@emotion/babel-plugin pulls vulnerable [email protected] (yaml CVE GHSA-48c2-rrv3-qjmp) — please upgrade to cosmiconfig 9.x

Summary

@emotion/babel-plugin depends (transitively through babel-plugin-macros) on [email protected], which itself depends on yaml: ^1.10.0. That ancient yaml range pulls in versions affected by the stack-overflow advisory GHSA-48c2-rrv3-qjmp (patched in yaml >= 2.8.3).

cosmiconfig shipped a major rewrite in 9.x that drops the yaml dep entirely, so upgrading the cosmiconfig dependency resolves this recurring class of CVE forever, not just this one instance.

This is the same recurring pattern as the previously-resolved #3024 ("Vulnerability reported by Snyk in yaml package (@emotion/[email protected])") — a one-time bump that lasted a few years.

Requested fix

Bump @emotion/babel-plugin's (or babel-plugin-macros') declared cosmiconfig dep from ^7.x to ^9.x. Latest cosmiconfig is 9.0.1 and no longer pulls yaml at all.

The cosmiconfig 7 → 9 migration is mostly an ESM / Node version bump; the API shape consumed by babel-plugin-macros (cosmiconfigSync().search() / .load()) is unchanged.

Reproduction

mkdir emotion-yaml-cve && cd emotion-yaml-cve
npm init -y
npm install @emotion/babel-plugin
npm audit

GHSA-48c2-rrv3-qjmp appears via the nested yaml.

Related

• #3024 — prior Vulnerability reported by Snyk in yaml package (@emotion/[email protected]) (closed, same chain).
• cosmiconfig/cosmiconfig#353 — confirms the yaml dep is gone in 9.x.

Downstream workaround

overrides:
  yaml@<2.8.3: ">=2.8.3"

Works for pnpm users but is brittle and doesn't help the wider npm/yarn ecosystem.