Repository navigation
[Security Vulnerabiliy] Vulnerable bundled node.exe detected (Node2Shell - CVE-2026-111497) #2959
Description
Description
The currently bundled Node.js version is v24.16.0, which is highly vulnerable to Node2Shell (CVE-2026-111497).
Proposed Resolution
We need to update the packaging pipeline to bundle a safe version of Node.js:
- Update Build Scripts: Modify
scripts/build-bundle.shor the release workflow config to bump the defaultNODE_VERIONfromv24.16.0tov24.22.1(or the latest secure release). - Re-trigger Release: Generate updated standalone packages for Windows (
install.ps1) and other platforms so users can runcodegraph upgradeto replace the unpatched binary.
Activity
maxmilian commentedon Oct 29, 2026
This is already done on
mainbut not released yet.b8c3c032, Oct 22) moved the bundled Node inscripts/build-bundle.shtov24.22.1, Node's October security release, and added a check of the downloaded Node against theSHASUMS256that nodejs.org publishes.[Unreleased]inCHANGELOG.md("The bundled Node runtime moves to 24.22.1…"). The latest release, v1.6.2 (Oct 3), still bundlesv24.16.0, and no tag containsb8c3c032yet.So the step left is item 2 here, the next release. After it ships,
codegraph upgradeshould replace the bundled runtime.libedi commentedon Oct 30, 2026
Thanks for the quick and detailed follow-up, @maxmilian!
Good to know the fix (#2817) is already on
main, and the added SHASUMS256 verification is a nice touch.Since this addresses a CVE, would it be possible to cut a patch release (e.g. v1.6.3) ahead of the next regular release? Our security team has restricted the use of codegraph internally because of the vulnerable bundled
node.exe, and we won't be able to use it again until a fixed build is released.If a patch release isn't planned, could you share a rough ETA for the next release? I'd suggest keeping this issue open until the fix ships in a tagged release, so it's easier to track.
maxmilian commentedon Nov 2, 2026
To clarify, I'm a contributor here, not a maintainer, so I can't cut a release or commit to a date. Releases are published by @colbymchenry.
For the release question: on
maintoday (f72c9d2e, Nov 1), the bundled Node is still listed under[Unreleased], and v1.6.2 is still the latest tag. Every release since v1.6.0 has been tagged by the release workflow after a maintainer prepares it, so a patch release only needs that step.@colbymchenry, would a v1.6.3 for the bundled Node update (#2817) work for you? libedi's security team has blocked the current build internally until a fixed build ships.
I agree with keeping this issue open until a tagged release includes the fix.