Resolve CVE-2025-9288 CVE-2025-9287 CVE-2025-7783 CVE-2025-6547 (#2317) (#2318)

opensearch-trigger-bot[bot] · github-actions[bot] · web-flow · commit 310abc5cd32d · 2025-10-03T16:04:26.000-04:00
(cherry picked from commit 54348af) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -22,6 +22,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `actions/checkout` from 4 to 5 ([#2295](https://github.com/opensearch-project/security-dashboards-plugin/pull/2295))
 - Bump `derek-ho/start-opensearch` from 7 to 8 ([#2309](https://github.com/opensearch-project/security-dashboards-plugin/pull/2309))
 - Bump `actions/github-script` from 7 to 8 ([#2307](https://github.com/opensearch-project/security-dashboards-plugin/pull/2307))
+- Resolve CVE-2025-9288 CVE-2025-9287 CVE-2025-7783 CVE-2025-6547 ([#2317](https://github.com/opensearch-project/security-dashboards-plugin/pull/2317))
 
 
 ### Documentation
diff --git a/package.json b/package.json
@@ -59,6 +59,9 @@
     "cross-spawn": "7.0.5",
     "xml-crypto": "^2.1.6",
     "@babel/runtime": "^7.27.0",
-    "pbkdf2": "^3.1.3"
+    "pbkdf2": "^3.1.3",
+    "crypto-browserify": "^3.12.1",
+    "cipher-base": "^1.0.7",
+    "sha.js": "^2.4.5"
   }
 }
diff --git a/yarn.lock b/yarn.lock

Original file line number	Diff line number	Diff line change
`@@ -59,6 +59,9 @@`
`59`	`59`	`"cross-spawn": "7.0.5",`
`60`	`60`	`"xml-crypto": "^2.1.6",`
`61`	`61`	`"@babel/runtime": "^7.27.0",`
`62`		`- "pbkdf2": "^3.1.3"`
	`62`	`+ "pbkdf2": "^3.1.3",`
	`63`	`+ "crypto-browserify": "^3.12.1",`
	`64`	`+ "cipher-base": "^1.0.7",`
	`65`	`+ "sha.js": "^2.4.5"`
`63`	`66`	`}`
`64`	`67`	`}`