lfg2025/archy
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases 3 Wiki Activity
Files
main
archy/docs/security/2.1-beta-dependency-dispositions.json
T

1897 lines
89 KiB
JSON
Raw Permalink Blame History

{
"qualification": "source scans only; not artifact or release acceptance",
"entries": [
{
"scope": "AIUI",
"package": "@babel/core",
"advisory": "GHSA-4x5r-pxfx-6jf8",
"title": "@babel/core: Arbitrary File Read via sourceMappingURL Comment",
"source": "https://github.com/advisories/GHSA-4x5r-pxfx-6jf8",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "@babel/plugin-transform-modules-systemjs",
"advisory": "GHSA-fv7c-fp4j-7gwp",
"title": "@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input",
"source": "https://github.com/advisories/GHSA-fv7c-fp4j-7gwp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "@humanfs/node",
"advisory": "GHSA-p498-v437-472g",
"title": "humanfs: Recursive copy follows symlinked files and copies data from outside the source tree",
"source": "https://github.com/advisories/GHSA-p498-v437-472g",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "@storybook/core",
"advisory": "GHSA-f2ph-cmg5-wxc8",
"title": "Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites",
"source": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "@storybook/core",
"advisory": "GHSA-px85-f4q5-jh77",
"title": "Storybook dev server vulnerable to code injection from the local network",
"source": "https://github.com/advisories/GHSA-px85-f4q5-jh77",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "@vitest/mocker",
"advisory": "GHSA-82fw-gwwq-j7x9",
"title": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock",
"source": "https://github.com/advisories/GHSA-82fw-gwwq-j7x9",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "@vitest/mocker",
"advisory": "GHSA-qxg6-89mg-rqv8",
"title": "Vitest: Code injection via unauthenticated manual mock registration",
"source": "https://github.com/advisories/GHSA-qxg6-89mg-rqv8",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "@vue/server-renderer",
"advisory": "GHSA-g2v6-rqmx-r4w6",
"title": "@vue/server-renderer: XSS via missing CR in attribute-name blacklist",
"source": "https://github.com/advisories/GHSA-g2v6-rqmx-r4w6",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "baseline-browser-mapping",
"advisory": "GHSA-w5vr-8v7q-w6rv",
"title": "baseline-browser-mapping process termination on invalid input causes denial of service",
"source": "https://github.com/advisories/GHSA-w5vr-8v7q-w6rv",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "brace-expansion",
"advisory": "GHSA-3jxr-9vmj-r5cp",
"title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
"source": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "brace-expansion",
"advisory": "GHSA-6j4f-fj2g-mc7p",
"title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
"source": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "brace-expansion",
"advisory": "GHSA-f886-m6hf-6m8v",
"title": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"source": "https://github.com/advisories/GHSA-f886-m6hf-6m8v",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "brace-expansion",
"advisory": "GHSA-jxxr-4gwj-5jf2",
"title": "brace-expansion: Large numeric range defeats documented `max` DoS protection",
"source": "https://github.com/advisories/GHSA-jxxr-4gwj-5jf2",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "brace-expansion",
"advisory": "GHSA-mh99-v99m-4gvg",
"title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
"source": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "brace-expansion",
"advisory": "GHSA-q2hr-2g5m-vwhr",
"title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
"source": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "brace-expansion",
"advisory": "GHSA-qhr7-859c-m2p7",
"title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
"source": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "brace-expansion",
"advisory": "GHSA-rgw5-rvv9-x895",
"title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
"source": "https://github.com/advisories/GHSA-rgw5-rvv9-x895",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "browserslist",
"advisory": "GHSA-73wf-gq98-2v4g",
"title": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)",
"source": "https://github.com/advisories/GHSA-73wf-gq98-2v4g",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "browserslist",
"advisory": "GHSA-c83g-rgw3-j3cx",
"title": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM",
"source": "https://github.com/advisories/GHSA-c83g-rgw3-j3cx",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "deepmerge",
"advisory": "GHSA-gcqx-w48m-w2h4",
"title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
"source": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4",
"disposition": "remaining; no upstream compatible patched release selected"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-39q2-94rc-95cp",
"title": "DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",
"source": "https://github.com/advisories/GHSA-39q2-94rc-95cp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-55q2-fjhq-7xh7",
"title": "DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS",
"source": "https://github.com/advisories/GHSA-55q2-fjhq-7xh7",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-6688-9rhm-gjv2",
"title": "DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup \u2014 pure HTML reparse executes",
"source": "https://github.com/advisories/GHSA-6688-9rhm-gjv2",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-76mc-f452-cxcm",
"title": "DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`",
"source": "https://github.com/advisories/GHSA-76mc-f452-cxcm",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-c2j3-45gr-mqc4",
"title": "DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",
"source": "https://github.com/advisories/GHSA-c2j3-45gr-mqc4",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-c6gr-qvv4-5v3f",
"title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml",
"source": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-cj63-jhhr-wcxv",
"title": "DOMPurify USE_PROFILES prototype pollution allows event handlers",
"source": "https://github.com/advisories/GHSA-cj63-jhhr-wcxv",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-cjmm-f4jc-qw8r",
"title": "DOMPurify ADD_ATTR predicate skips URI validation",
"source": "https://github.com/advisories/GHSA-cjmm-f4jc-qw8r",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-cmwh-pvxp-8882",
"title": "DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)",
"source": "https://github.com/advisories/GHSA-cmwh-pvxp-8882",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-crv5-9vww-q3g8",
"title": "DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode",
"source": "https://github.com/advisories/GHSA-crv5-9vww-q3g8",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-gvmj-g25r-r7wr",
"title": "DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes",
"source": "https://github.com/advisories/GHSA-gvmj-g25r-r7wr",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-h7mw-gpvr-xq4m",
"title": "DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)",
"source": "https://github.com/advisories/GHSA-h7mw-gpvr-xq4m",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-h8r8-wccr-v5f2",
"title": "DOMPurify is vulnerable to mutation-XSS via Re-Contextualization ",
"source": "https://github.com/advisories/GHSA-h8r8-wccr-v5f2",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-hpcv-96wg-7vj8",
"title": "DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks",
"source": "https://github.com/advisories/GHSA-hpcv-96wg-7vj8",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-mrv2-3pqr-j5jr",
"title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)",
"source": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-r47g-fvhr-h676",
"title": "DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM",
"source": "https://github.com/advisories/GHSA-r47g-fvhr-h676",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-rp9w-3fw7-7cwq",
"title": "DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content",
"source": "https://github.com/advisories/GHSA-rp9w-3fw7-7cwq",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-v2wj-7wpq-c8vv",
"title": "DOMPurify contains a Cross-site Scripting vulnerability",
"source": "https://github.com/advisories/GHSA-v2wj-7wpq-c8vv",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-v9jr-rg53-9pgp",
"title": "DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback",
"source": "https://github.com/advisories/GHSA-v9jr-rg53-9pgp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-vxr8-fq34-vvx9",
"title": "DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output",
"source": "https://github.com/advisories/GHSA-vxr8-fq34-vvx9",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "dompurify",
"advisory": "GHSA-x4vx-rjvf-j5p4",
"title": "DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects",
"source": "https://github.com/advisories/GHSA-x4vx-rjvf-j5p4",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "esbuild",
"advisory": "GHSA-g7r4-m6w7-qqqr",
"title": "esbuild allows arbitrary file read when running the development server on Windows",
"source": "https://github.com/advisories/GHSA-g7r4-m6w7-qqqr",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-333x-w4r6-6crp",
"title": "fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references",
"source": "https://github.com/advisories/GHSA-333x-w4r6-6crp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-4c8g-83qw-93j6",
"title": "fast-uri vulnerable to host confusion via failed IDN canonicalization",
"source": "https://github.com/advisories/GHSA-4c8g-83qw-93j6",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-7p8r-x3mc-p8w7",
"title": "fast-uri vulnerable to host confusion via backslash authority introducer",
"source": "https://github.com/advisories/GHSA-7p8r-x3mc-p8w7",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-f65p-4m7j-42xc",
"title": "fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization",
"source": "https://github.com/advisories/GHSA-f65p-4m7j-42xc",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-hrr3-gc8f-f4qj",
"title": "fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets",
"source": "https://github.com/advisories/GHSA-hrr3-gc8f-f4qj",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-jqff-g426-hqxp",
"title": "fast-uri vulnerable to host confusion via percent-encoded scheme normalization",
"source": "https://github.com/advisories/GHSA-jqff-g426-hqxp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-q3j6-qgpj-74h6",
"title": "fast-uri vulnerable to path traversal via percent-encoded dot segments",
"source": "https://github.com/advisories/GHSA-q3j6-qgpj-74h6",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-qw65-cvwx-89v3",
"title": "fast-uri vulnerable to authority injection via an unvalidated port in serialize",
"source": "https://github.com/advisories/GHSA-qw65-cvwx-89v3",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-v2hh-gcrm-f6hx",
"title": "fast-uri vulnerable to host confusion via literal backslash authority delimiter",
"source": "https://github.com/advisories/GHSA-v2hh-gcrm-f6hx",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-v39h-62p7-jpjc",
"title": "fast-uri vulnerable to host confusion via percent-encoded authority delimiters",
"source": "https://github.com/advisories/GHSA-v39h-62p7-jpjc",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-w74x-v6f9-j3xg",
"title": "fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding",
"source": "https://github.com/advisories/GHSA-w74x-v6f9-j3xg",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "fast-uri",
"advisory": "GHSA-xhq7-xmqj-769h",
"title": "fast-uri vulnerable to improper path equivalence in relative reference normalization",
"source": "https://github.com/advisories/GHSA-xhq7-xmqj-769h",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "flatted",
"advisory": "GHSA-25h7-pfq9-p65f",
"title": "flatted vulnerable to unbounded recursion DoS in parse() revive phase",
"source": "https://github.com/advisories/GHSA-25h7-pfq9-p65f",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "flatted",
"advisory": "GHSA-rf6f-7fwh-wjgh",
"title": "Prototype Pollution via parse() in NodeJS flatted",
"source": "https://github.com/advisories/GHSA-rf6f-7fwh-wjgh",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "glob",
"advisory": "GHSA-3g3m-2fjr-6pw4",
"title": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal",
"source": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "happy-dom",
"advisory": "GHSA-5fpq-26gf-qwcr",
"title": "Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies",
"source": "https://github.com/advisories/GHSA-5fpq-26gf-qwcr",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "happy-dom",
"advisory": "GHSA-6q6h-j7hj-3r64",
"title": "Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code",
"source": "https://github.com/advisories/GHSA-6q6h-j7hj-3r64",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "happy-dom",
"advisory": "GHSA-834v-8h66-3h79",
"title": "Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution",
"source": "https://github.com/advisories/GHSA-834v-8h66-3h79",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "happy-dom",
"advisory": "GHSA-c8p4-j97h-3vg8",
"title": "Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML",
"source": "https://github.com/advisories/GHSA-c8p4-j97h-3vg8",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "happy-dom",
"advisory": "GHSA-w4gp-fjgq-3q4g",
"title": "Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies",
"source": "https://github.com/advisories/GHSA-w4gp-fjgq-3q4g",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "katex",
"advisory": "GHSA-238p-pmpm-9mq7",
"title": "KaTeX: Existing prototype pollution can bypass trust restrictions",
"source": "https://github.com/advisories/GHSA-238p-pmpm-9mq7",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "linkify-it",
"advisory": "GHSA-22p9-wv53-3rq4",
"title": "LinkifyIt#match scan loop has quadratic algorithmic complexity",
"source": "https://github.com/advisories/GHSA-22p9-wv53-3rq4",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "linkify-it",
"advisory": "GHSA-v245-v573-v5vm",
"title": "linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text",
"source": "https://github.com/advisories/GHSA-v245-v573-v5vm",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "lodash",
"advisory": "GHSA-f23m-r3pf-42rh",
"title": "lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt",
"source": "https://github.com/advisories/GHSA-f23m-r3pf-42rh",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "lodash",
"advisory": "GHSA-r5fr-rjxr-66jc",
"title": "lodash vulnerable to Code Injection via `_.template` imports key names",
"source": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "lodash-es",
"advisory": "GHSA-f23m-r3pf-42rh",
"title": "lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt",
"source": "https://github.com/advisories/GHSA-f23m-r3pf-42rh",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "lodash-es",
"advisory": "GHSA-r5fr-rjxr-66jc",
"title": "lodash vulnerable to Code Injection via `_.template` imports key names",
"source": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "markdown-it",
"advisory": "GHSA-253c-mchw-3w2r",
"title": "markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds",
"source": "https://github.com/advisories/GHSA-253c-mchw-3w2r",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "markdown-it",
"advisory": "GHSA-6v5v-wf23-fmfq",
"title": "markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations",
"source": "https://github.com/advisories/GHSA-6v5v-wf23-fmfq",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "markdown-it",
"advisory": "GHSA-gfr2-rv44-r23c",
"title": "markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)",
"source": "https://github.com/advisories/GHSA-gfr2-rv44-r23c",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "markdown-it",
"advisory": "GHSA-r7fv-28h4-cvq7",
"title": "markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes",
"source": "https://github.com/advisories/GHSA-r7fv-28h4-cvq7",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "markdown-it",
"advisory": "GHSA-vfgh-jcmw-g37q",
"title": "markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled",
"source": "https://github.com/advisories/GHSA-vfgh-jcmw-g37q",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "mermaid",
"advisory": "GHSA-2v8p-3f2j-5mp7",
"title": "Mermaid XY Charts are vulnerable to an infinite loop DoS",
"source": "https://github.com/advisories/GHSA-2v8p-3f2j-5mp7",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "mermaid",
"advisory": "GHSA-3rrr-jr9j-h3q3",
"title": "Mermaid Architecture diagrams are vulnerable to prototype pollution",
"source": "https://github.com/advisories/GHSA-3rrr-jr9j-h3q3",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "mermaid",
"advisory": "GHSA-6m6c-36f7-fhxh",
"title": "Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS",
"source": "https://github.com/advisories/GHSA-6m6c-36f7-fhxh",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "mermaid",
"advisory": "GHSA-6x64-9x62-f2gx",
"title": "Mermaid allows CSS injection applying to sibling elements of the diagram",
"source": "https://github.com/advisories/GHSA-6x64-9x62-f2gx",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "mermaid",
"advisory": "GHSA-87f9-hvmw-gh4p",
"title": "Mermaid: Improper sanitization of configuration leads to CSS injection",
"source": "https://github.com/advisories/GHSA-87f9-hvmw-gh4p",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "mermaid",
"advisory": "GHSA-c4c3-pg64-4m4v",
"title": "Mermaid configuration APIs allow prototype pollution",
"source": "https://github.com/advisories/GHSA-c4c3-pg64-4m4v",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "mermaid",
"advisory": "GHSA-ghcm-xqfw-q4vr",
"title": "Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection",
"source": "https://github.com/advisories/GHSA-ghcm-xqfw-q4vr",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "mermaid",
"advisory": "GHSA-rhh3-jpg6-66xh",
"title": "Mermaid radar diagrams are vulnerable to DoS",
"source": "https://github.com/advisories/GHSA-rhh3-jpg6-66xh",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "mermaid",
"advisory": "GHSA-xcj9-5m2h-648r",
"title": "Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection",
"source": "https://github.com/advisories/GHSA-xcj9-5m2h-648r",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "minimatch",
"advisory": "GHSA-g3hv-75wg-m249",
"title": "minimatch has potential denial of service via globparts amplification",
"source": "https://github.com/advisories/GHSA-g3hv-75wg-m249",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "nanoid",
"advisory": "GHSA-28wg-ghj8-5hjv",
"title": "nanoid: non-secure generators can loop indefinitely with negative size",
"source": "https://github.com/advisories/GHSA-28wg-ghj8-5hjv",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "nanoid",
"advisory": "GHSA-2v37-7h3g-55p8",
"title": "nanoid: custom generators can loop indefinitely when size is zero",
"source": "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "nanoid",
"advisory": "GHSA-xwg4-73v4-xw9w",
"title": "nanoid: Integer Overflow or Wraparound",
"source": "https://github.com/advisories/GHSA-xwg4-73v4-xw9w",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "pdfjs-dist",
"advisory": "GHSA-hq66-cqwq-w95j",
"title": "PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF ",
"source": "https://github.com/advisories/GHSA-hq66-cqwq-w95j",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "picomatch",
"advisory": "GHSA-3v7f-55p6-f55p",
"title": "Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"source": "https://github.com/advisories/GHSA-3v7f-55p6-f55p",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "picomatch",
"advisory": "GHSA-c2c7-rcm5-vvqj",
"title": "Picomatch has a ReDoS vulnerability via extglob quantifiers",
"source": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "postcss",
"advisory": "GHSA-6g55-p6wh-862q",
"title": "PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments",
"source": "https://github.com/advisories/GHSA-6g55-p6wh-862q",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "postcss",
"advisory": "GHSA-fxqj-rqcc-2cmp",
"title": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
"source": "https://github.com/advisories/GHSA-fxqj-rqcc-2cmp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "postcss",
"advisory": "GHSA-qx2v-qp2m-jg93",
"title": "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"source": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "postcss",
"advisory": "GHSA-r28c-9q8g-f849",
"title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",
"source": "https://github.com/advisories/GHSA-r28c-9q8g-f849",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "postcss-selector-parser",
"advisory": "GHSA-rj75-hqrm-r3gf",
"title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion",
"source": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "postcss-selector-parser",
"advisory": "GHSA-w9m9-85wc-3x92",
"title": "postcss-selector-parser allows denial of service through uncontrolled AST recursion",
"source": "https://github.com/advisories/GHSA-w9m9-85wc-3x92",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "serialize-javascript",
"advisory": "GHSA-5c6j-r48x-rmvq",
"title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
"source": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "serialize-javascript",
"advisory": "GHSA-m5mm-p8h7-m29v",
"title": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body",
"source": "https://github.com/advisories/GHSA-m5mm-p8h7-m29v",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "serialize-javascript",
"advisory": "GHSA-qj8w-gfj5-8c6v",
"title": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects",
"source": "https://github.com/advisories/GHSA-qj8w-gfj5-8c6v",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "source-map-js",
"advisory": "GHSA-68fv-2mgg-jv7q",
"title": "source-map-js allows event-loop denial of service through indexed source-map section offsets",
"source": "https://github.com/advisories/GHSA-68fv-2mgg-jv7q",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "storybook",
"advisory": "GHSA-f2ph-cmg5-wxc8",
"title": "Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites",
"source": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "storybook",
"advisory": "GHSA-px85-f4q5-jh77",
"title": "Storybook dev server vulnerable to code injection from the local network",
"source": "https://github.com/advisories/GHSA-px85-f4q5-jh77",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "turbo",
"advisory": "GHSA-3qcw-2rhx-2726",
"title": "Turbo: Unexpected local code execution during Yarn Berry detection",
"source": "https://github.com/advisories/GHSA-3qcw-2rhx-2726",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "turbo",
"advisory": "GHSA-hcf7-66rw-9f5r",
"title": "Turbo: Login callback CSRF/session fixation",
"source": "https://github.com/advisories/GHSA-hcf7-66rw-9f5r",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "uuid",
"advisory": "GHSA-w5hq-g745-h8pq",
"title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"source": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vite",
"advisory": "GHSA-4w7w-66w2-5vf9",
"title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"source": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vite",
"advisory": "GHSA-587h-7wmj-h5pm",
"title": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows",
"source": "https://github.com/advisories/GHSA-587h-7wmj-h5pm",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vite",
"advisory": "GHSA-698v-4r3x-3vcv",
"title": "launch-editor: escapeCmdArgs() omits % escaping on Windows",
"source": "https://github.com/advisories/GHSA-698v-4r3x-3vcv",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vite",
"advisory": "GHSA-9jrq-w75r-8gcw",
"title": "Vite: Cross origin script execution through Vite custom middleware",
"source": "https://github.com/advisories/GHSA-9jrq-w75r-8gcw",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vite",
"advisory": "GHSA-fx2h-pf6j-xcff",
"title": "vite: `server.fs.deny` bypass on Windows alternate paths",
"source": "https://github.com/advisories/GHSA-fx2h-pf6j-xcff",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vite",
"advisory": "GHSA-p9ff-h696-f583",
"title": "Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket",
"source": "https://github.com/advisories/GHSA-p9ff-h696-f583",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vite",
"advisory": "GHSA-r825-w8mm-5pxw",
"title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors",
"source": "https://github.com/advisories/GHSA-r825-w8mm-5pxw",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vite",
"advisory": "GHSA-rq7h-c2jc-7f22",
"title": "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine",
"source": "https://github.com/advisories/GHSA-rq7h-c2jc-7f22",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vite",
"advisory": "GHSA-v2wj-q39q-566r",
"title": "Vite: `server.fs.deny` bypassed with queries",
"source": "https://github.com/advisories/GHSA-v2wj-q39q-566r",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vite",
"advisory": "GHSA-v6wh-96g9-6wx3",
"title": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
"source": "https://github.com/advisories/GHSA-v6wh-96g9-6wx3",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vitest",
"advisory": "GHSA-5xrq-8626-4rwp",
"title": "When Vitest UI server is listening, arbitrary file can be read and executed",
"source": "https://github.com/advisories/GHSA-5xrq-8626-4rwp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "vitest",
"advisory": "GHSA-82fw-gwwq-j7x9",
"title": "Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock",
"source": "https://github.com/advisories/GHSA-82fw-gwwq-j7x9",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "ws",
"advisory": "GHSA-58qx-3vcg-4xpx",
"title": "ws: Uninitialized memory disclosure",
"source": "https://github.com/advisories/GHSA-58qx-3vcg-4xpx",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "ws",
"advisory": "GHSA-96hv-2xvq-fx4p",
"title": "ws: Memory exhaustion DoS from tiny fragments and data chunks",
"source": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "AIUI",
"package": "yaml",
"advisory": "GHSA-48c2-rrv3-qjmp",
"title": "yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"source": "https://github.com/advisories/GHSA-48c2-rrv3-qjmp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "Android Rust",
"package": "paste",
"advisory": "RUSTSEC-2024-0436",
"title": "paste - no longer maintained",
"source": "https://rustsec.org/advisories/RUSTSEC-2024-0436.html",
"disposition": "remaining; no upstream compatible patched release selected"
},
{
"scope": "Android Rust",
"package": "tokio",
"advisory": "RUSTSEC-2026-0386",
"title": "`AsyncFd::new` and related constructors violate I/O safety",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0386.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "Android Rust",
"package": "unsafe-libyaml",
"advisory": "RUSTSEC-2024-0449",
"title": "unsafe-libyaml is unmaintained",
"source": "https://rustsec.org/advisories/RUSTSEC-2024-0449.html",
"disposition": "remaining; no upstream compatible patched release selected"
},
{
"scope": "dashboard",
"package": "@intlify/core-base",
"advisory": "GHSA-83rm-6c8r-g728",
"title": "Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages",
"source": "https://github.com/advisories/GHSA-83rm-6c8r-g728",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "@intlify/core-base",
"advisory": "GHSA-8rc2-428q-7ww3",
"title": "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list",
"source": "https://github.com/advisories/GHSA-8rc2-428q-7ww3",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "@intlify/shared",
"advisory": "GHSA-83rm-6c8r-g728",
"title": "Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages",
"source": "https://github.com/advisories/GHSA-83rm-6c8r-g728",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "body-parser",
"advisory": "GHSA-27r3-jxmh-p828",
"title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body",
"source": "https://github.com/advisories/GHSA-27r3-jxmh-p828",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "deepmerge",
"advisory": "GHSA-gcqx-w48m-w2h4",
"title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
"source": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4",
"disposition": "remaining; no upstream compatible patched release selected"
},
{
"scope": "dashboard",
"package": "dompurify",
"advisory": "GHSA-c6gr-qvv4-5v3f",
"title": "DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml",
"source": "https://github.com/advisories/GHSA-c6gr-qvv4-5v3f",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "dompurify",
"advisory": "GHSA-cg2g-xh64-v4q7",
"title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes",
"source": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "dompurify",
"advisory": "GHSA-mrv2-3pqr-j5jr",
"title": "DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)",
"source": "https://github.com/advisories/GHSA-mrv2-3pqr-j5jr",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "fast-uri",
"advisory": "GHSA-333x-w4r6-6crp",
"title": "fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references",
"source": "https://github.com/advisories/GHSA-333x-w4r6-6crp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "fast-uri",
"advisory": "GHSA-w74x-v6f9-j3xg",
"title": "fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding",
"source": "https://github.com/advisories/GHSA-w74x-v6f9-j3xg",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "fast-uri",
"advisory": "GHSA-wjr9-j795-jxcr",
"title": "fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization",
"source": "https://github.com/advisories/GHSA-wjr9-j795-jxcr",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "fast-uri",
"advisory": "GHSA-xhq7-xmqj-769h",
"title": "fast-uri vulnerable to improper path equivalence in relative reference normalization",
"source": "https://github.com/advisories/GHSA-xhq7-xmqj-769h",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "glob",
"advisory": "GHSA-3g3m-2fjr-6pw4",
"title": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal",
"source": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "minimatch",
"advisory": "GHSA-g3hv-75wg-m249",
"title": "minimatch has potential denial of service via globparts amplification",
"source": "https://github.com/advisories/GHSA-g3hv-75wg-m249",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "postcss-selector-parser",
"advisory": "GHSA-rj75-hqrm-r3gf",
"title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion",
"source": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "qs",
"advisory": "GHSA-4mjr-xmp4-gh2g",
"title": "qs: Denial of Service via Attacker Controlled isBuffer",
"source": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "qs",
"advisory": "GHSA-6pq8-jhm2-2vcw",
"title": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)",
"source": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "qs",
"advisory": "GHSA-q8mj-m7cp-5q26",
"title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"source": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "qs",
"advisory": "GHSA-x5fp-wj9c-mxmx",
"title": "qs array-limit bypass via bracket-key comma parsing",
"source": "https://github.com/advisories/GHSA-x5fp-wj9c-mxmx",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "serialize-javascript",
"advisory": "GHSA-m5mm-p8h7-m29v",
"title": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body",
"source": "https://github.com/advisories/GHSA-m5mm-p8h7-m29v",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "vue-i18n",
"advisory": "GHSA-83rm-6c8r-g728",
"title": "Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages",
"source": "https://github.com/advisories/GHSA-83rm-6c8r-g728",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "dashboard",
"package": "vue-i18n",
"advisory": "GHSA-8rc2-428q-7ww3",
"title": "Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list",
"source": "https://github.com/advisories/GHSA-8rc2-428q-7ww3",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "@vue/server-renderer",
"advisory": "GHSA-g2v6-rqmx-r4w6",
