GHSA-3pg2-h62q-24j6: 
JavaScript vulnerability analysis and mitigation

Impact

The chart tick generator (extendDomainToNice in packages/ui/src/charts/core/svg.ts on main, and the same function in @k2b/stdlib charts that released Cloud versions draw with) counts from the lowest to the highest tick with v += step. When the plotted values are large and nearly equal, for example a single value at or above about 2^54 (1.8 × 10^16), the step is smaller than the float spacing of the values. v + step then equals v, the loop never ends, and the tick array grows until the process runs out of memory. Grids custom app pages draw their charts during server-side rendering. A line chart block whose source aggregates one bucket to such a value (for example one record with 100000000000000000 in a number field, which the default number field accepts) blocks the Grids process on every request for that page, signed-in or anonymous, and also in the builder preview. While it runs, every other Grids request on the installation waits; the process then fails on memory and is restarted, and the next page view repeats it. Anyone who can put such a value into a table that feeds a line chart on a custom app page can cause this: Grids members with write access to the table, and, if the table takes submissions from a public form, anonymous submitters. The impact is availability only; no data is disclosed or changed. AI chart blocks in chat, Notebooks chart blocks, AI views and the chat explorer are not affected: their schema rejects values that the renderer cannot step (chartSteppingIssue), or they pass a fixed domain. Pulse public dashboards draw their panels only in the browser. Code and assistant cloud.chart() runs draw inside a terminable browser worker with a watchdog.

Patches

Fixed in Cloud 0.68.0 (images and CLI v0.68.0) and @k2b/ui 0.50.0, which @k2b/cloud 0.61.0 pins. The fix makes the chart core's domain and tick math finish for every finite input: tick loops stop when a step no longer advances and keep a bounded number of ticks, so the ends of the domain stay drawn. Output for all other inputs is unchanged. Regression tests draw every axis kind with such values in a bounded child process. Update Grids together with Core and the other services to 0.68.0, and rebuild standalone applications on @k2b/cloud 0.61.0.

Workarounds

Until you can deploy 0.68.0, remove line chart blocks whose source can reach very large values from custom app pages, or set a maximum well below 10^15 on number fields that feed them, and close public forms on those tables. Correct a record that already holds such a value in the table, outside the custom app page.

References

@k2b/stdlib carries the same function and is informed separately.