd0\u884c\u8be5\u793a\u4f8b\u9879\u76ee\u73b0\u6709\u7684\u6784\u5efa\u3001\u6d4b\u8bd5\u548c\u6253\u5305\u547d\u4ee4\uff0c\u5e76\u8986\u76d6\u5b9e\u9645\u4f7f\u7528\u7684\u6587\u4ef6\u5339\u914d\u6a21\u5f0f\u3002 |\n| \u9501\u6587\u4ef6\u751f\u6210\u5668\u5dee\u5f02 | \u7a7a `requires` \u5b57\u6bb5\u548c\u4f9d\u8d56\u53bb\u91cd\u8868\u660e\u9501\u6587\u4ef6\u7ecf\u8fc7 npm \u91cd\u65b0\u5e8f\u5217\u5316\uff1b\u4f7f\u7528\u4e0d\u540c npm \u7248\u672c\u53ef\u80fd\u518d\u6b21\u4ea7\u751f\u9501\u6587\u4ef6\u6f02\u79fb\u3002 | \u4f7f\u7528\u4ed3\u5e93\u89c4\u5b9a\u7684 Node.js/npm \u7248\u672c\u6267\u884c\u5e72\u51c0\u5b89\u88c5\uff0c\u786e\u8ba4\u4e0d\u4f1a\u4ea7\u751f\u989d\u5916\u672a\u63d0\u4ea4\u53d8\u66f4\u3002 |\n| \u5185\u90e8\u6e90\u53ef\u7528\u6027 | \u65b0\u7248\u672c\u5fc5\u987b\u80fd\u4ece\u8bb0\u5f55\u7684\u5185\u90e8 Azure Artifacts npm \u6e90\u4e0b\u8f7d\uff0c\u4e14\u5b8c\u6574\u6027\u6458\u8981\u5fc5\u987b\u5339\u914d\u3002 | \u5728\u4e0e CI \u76f8\u540c\u7684\u6e90\u914d\u7f6e\u548c\u51ed\u636e\u73af\u5883\u4e2d\u6267\u884c\u9501\u5b9a\u5b89\u88c5\u3002 |\n| \u4f20\u9012\u4f9d\u8d56\u53cc\u7248\u672c\u5171\u5b58 | \u6b64 PR \u4fee\u590d\u4e24\u6761\u73b0\u6709\u4e3b\u7248\u672c\u7ebf\uff0c\u4f46\u6ca1\u6709\u5c06\u5b83\u4eec\u7edf\u4e00\uff1b\u672a\u6765\u626b\u63cf\u4ecd\u9700\u540c\u65f6\u5173\u6ce8 1.x \u4e0e 2.x\u3002 | \u5408\u5e76\u540e\u786e\u8ba4\u4f9d\u8d56\u6e05\u5355\u4e2d\u4e0d\u518d\u51fa\u73b0 1.1.11 \u548c 2.0.1\uff0c\u5e76\u6838\u5bf9\u5bf9\u5e94 CG \u544a\u8b66\u72b6\u6001\u3002 |\n| `graceful-fs` \u53bb\u91cd | \u7406\u8bba\u4e0a\u7236\u4f9d\u8d56\u8303\u56f4\u5141\u8bb8\u5171\u4eab\u7248\u672c\uff0c\u4f46\u5b9e\u9645\u5b89\u88c5\u5e03\u5c40\u4e0e\u4e4b\u524d\u4e0d\u540c\uff0c\u6781\u5c11\u6570\u4f9d\u8d56\u7269\u7406\u8def\u5f84\u7684\u975e\u6807\u51c6\u811a\u672c\u53ef\u80fd\u53d7\u5f71\u54cd\u3002 | \u4f7f\u7528\u5e72\u51c0\u7684 `node_modules` \u9a8c\u8bc1\uff0c\u907f\u514d\u4ec5\u5728\u65e7\u5b89\u88c5\u76ee\u5f55\u4e0a\u589e\u91cf\u5b89\u88c5\u3002 |\n| \u4ec5\u9501\u6587\u4ef6\u66f4\u65b0 | \u5982\u679c\u540e\u7eed\u91cd\u65b0\u89e3\u6790\u4f9d\u8d56\u65f6\u7f3a\u5c11\u8db3\u591f\u7684\u76f4\u63a5\u7ea6\u675f\uff0c\u65e7\u7248\u662f\u5426\u53ef\u80fd\u518d\u6b21\u51fa\u73b0\u53d6\u51b3\u4e8e\u4e0a\u6e38\u4f9d\u8d56\u8303\u56f4\u548c\u4f7f\u7528\u7684 npm \u7248\u672c\u3002 | \u68c0\u67e5\u5e72\u51c0\u5b89\u88c5\u540e\u7684\u4f9d\u8d56\u6811\uff0c\u5e76\u786e\u4fdd CI \u4f7f\u7528\u9501\u5b9a\u5b89\u88c5\u65b9\u5f0f\u3002 |\n\n\u517c\u5bb9\u6027\u65b9\u9762\uff0c\u4e24\u6b21\u5347\u7ea7\u90fd\u6ca1\u6709\u8de8\u8d8a\u4e3b\u7248\u672c\uff0c\u4e14\u6ca1\u6709\u5e94\u7528\u4ee3\u7801\u6539\u52a8\uff0c\u6574\u4f53\u98ce\u9669\u4f4e\u4e8e\u76f4\u63a5\u5347\u7ea7\u4e0a\u6e38 glob/minimatch \u5305\uff1b\u4f46\u4f20\u9012\u4f9d\u8d56\u7684\u8865\u4e01/\u6b21\u7248\u672c\u4ecd\u53ef\u80fd\u5e26\u6765\u4e0a\u8ff0\u8fb9\u754c\u884c\u4e3a\u53d8\u5316\uff0c\u4e0d\u80fd\u4ec5\u51ed\u8bed\u4e49\u5316\u7248\u672c\u53f7\u8ba4\u5b9a\u5b8c\u5168\u65e0\u98ce\u9669\u3002\n\n## \u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u5efa\u8bae\n\n\u5206\u6790\u5305\u672a\u5305\u542b\u6d4b\u8bd5\u6587\u4ef6\u53d8\u66f4\u3001\u6d4b\u8bd5\u8fd0\u884c\u7ed3\u679c\u3001\u6d41\u6c34\u7ebf\u72b6\u6001\u6216\u6784\u5efa\u65e5\u5fd7\uff1b`mergeStatus: succeeded` \u53ea\u8868\u793a\u5305\u4e2d\u8bb0\u5f55\u7684 PR \u5408\u5e76\u8ba1\u7b97\u72b6\u6001\uff0c\u4e0d\u80fd\u636e\u6b64\u58f0\u79f0\u6d4b\u8bd5\u5df2\u7ecf\u901a\u8fc7\u3002\u5efa\u8bae\u81f3\u5c11\u5b8c\u6210\u4ee5\u4e0b\u9a8c\u8bc1\uff1a\n\n1. \u5728 [`sample/aznb-helloworld-output-renderer/package-lock.json`](https://dev.azure.com/devdiv/OnlineServices/_git/AzureNotebooks/pullrequest/766449?path=/sample/aznb-helloworld-output-renderer/package-lock.json&_a=files) \u6240\u5c5e\u9879\u76ee\u76ee\u5f55\u6267\u884c\u4ed3\u5e93\u65e2\u5b9a\u7684\u5e72\u51c0\u9501\u5b9a\u5b89\u88c5\u547d\u4ee4\uff0c\u786e\u8ba4\u5185\u90e8\u6e90\u4e0b\u8f7d\u4e0e\u5b8c\u6574\u6027\u6821\u9a8c\u6210\u529f\u3002\n2. \u8fd0\u884c\u8be5\u793a\u4f8b\u9879\u76ee\u5df2\u6709\u7684\u6784\u5efa\u3001\u6d4b\u8bd5\u3001lint \u6216\u6253\u5305\u547d\u4ee4\uff0c\u91cd\u70b9\u89c2\u5bdf\u6587\u4ef6 glob\u3001webpack/PostCSS \u548c\u8f93\u51fa\u6e32\u67d3\u5668\u6784\u5efa\u6d41\u7a0b\u3002\n3. \u68c0\u67e5\u5b89\u88c5\u540e\u7684\u4f9d\u8d56\u6811\uff0c\u786e\u8ba4\u4e0d\u518d\u89e3\u6790\u51fa `brace-expansion@1.1.11` \u6216 `brace-expansion@2.0.1`\uff0c\u5e76\u786e\u8ba4\u76ee\u6807\u7248\u672c\u4e3a 1.1.18 \u548c 2.1.4\u3002\n4. \u786e\u8ba4\u5e72\u51c0\u5b89\u88c5\u4e0d\u4f1a\u7ee7\u7eed\u6539\u5199\u9501\u6587\u4ef6\uff0c\u6392\u9664 npm \u7248\u672c\u4e0d\u4e00\u81f4\u5bfc\u81f4\u7684\u683c\u5f0f\u6f02\u79fb\u3002\n5. \u5408\u5e76\u540e\u590d\u67e5 Component Governance \u544a\u8b66\uff0c\u786e\u8ba4 PR \u63cf\u8ff0\u6240\u6307\u7684\u544a\u8b66\u5df2\u88ab\u5b9e\u9645\u5173\u95ed\u6216\u91cd\u65b0\u8bc4\u4f30\u3002\n\n## \u5dee\u5f02\u8986\u76d6\u4e0e\u5206\u6790\u8fb9\u754c\n\n- \u5206\u6790\u5305\u58f0\u660e\u5171\u53d8\u66f4 