"title": "@vue/server-renderer: XSS via missing CR in attribute-name blacklist",
"source": "https://github.com/advisories/GHSA-g2v6-rqmx-r4w6",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "body-parser",
"advisory": "GHSA-27r3-jxmh-p828",
"title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body",
"source": "https://github.com/advisories/GHSA-27r3-jxmh-p828",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "body-parser",
"advisory": "GHSA-v422-hmwv-36x6",
"title": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
"source": "https://github.com/advisories/GHSA-v422-hmwv-36x6",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "brace-expansion",
"advisory": "GHSA-3jxr-9vmj-r5cp",
"title": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",
"source": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "brace-expansion",
"advisory": "GHSA-6j4f-fj2g-mc7p",
"title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
"source": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "brace-expansion",
"advisory": "GHSA-mh99-v99m-4gvg",
"title": "brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
"source": "https://github.com/advisories/GHSA-mh99-v99m-4gvg",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "brace-expansion",
"advisory": "GHSA-q2hr-2g5m-vwhr",
"title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
"source": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "brace-expansion",
"advisory": "GHSA-qhr7-859c-m2p7",
"title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
"source": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "brace-expansion",
"advisory": "GHSA-rgw5-rvv9-x895",
"title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
"source": "https://github.com/advisories/GHSA-rgw5-rvv9-x895",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "esbuild",
"advisory": "GHSA-67mh-4wv8-2f99",
"title": "esbuild enables any website to send any requests to the development server and read the response",
"source": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "minimatch",
"advisory": "GHSA-g3hv-75wg-m249",
"title": "minimatch has potential denial of service via globparts amplification",
"source": "https://github.com/advisories/GHSA-g3hv-75wg-m249",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "nanoid",
"advisory": "GHSA-28wg-ghj8-5hjv",
"title": "nanoid: non-secure generators can loop indefinitely with negative size",
"source": "https://github.com/advisories/GHSA-28wg-ghj8-5hjv",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "nanoid",
"advisory": "GHSA-2v37-7h3g-55p8",
"title": "nanoid: custom generators can loop indefinitely when size is zero",
"source": "https://github.com/advisories/GHSA-2v37-7h3g-55p8",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "path-to-regexp",
"advisory": "GHSA-37ch-88jc-xwx2",
"title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
"source": "https://github.com/advisories/GHSA-37ch-88jc-xwx2",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "path-to-regexp",
"advisory": "GHSA-rhx6-c78j-4q9w",
"title": "path-to-regexp contains a ReDoS",
"source": "https://github.com/advisories/GHSA-rhx6-c78j-4q9w",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "postcss",
"advisory": "GHSA-fxqj-rqcc-2cmp",
"title": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
"source": "https://github.com/advisories/GHSA-fxqj-rqcc-2cmp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "postcss",
"advisory": "GHSA-r28c-9q8g-f849",
"title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",
"source": "https://github.com/advisories/GHSA-r28c-9q8g-f849",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "proxy-addr",
"advisory": "GHSA-jqcg-44mw-7w3h",
"title": "proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet",
"source": "https://github.com/advisories/GHSA-jqcg-44mw-7w3h",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "qs",
"advisory": "GHSA-4mjr-xmp4-gh2g",
"title": "qs: Denial of Service via Attacker Controlled isBuffer",
"source": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "qs",
"advisory": "GHSA-6pq8-jhm2-2vcw",
"title": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)",
"source": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "qs",
"advisory": "GHSA-6rw7-vpxm-498p",
"title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
"source": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "qs",
"advisory": "GHSA-q8mj-m7cp-5q26",
"title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"source": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "qs",
"advisory": "GHSA-w7fw-mjwx-w883",
"title": "qs's arrayLimit bypass in comma parsing allows denial of service",
"source": "https://github.com/advisories/GHSA-w7fw-mjwx-w883",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "source-map-js",
"advisory": "GHSA-68fv-2mgg-jv7q",
"title": "source-map-js allows event-loop denial of service through indexed source-map section offsets",
"source": "https://github.com/advisories/GHSA-68fv-2mgg-jv7q",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-356w-63v5-8wf4",
"title": "Vite has an `server.fs.deny` bypass with an invalid `request-target`",
"source": "https://github.com/advisories/GHSA-356w-63v5-8wf4",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-4r4m-qw57-chr8",
"title": "Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query",
"source": "https://github.com/advisories/GHSA-4r4m-qw57-chr8",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-4w7w-66w2-5vf9",
"title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"source": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-587h-7wmj-h5pm",
"title": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows",
"source": "https://github.com/advisories/GHSA-587h-7wmj-h5pm",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-698v-4r3x-3vcv",
"title": "launch-editor: escapeCmdArgs() omits % escaping on Windows",
"source": "https://github.com/advisories/GHSA-698v-4r3x-3vcv",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-859w-5945-r5v3",
"title": "Vite's server.fs.deny bypassed with /. for files under project root",
"source": "https://github.com/advisories/GHSA-859w-5945-r5v3",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-93m4-6634-74q7",
"title": "vite allows server.fs.deny bypass via backslash on Windows",
"source": "https://github.com/advisories/GHSA-93m4-6634-74q7",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-9jrq-w75r-8gcw",
"title": "Vite: Cross origin script execution through Vite custom middleware",
