Detections
Analytics

Chainguard: kubeflow-pipelines-frontend: security update to 2.18.0-r0

medium Tenable Cloud Security Plugin ID 478034

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory
 footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-
 json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a block or line
 comment spans an input chunk, while retaining the accumulated comment buffer. Delivering a large valid
 comment across many small chunks therefore causes quadratic CPU work and can stall the Node.js event loop.
 The maintainer characterizes the attack vector as local because the documented JSONC input is locally
 owned or user-controlled configuration, rather than input intended for the open internet. This JSONC-only
 scope does not include the plain JSON parser, which advances through and discards consumed string and
 number data. This issue is fixed in version 3.6.0. (CVE-2026-104182)

Solution

Update the kubeflow-pipelines-frontend library and its related packages to version 2.18.0-r0 or later.

Plugin Details

Severity: Medium

ID: 478034

Version: Revision 1.1

Type: Local

Published: 10/31/2026

Updated: 10/31/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.64

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-104182

CVSS v3

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 5.4

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/1/2026

Reference Information

CVE: CVE-2026-104182