Impact

Lily makes use of Cozy's Welcome Channel module, which contains the affected dependency

Patches

In the latest LilyBot version (v4.8.3) we bump our dependency on the welcome channel module to 1.0.1-SNAPSHOT which contains the fixed versions

Workarounds

None.

References

• Security advisory for the Cozy Modules (QuiltMC/cozy-discord, GHSA-4725-965f-99mw)
• Security advisory for the YAML parser (charleskorn/kaml, GHSA-c24f-2j3g-rg48)
• Wikipedia explanation of the Billion Laughs Attack, which is the vulnerability in question here.