"source": "https://github.com/advisories/GHSA-9jrq-w75r-8gcw",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-fx2h-pf6j-xcff",
"title": "vite: `server.fs.deny` bypass on Windows alternate paths",
"source": "https://github.com/advisories/GHSA-fx2h-pf6j-xcff",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-g4jq-h2w9-997c",
"title": "Vite middleware may serve files starting with the same name with the public directory",
"source": "https://github.com/advisories/GHSA-g4jq-h2w9-997c",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-jqfw-vq24-v9c3",
"title": "Vite's `server.fs` settings were not applied to HTML files",
"source": "https://github.com/advisories/GHSA-jqfw-vq24-v9c3",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-p9ff-h696-f583",
"title": "Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket",
"source": "https://github.com/advisories/GHSA-p9ff-h696-f583",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-r825-w8mm-5pxw",
"title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors",
"source": "https://github.com/advisories/GHSA-r825-w8mm-5pxw",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-rq7h-c2jc-7f22",
"title": "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine",
"source": "https://github.com/advisories/GHSA-rq7h-c2jc-7f22",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-v6wh-96g9-6wx3",
"title": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
"source": "https://github.com/advisories/GHSA-v6wh-96g9-6wx3",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-vg6x-rcgg-rjx6",
"title": "Websites were able to send any requests to the development server and read the response in vite",
"source": "https://github.com/advisories/GHSA-vg6x-rcgg-rjx6",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-x574-m823-4x7w",
"title": "Vite bypasses server.fs.deny when using ?raw??",
"source": "https://github.com/advisories/GHSA-x574-m823-4x7w",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "vite",
"advisory": "GHSA-xcj6-pq6g-qj4x",
"title": "Vite allows server.fs.deny to be bypassed with .svg or relative paths",
"source": "https://github.com/advisories/GHSA-xcj6-pq6g-qj4x",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "gashboard",
"package": "zod",
"advisory": "GHSA-mrhx-c7xc-m3w5",
"title": "Zod can exhaust memory while validating oversized constrained collections",
"source": "https://github.com/advisories/GHSA-mrhx-c7xc-m3w5",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "anyhow",
"advisory": "RUSTSEC-2026-0190",
"title": "Unsoundness in `Error::downcast_mut()`",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0190.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "bytes",
"advisory": "RUSTSEC-2026-0007",
"title": "Integer overflow in `BytesMut::reserve`",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0007.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "h2",
"advisory": "RUSTSEC-2026-0258",
"title": "h2 unbounded empty DATA frames",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0258.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "instant",
"advisory": "RUSTSEC-2024-0384",
"title": "`instant` is unmaintained",
"source": "https://rustsec.org/advisories/RUSTSEC-2024-0384.html",
"disposition": "remaining; no upstream compatible patched release selected"
},
{
"scope": "node Rust",
"package": "libz-sys",
"advisory": "RUSTSEC-2026-0418",
"title": "libz-sys build script leaks environment variables in the build directory",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0418.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "negentropy",
"advisory": "RUSTSEC-2026-0365",
"title": " Remote DoS through unchecked `IdList` allocation in negentropy",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0365.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "paste",
"advisory": "RUSTSEC-2024-0436",
"title": "paste - no longer maintained",
"source": "https://rustsec.org/advisories/RUSTSEC-2024-0436.html",
"disposition": "remaining; no upstream compatible patched release selected"
},
{
"scope": "node Rust",
"package": "pin-utils",
"advisory": "RUSTSEC-2026-0441",
"title": "`pin-utils` is unmaintained",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0441.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "quick-xml",
"advisory": "RUSTSEC-2026-0194",
"title": "Quadratic run time when checking a start tag for duplicate attribute names",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0194.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "quick-xml",
"advisory": "RUSTSEC-2026-0195",
"title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0195.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "rand",
"advisory": "RUSTSEC-2026-0097",
"title": "Rand is unsound with a custom logger using `rand::rng()`",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0097.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "rustls",
"advisory": "RUSTSEC-2026-0285",
"title": "TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0285.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "rustls",
"advisory": "RUSTSEC-2026-0346",
"title": "`Debug` impls for client session values expose TLS secrets",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0346.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "rustls",
"advisory": "RUSTSEC-2026-0348",
"title": "Brotli certificate decompression can allocate up to 1 GiB before authentication",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0348.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "rustls",
"advisory": "RUSTSEC-2026-0349",
"title": "Unauthenticated ServerHello can downgrade later connections to classical key exchange",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0349.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "rustls-pemfile",
"advisory": "RUSTSEC-2025-0134",
"title": "rustls-pemfile is unmaintained",
"source": "https://rustsec.org/advisories/RUSTSEC-2025-0134.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "rustls-webpki",
"advisory": "RUSTSEC-2026-0049",
"title": "CRLs not considered authoritative by Distribution Point due to faulty matching logic",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0049.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "rustls-webpki",
"advisory": "RUSTSEC-2026-0098",
"title": "Name constraints for URI names were incorrectly accepted",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0098.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "rustls-webpki",
"advisory": "RUSTSEC-2026-0099",