1 \u4e2a\u6587\u4ef6\uff0c\u5e76\u63d0\u4f9b\u4e86\u8be5\u6587\u4ef6\u7684\u5b8c\u6574\u5dee\u5f02\uff1b\u6587\u4ef6\u7ea7 `truncated` \u4e3a `false`\uff0c\u5168\u5c40 `diffTruncated` \u4e5f\u4e3a `false`\u3002\u56e0\u6b64\uff0c\u672c\u8bf4\u660e\u8986\u76d6\u4e86\u5305\u4e2d\u5217\u51fa\u7684\u5168\u90e8\u4ee3\u7801\u5dee\u5f02\u3002\n- \u5dee\u5f02\u901a\u8fc7 `git-local` \u65b9\u6cd5\u5bfc\u51fa\uff0c\u5355\u6587\u4ef6\u5dee\u5f02 9,407 \u5b57\u8282\uff0c\u4f4e\u4e8e\u5305\u4e2d\u8bb0\u5f55\u7684 65,536 \u5b57\u8282\u5355\u6587\u4ef6\u4e0a\u9650\uff0c\u4e5f\u4f4e\u4e8e 524,288 \u5b57\u8282\u603b\u4e0a\u9650\u3002\n- \u5206\u6790\u5305\u6ca1\u6709\u9519\u8bef\u6216\u8b66\u544a\u3002\n- PR \u63cf\u8ff0\u4e2d\u7684\u4e0a\u6e38\u63d0\u4ea4\u5217\u8868\u5728\u5305\u5185\u4ee5\u7701\u7565\u5185\u5bb9\u7ed3\u5c3e\uff0c\u4e14\u56db\u4e2a CG \u544a\u8b66\u53ea\u5c55\u793a\u4e86\u5176\u4e2d\u4e24\u4e2a\u7684\u5177\u4f53\u94fe\u63a5\uff1b\u672c\u8bf4\u660e\u6ca1\u6709\u63a8\u65ad\u7f3a\u5931\u7684\u63d0\u4ea4\u3001\u544a\u8b66\u4f9d\u8d56\u8def\u5f84\u6216 CVE \u6280\u672f\u7ec6\u8282\u3002\n- \u5305\u4e2d\u6ca1\u6709 `package.json` \u5185\u5bb9\u3001\u9879\u76ee\u811a\u672c\u5b9a\u4e49\u3001CI \u7ed3\u679c\u3001\u6d4b\u8bd5\u65e5\u5fd7\u6216\u5b8c\u6574\u4f9d\u8d56\u6811\uff0c\u56e0\u6b64\u65e0\u6cd5\u786e\u8ba4\u5177\u4f53\u547d\u4ee4\u3001\u5b9e\u9645\u6d4b\u8bd5\u901a\u8fc7\u60c5\u51b5\u3001\u544a\u8b66\u5173\u95ed\u7ed3\u679c\u6216\u6240\u6709\u8fd0\u884c\u65f6\u8c03\u7528\u8def\u5f84\u3002\n", "creation_timestamp": "2026-08-31T16:16:12.398218Z"}, {"uuid": "97b9921d-984a-407a-ae80-ccdfb6e807d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13149", "type": "seen", "source": "https://gist.github.com/dystewart/96e0a391116dd67ddc5f575f0732a337", "content": "# SPDX-FileCopyrightText: Copyright (c) 2024-2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.\n# SPDX-License-Identifier: Apache-2.0\n#\n# Licensed under the Apache License, Version 2.0 (the \"License\");\n# you may not use this file except in compliance with the License.\n# You may obtain a copy of the License at\n#\n# http://www.apache.org/licenses/LICENSE-2.0\n#\n# Unless required by applicable law or agreed to in writing, software\n# distributed under the License is distributed on an \"AS IS\" BASIS,\n# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n# See the License for the specific language governing permissions and\n# limitations under the License.