[Security] Fix HIGH vulnerability: CVE-2025-15284

[orbisai0security]

Security Fix

This PR addresses a HIGH severity vulnerability detected by our security scanner.

Security Impact Assessment

Aspect	Rating	Rationale
Impact	Medium	In WaveTerm, a terminal emulator app, exploitation of this qs DoS vulnerability could cause the application to crash or become unresponsive when parsing malformed array inputs, potentially disrupting user workflows and requiring app restart; however, it does not enable data breaches, remote code execution, or system compromise, limiting damage to temporary denial of service on the user's local machine.
Likelihood	Low	WaveTerm is a client-side desktop application with limited external input surface, and qs is likely used for internal parsing of controlled data like configuration or UI parameters; exploitation would require an attacker to deliver specific malformed inputs, which is unlikely without social engineering or if the app processes untrusted web content, given its focus on local terminal operations.
Ease of Fix	Medium	Remediation involves updating the qs dependency to a patched version via npm, which may require reviewing and testing for compatibility with WaveTerm's web-based interface and terminal features; potential for breaking changes exists due to qs's role in query string handling, necessitating moderate testing effort across different platforms.

Vulnerability Details

• Rule ID: CVE-2025-15284
• File: package-lock.json
• Description: qs: qs: Denial of Service via improper input validation in array parsing

Changes Made

This automated fix addresses the vulnerability by applying security best practices.

Files Modified

• package.json
• package-lock.json

Verification

This fix has been automatically verified through:

• ✅ Build verification
• ✅ Scanner re-scan
• ✅ LLM code review

🤖 This PR was automatically generated.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

Walkthrough

A new npm dependency "qs" with version ^6.14.1 was added to the project's package.json file. This is a single-line addition to the dependencies section with no other modifications.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change as a security fix for CVE-2025-15284, which directly corresponds to the qs dependency update in package.json.
Description check	✅ Passed	The description is directly related to the changeset, providing detailed security context, impact assessment, and rationale for updating the qs dependency.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

🧹 Recent nitpick comments

package.json (1)

115-115: Remove qs or clarify why it's needed—it's not directly used and has no transitive dependents.

qs is neither directly imported in the codebase nor a transitive dependency (npm ls qs shows no dependents). If this was added to patch a vulnerability in a transitive chain, verify that chain still exists. If the CVE is resolved elsewhere, this direct dependency is unnecessary and should be removed.

---

📜 Recent review details

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 31a8714 and e85f7f0.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: merge-gatekeeper

_{✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}