CVE-2025-5889

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

Brace expansion as known from sh/bash

Security Fix(es):

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.(CVE-2025-5889)

Root has patched CVE-2025-5889 in the brace-expansion package for Root:npm. Multiple fixed versions available.

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.12-tuxcare.1.

TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 2.0.1-tuxcare.1.

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.11-tuxcare.1.

TuxCare rebuilt brace-expansion to address 5 CVEs. Fixed in 1.1.3-tuxcare.2.

These are all security issues fixed in the jupyter-bqplot-jupyterlab-0.5.44-10.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-furo-doc-2024.8.6-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the jupyter-matplotlib-0.11.4-15.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-jupyter-ydoc-3.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the jupyter-jupyterlab-templates-0.5.2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the jupyter-nbclassic-1.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the jupyter-nbdime-7.0.2-20.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the jupyter-panel-1.7.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the jupyter-plotly-6.1.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-pydata-sphinx-theme-0.16.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-pytest-html-4.1.1-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tree-sitter-ruby-0.23.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.

This update for tree-sitter-ruby fixes the following issues

• CVE-2025-5889: brace-expansion: inefficient regular expression complexity in function expand of file index.js (bsc#1244345).
• CVE-2025-59343: tar-fs: tar-fs symlink validation bypass (bsc#1250517).

Changes for tree-sitter-ruby:

• Use correct tree-sitter dirname instead of tree_sitter (bsc#1267461).

• update to 0.23.1:

• ci(publish): add attestations and generate parser
• build: update bindings
• fix: remove unnecessary empty string usage
• chore: regenerate
• ci: update workflows
• fix(swift): include scanner.c

• update to 0.23.0:

• fix(go): correct test
• fix: handle != operator definition
• feat: support element references with blocks
• fix: do not require newline after block comment =end
• fix: parsing of multiple unicode escapes
• fix: correct repo url

• update to 0.21.0:

• feat: rewrite scanner with array header and regenerate
• build: update bindings and manifests
• fix: reverse precedence queries
• fix: escape braces in regex
• docs: update badges

• switch to download_files service
• add neovim links
• add license file to package

This update for aws-cli, local-npm-registry, python-boto3, python-botocore, python-coverage, python-flaky, python-pluggy, python-pytest, python-pytest-cov, python-pytest-html, python-pytest-metadata, python-pytest-mock contains the following fixes:

Changes in aws-cli:

• Update to 1.33.26
  • api-change:acm-pca: Minor refactoring of C2J model for AWS Private CA
  • api-change:arc-zonal-shift: Adds the option to subscribe to get notifications when a zonal autoshift occurs in a region.
  • api-change:globalaccelerator: This feature adds exceptions to the Customer API to avoid throwing Internal Service errors
  • api-change:pinpoint: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:quicksight: Vega ally control options and Support for Reviewed Answers in Topics
• from version 1.33.25
  • api-change:batch: This feature allows AWS Batch Jobs with EKS container orchestration type to be run as Multi-Node Parallel Jobs.
  • api-change:bedrock: Add support for contextual grounding check for Guardrails for Amazon Bedrock.
  • api-change:bedrock-agent: Introduces new data sources and chunking strategies for Knowledge bases, advanced parsing logic using FMs, session summary generation, and code interpretation (preview) for Claude V3 Sonnet and Haiku models. Also introduces Prompt Flows (preview) to link prompts, foundational models, and resources.
  • api-change:bedrock-agent-runtime: Introduces query decomposition, enhanced Agents integration with Knowledge bases, session summary generation, and code interpretation (preview) for Claude V3 Sonnet and Haiku models. Also introduces Prompt Flows (preview) to link prompts, foundational models, and resources for end-to-end solutions.
  • api-change:bedrock-runtime: Add support for contextual grounding check and ApplyGuardrail API for Guardrails for Amazon Bedrock.
  • api-change:ec2: Add parameters to enable provisioning IPAM BYOIPv4 space at a Local Zone Network Border Group level
  • api-change:glue: Add recipe step support for recipe node
  • api-change:groundstation: Documentation update specifying OEM ephemeris units of measurement
  • api-change:license-manager-linux-subscriptions: Add support for third party subscription providers, starting with RHEL subscriptions through Red Hat Subscription Manager (RHSM). Additionally, add support for tagging subscription provider resources, and detect when an instance has more than one Linux subscription and notify the customer.
  • api-change:mediaconnect: AWS Elemental MediaConnect introduces the ability to disable outputs. Disabling an output allows you to keep the output attached to the flow, but stop streaming to the output destination. A disabled output does not incur data transfer costs.
• from version 1.33.24
  • api-change:datazone: This release deprecates dataProductItem field from SearchInventoryResultItem, along with some unused DataProduct shapes
  • api-change:fsx: Adds support for FSx for NetApp ONTAP 2nd Generation file systems, and FSx for OpenZFS Single AZ HA file systems.
  • api-change:opensearch: This release adds support for enabling or disabling Natural Language Query Processing feature for Amazon OpenSearch Service domains, and provides visibility into the current state of the setup or tear-down.
  • api-change:sagemaker: This release 1/ enables optimization jobs that allows customers to perform Ahead-of-time compilation and quantization. 2/ allows customers to control access to Amazon Q integration in SageMaker Studio. 3/ enables AdditionalModelDataSources for CreateModel action.
• from version 1.33.23
  • api-change:codedeploy: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:devicefarm: Add v2 smoke tests and smithy smokeTests trait for SDK testing.
  • api-change:dms: Add v2 smoke…