Fix OCPBUGS-98767: CVE-2026-48801 by germanparente · Pull Request #16853 · openshift/console

germanparente · 2026-07-27T18:54:39Z

Summary

Replaces react-linkify (depends on vulnerable linkify-it) with linkify-react + linkifyjs
Fixes CVE-2026-48801: quadratic algorithmic complexity in LinkifyIt#match scan loop (DoS)
Backport of OCPBUGS-98879, CONSOLE-5133: Replace react-linkify with linkify-react to fix CVE-2026-48801 #16814 approach to this release branch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-merge-bot · 2026-07-27T18:54:41Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

coderabbitai · 2026-07-27T18:54:46Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1be15887-cedf-400f-b35a-17d90e358c80

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-07-27T18:54:46Z

@germanparente: This pull request references Jira Issue OCPBUGS-98767, which is invalid:

expected dependent Jira Issue OCPBUGS-98791 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead
expected dependent Jira Issue OCPBUGS-98791 to target a version in 4.22.0, but it targets "4.22.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Replaces react-linkify (depends on vulnerable linkify-it) with linkify-react + linkifyjs

Fixes CVE-2026-48801: quadratic algorithmic complexity in LinkifyIt#match scan loop (DoS)

Backport of OCPBUGS-98879, CONSOLE-5133: Replace react-linkify with linkify-react to fix CVE-2026-48801 #16814 approach to this release branch

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-07-27T18:58:25Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: germanparente
Once this PR has been reviewed and has the lgtm label, please assign spadgett for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

frontend/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rhamilto · 2026-07-29T16:33:13Z

@germanparente, there is a build issue here that cascades down to earlier releases. Will require a manual fix.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The initial backport swapped the library but kept the old react-linkify component prop API. This adds the linkifyOptions config with custom render and URL validation as done in openshift#16814. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

germanparente · 2026-07-29T19:26:51Z

/test backend
/test frontend
/test okd-scos-images

germanparente · 2026-07-29T20:57:53Z

/test frontend

germanparente · 2026-07-30T07:29:41Z

/test frontend

germanparente · 2026-07-30T09:03:06Z

/jira refresh

openshift-ci-robot · 2026-07-30T09:03:11Z

@germanparente: This pull request references Jira Issue OCPBUGS-98767, which is invalid:

expected dependent Jira Issue OCPBUGS-98791 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ON_QA instead
expected dependent Jira Issue OCPBUGS-98791 to target a version in 4.22.0, but it targets "4.22.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Use bare 'linkify-react' import instead of explicit .mjs path. Webpack resolves to ESM via the module field, Jest resolves to CJS via the main field, fixing the SyntaxError in test suites. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

germanparente · 2026-07-30T10:19:03Z

/jira refresh

openshift-ci-robot · 2026-07-30T10:19:07Z

@germanparente: This pull request references Jira Issue OCPBUGS-98767, which is invalid:

expected dependent Jira Issue OCPBUGS-98791 to target a version in 4.22.0, but it targets "4.22.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Restore the explicit .mjs import needed by webpack, and add a Jest moduleNameMapper to redirect it to the .cjs build so Jest can parse it in CommonJS mode. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

germanparente · 2026-07-30T10:41:55Z

/jira refresh

openshift-ci-robot · 2026-07-30T10:42:02Z

@germanparente: This pull request references Jira Issue OCPBUGS-98767, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.21.z) matches configured target version for branch (4.21.z)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
release note type set to "Release Note Not Required"
dependent bug Jira Issue OCPBUGS-98791 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
dependent Jira Issue OCPBUGS-98791 targets the "4.22.0" version, which is one of the valid target versions: 4.22.0
bug has dependents

No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

germanparente · 2026-07-31T20:31:38Z

/test frontend

openshift-ci · 2026-07-31T21:30:03Z

@germanparente: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-images	`fe3dff0`	link	true	`/test okd-scos-images`
ci/prow/frontend	`fe3dff0`	link	true	`/test frontend`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Fix OCPBUGS-98767: CVE-2026-48801

428125c

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci Bot requested review from jhadvig and sg00dwin July 27, 2026 18:58

openshift-ci Bot added the component/core Related to console core functionality label Jul 27, 2026

Remove unused linkifyjs type import

4fc770c

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

rhamilto reviewed Jul 29, 2026

View reviewed changes

Comment thread frontend/public/components/utils/link.tsx Outdated

Fix Jest ESM error: map .mjs import to .cjs for tests

fe3dff0

Restore the explicit .mjs import needed by webpack, and add a Jest moduleNameMapper to redirect it to the .cjs build so Jest can parse it in CommonJS mode. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jul 30, 2026

Uh oh!

Conversation

germanparente commented Jul 27, 2026

Summary

Uh oh!

openshift-merge-bot Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

openshift-ci-robot commented Jul 27, 2026

Summary

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

rhamilto commented Jul 29, 2026

Uh oh!

Uh oh!

germanparente commented Jul 29, 2026

Uh oh!

germanparente commented Jul 29, 2026

Uh oh!

germanparente commented Jul 30, 2026

Uh oh!

germanparente commented Jul 30, 2026

Uh oh!

openshift-ci-robot commented Jul 30, 2026

Uh oh!

germanparente commented Jul 30, 2026

Uh oh!

openshift-ci-robot commented Jul 30, 2026

Uh oh!

germanparente commented Jul 30, 2026

Uh oh!

openshift-ci-robot commented Jul 30, 2026

Uh oh!

germanparente commented Jul 31, 2026

Uh oh!

openshift-ci Bot commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading