Vulnerabilities Without a CVE Not Impacting Pipelines

Preventing remove-markdown RedDos

Medium

1.23.2

RedDos vulnerable code will run with a timeout.

Prototype pollution flaw in clean-css 4.2.4

High

1.20.2

Does not affect Pipelines, since clean-css@4.2.4 is submodule of mjml and Pipelines is not calling the vulnerable template function.

Prototype pollution flaw in node-forge 0.10.0

Critical

N/A

Does not affect Pipelines, since Pipelines and win-ca does not call the vulnerable debug function.