[devin-ai-integration]

Summary

Upgrades dustjs-linkedin from 2.5.0 to 2.6.1 to fix the critical code injection SNYK-JS-DUSTJSLINKEDIN-1089257 / CVE-2021-4264 (CWE-94).

How the attack works: routes.about_new passes req.query.device into views/about_new.dust, which renders {@if cond="'{device}'=='Desktop'"}. The dustjs-helpers @if helper runs cond through eval. In 2.5.0, dust.escapeHtml returns non-strings unchanged. So ?device[]=Desktop'-require('child_process')...-' skips HTML escaping, closes the string literal, and runs arbitrary JS. From 2.6.0 on, arrays are stringified and escaped (' becomes '), so the payload stays a plain string.

Why 2.6.1: The pinned dustjs-helpers@1.5.0 has peerDependency dustjs-linkedin: "2.5 - 2.6", so 2.6.x is the highest line that works without also upgrading helpers. 2.6.2 and later add an old chokidar 1.x dependency tree (~140 packages, only used by dustc watch mode). 2.6.1 only adds cli@0.6.6 (+ exit, glob@3, minimatch@0.3, sigmund), which keeps the lockfile diff small.

Only package.json and the matching package-lock.json entries change. No app code changes.

Verification

I ran the real app.js locally and replayed the repo's own exploits/dustjs-exploits.sh payloads. dust5 was changed to touch /tmp/pwned_dust so a successful exploit is easy to see:

payload	main (2.5.0)	this branch (2.6.1)
dust1 ?device=Desktop	font-size: medium	font-size: medium
dust2 ?device[]=Desktop	font-size: medium	font-size: medium
dust3 ?device[]=Desktop'	HTTP 500 (eval syntax error)	HTTP 200
dust5 RCE payload	/tmp/pwned_dust created	not created

Notes: the repo has no unit tests for this path, and npm test is snyk test, which needs Snyk auth. To run the app locally I had to swallow unrelated startup errors from MongoDB and MySQL seeding: mongoose@4.2.4 can't talk to the box's mongod 7, and the MySQL port didn't match. Neither affects /about_new.

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/a1105cb4d9ac4a1e8bcd9c32208bde5a
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/a1105cb4d9ac4a1e8bcd9c32208bde5a?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

Enable auto-review to review your pull requests automatically.

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	dustjs-linkedin@​2.5.0 ⏵ 2.6.1	+7		+1

View full report

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.