\n\nARG BASE_IMAGE_URL=registry.access.redhat.com/ubi9/ubi\nARG BASE_IMAGE_TAG=9.8-1782841664\nARG PYTHON_VERSION=3.12\n\n# Specified on the command line with --build-arg VULN_ANALYSIS_VERSION=$(python -m setuptools_scm)\nARG VULN_ANALYSIS_VERSION=2.0.0\n\nFROM ${BASE_IMAGE_URL}:${BASE_IMAGE_TAG} AS base\nCOPY --from=ghcr.io/astral-sh/uv:0.7.15 /uv /uvx /bin/\nARG VULN_ANALYSIS_VERSION\nARG PYTHON_VERSION\nARG AGENT_GIT_COMMIT\nARG AGENT_GIT_TAG\n\nENV PYTHONDONTWRITEBYTECODE=1 \\\n    AGENT_GIT_COMMIT=${AGENT_GIT_COMMIT} \\\n    AGENT_GIT_TAG=${AGENT_GIT_TAG}\n\nRUN dnf install -y --nodocs \\\n      bsdtar \\\n      ca-certificates \\\n      gcc \\\n      gcc-c++ \\\n      git \\\n      git-lfs \\\n      krb5-devel \\\n      libatomic \\\n      make \\\n      python3.12 \\\n      python3.12-devel \\\n      skopeo \\\n      wget \\\n      xz \\\n    && dnf clean all \\\n    && update-ca-trust\n\n\nRUN curl -L -X GET https://go.dev/dl/go1.24.1.linux-amd64.tar.gz -o /tmp/go1.24.1.linux-amd64.tar.gz \\\n    && tar -C /usr/local -xzf /tmp/go1.24.1.linux-amd64.tar.gz \\\n    && rm /tmp/go1.24.1.linux-amd64.tar.gz\n\nENV GOTOOLCHAIN=auto\n\n# --- Node.js and npm (CVE-2026-13149: brace-expansion DoS) ---\nARG NODE_VERSION=26.5.0\nRUN curl -fsSL -o /tmp/node.tar.xz \\\n      \"https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz\" \\\n && mkdir -p /opt/nodejs \\\n && tar -C /opt/nodejs -xJf /tmp/node.tar.xz --strip-components=1 \\\n && rm -f /tmp/node.tar.xz\nENV PATH=\"/opt/nodejs/bin:${PATH}\"\n\n\n# CVE-2026-42338: ip-address <10.1.1 XSS (transitive via npm -> socks@2.8.7)\nRUN cd /tmp && \\\n    npm pack ip-address@10.1.1 && \\\n    tar -xzf ip-address-*.tgz && \\\n    rm -rf /opt/nodejs/lib/node_modules/npm/node_modules/ip-address && \\\n    mv package /opt/nodejs/lib/node_modules/npm/node_modules/ip-address && \\\n    rm -f /tmp/ip-address-*.tgz && \\\n    rm -rf /tmp/package\n\n# Verify Node.js and npm installation\n# npm <=11.17 bundles brace-expansion <=5.0.6; upgrade to patched release\nRUN npm install -g npm@11.18.0 \\\n && node --version && npm --version\n\n# --- Temurin JDK 17 (amd64/x86_64) ---\nARG JDK_URL=\"https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.18%2B8/OpenJDK17U-jdk_x64_linux_hotspot_17.0.18_8.tar.gz\"\nARG JDK_DIR=\"jdk-17.0.18+8\"\nRUN mkdir -p /opt/jdk \\\n && curl -fsSL -o /tmp/jdk.tgz \"${JDK_URL}\" \\\n && tar -C /opt/jdk -xzf /tmp/jdk.tgz \\\n && rm -f /tmp/jdk.tgz\nENV JAVA_HOME=/opt/jdk/${JDK_DIR}\nENV PATH=\"${JAVA_HOME}/bin:${PATH}\"\n\n# --- Maven 3.9.11 (optional) ---\nARG MVN_VER=3.9.11\nRUN curl -fsSL -o /tmp/maven.tgz \\\n      \"https://archive.apache.org/dist/maven/maven-3/${MVN_VER}/binaries/apache-maven-${MVN_VER}-bin.tar.gz\" \\\n && tar -C /opt -xzf /tmp/maven.tgz \\\n && rm -f /tmp/maven.tgz\nENV PATH=\"/opt/apache-maven-${MVN_VER}/bin:${PATH}\"\n\n# Verify\nRUN java -version && mvn -v\n\n# Set SSL environment variables\nENV REQUESTS_CA_BUNDLE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \\\n    SSL_CERT_FILE=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem\n\n# Add Tini\nADD --chmod=755 \\\n    --checksum=sha256:93dcc18adc78c65a028a84799ecf8ad40c936fdfc5f2a57b1acda5a8117fa82c \\\n    https://github.com/krallin/tini/releases/download/v0.19.0/tini /tini\n\nSHELL [\"/bin/bash\", \"-c\"]\n\n# Set working directory\nWORKDIR /workspace\n\n# Copy the project into the container\nCOPY ./ /workspace\n\nRUN groupadd workspace-group && \\\n    useradd -u 1001 -m -g workspace-group user1001 && \\\n    chown -R :workspace-group /home/user1001 && \\\n    chmod -R g+wrx /home/user1001\n\n\n\n# Install the NeMo Agent toolkit package and vuln analysis package\nRUN --mount=type=cache,id=uv_cache,target=/home/user1001/.cache/uv,mode=0775,sharing=locked \\\n    export SETUPTOOLS_SCM_PRETEND_VERSION=${VULN_ANALYSIS_VERSION} && \\\n    UV_PYTHON_DOWNLOADS=never uv venv --python /usr/bin/python3.12 /workspace/.venv && \\\n    uv sync && \\\n    chown -R :workspace-group /workspace && \\\n    chmod -R g+wrx /workspace && \\\n    chown -R :workspace-group /root && \\\n    chmod -R g+rx /root\n\nRUN chgrp -R 0 /workspace && chmod -R g=u /workspace\n\nUSER 1001\n\n# Activate the environment (make it default for subsequent commands)\n# Environment variables for the venv\nENV PATH=\"/workspace/.venv/bin:/usr/local/go/bin:$PATH\"\n\n# Activate the environment (make it default for subsequent commands)\nRUN echo \"source /workspace/.venv/bin/activate\" >> ~/.bashrc\n\n# ===== Setup for development =====\nFROM base AS runtime\nRUN --mount=type=cache,id=uv_cache,target=/root/.cache/uv,sharing=locked \\\n    source /workspace/.venv/bin/activate\n\n\nCMD [\"jupyter-lab\", \"--no-browser\", \"--allow-root\", \"--ip='*'\", \"--port=8000\", \"--NotebookApp.token=''\", \"--NotebookApp.password=''\"]\n", "creation_timestamp": "2026-09-02T18:04:42.081471Z"}]}