"title": "Name constraints were accepted for certificates asserting a wildcard name",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0099.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "rustls-webpki",
"advisory": "RUSTSEC-2026-0104",
"title": "Reachable panic in certificate revocation list parsing",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0104.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "rustls-webpki",
"advisory": "RUSTSEC-2026-0382",
"title": "Certificate verification may accept distrusted intermediates",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0382.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "tar",
"advisory": "RUSTSEC-2026-0067",
"title": "`unpack_in` can chmod arbitrary directories by following symlinks",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0067.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "tar",
"advisory": "RUSTSEC-2026-0068",
"title": "tar-rs incorrectly ignores PAX size headers if header size is nonzero",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0068.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "unsafe-libyaml",
"advisory": "RUSTSEC-2024-0449",
"title": "unsafe-libyaml is unmaintained",
"source": "https://rustsec.org/advisories/RUSTSEC-2024-0449.html",
"disposition": "remaining; no upstream compatible patched release selected"
},
{
"scope": "node Rust",
"package": "webpki-roots",
"advisory": "RUSTSEC-2026-0381",
"title": "Bundled root certificates allow trust in distrusted emSign intermediates",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0381.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "zip",
"advisory": "RUSTSEC-2026-0367",
"title": " Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0367.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "zip",
"advisory": "RUSTSEC-2026-0368",
"title": "zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0368.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "zip",
"advisory": "RUSTSEC-2026-0369",
"title": "ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0369.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "node Rust",
"package": "zip",
"advisory": "RUSTSEC-2026-0429",
"title": "zip: `ZipArchive::extract` aborts the process on a symlink entry with a large declared size",
"source": "https://rustsec.org/advisories/RUSTSEC-2026-0429.html",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "router",
"package": "body-parser",
"advisory": "GHSA-27r3-jxmh-p828",
"title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body",
"source": "https://github.com/advisories/GHSA-27r3-jxmh-p828",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "router",
"package": "body-parser",
"advisory": "GHSA-v422-hmwv-36x6",
"title": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",
"source": "https://github.com/advisories/GHSA-v422-hmwv-36x6",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "router",
"package": "ip",
"advisory": "GHSA-2p57-rm9w-gvfp",
"title": "ip SSRF improper categorization in isPublic",
"source": "https://github.com/advisories/GHSA-2p57-rm9w-gvfp",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "router",
"package": "path-to-regexp",
"advisory": "GHSA-37ch-88jc-xwx2",
"title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
"source": "https://github.com/advisories/GHSA-37ch-88jc-xwx2",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "router",
"package": "proxy-addr",
"advisory": "GHSA-jqcg-44mw-7w3h",
"title": "proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet",
"source": "https://github.com/advisories/GHSA-jqcg-44mw-7w3h",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "router",
"package": "qs",
"advisory": "GHSA-4mjr-xmp4-gh2g",
"title": "qs: Denial of Service via Attacker Controlled isBuffer",
"source": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "router",
"package": "qs",
"advisory": "GHSA-6pq8-jhm2-2vcw",
"title": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)",
"source": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "router",
"package": "qs",
"advisory": "GHSA-q8mj-m7cp-5q26",
"title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"source": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "router",
"package": "qs",
"advisory": "GHSA-w7fw-mjwx-w883",
"title": "qs's arrayLimit bypass in comma parsing allows denial of service",
"source": "https://github.com/advisories/GHSA-w7fw-mjwx-w883",
"disposition": "not reported by current scan after dependency update; runtime qualification pending"
},
{
"scope": "Python resolved runtime/build graph",
"package": "ecdsa",
"version": "0.19.2",
"parent": "esptool==4.8.1",
"advisory": "GHSA-wj6h-64fc-37mp",
"aliases": [
"CVE-2024-23342",
"PYSEC-2026-1325"
],
"title": "Minerva timing attack on P-256 in python-ecdsa",
"source": "https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp",
"disposition": "removed from the current resolved Python runtime/build graph by the esptool5.6.0 migration; no advisory suppression; frozen-artifact and physical ESP acceptance remain pending",
"reachability": "Historical esptool4.8.1 brought ecdsa0.19.2. Pinned esptool5.6.0 declares cryptography instead; all23 newly resolved coordinates and exact artifact hashes are recorded, with ecdsa absent and zero OSV findings. Real v5 source CLI/resource/reset/PTY tests pass. This does not prove old installed artifacts have been replaced.",
"next_action": "Parent isolated flash.rs regression, then later immutable frozen-binary content/self-test qualification and authorized physical ESP serial workflow acceptance. No release or live flash performed by this source change.",
"evidence": [
"/home/archipelago/Reports/next-release-nine-issues-20261109/python-osv-resolved-r1.json",
"/home/archipelago/Reports/next-release-nine-issues-20261109/python-resolution-linux-x86_64-r1.json",
"/home/archipelago/Reports/next-release-nine-issues-20261109/python-resolution-linux-x86_64-r2.json",
"/home/archipelago/Reports/next-release-nine-issues-20261109/python-osv-resolved-r2.json",
"docs/security/2.1-beta-esptool-v5.md"
],
"migration_sources": [
"https://github.com/espressif/esptool/blob/v5.6.0/pyproject.toml",
"https://github.com/espressif/esptool/blob/v5.6.0/esptool/__init__.py",
"https://docs.espressif.com/projects/esptool/en/latest/esp32/migration-guide.html"
]
}
],
"license_review_items": [
{
"packages": [
"rns@1.3.5",
"lxmf@1.0.1"
],
"terms": "Reticulum License (custom use restrictions and notice retention)",
"status": "declared; usage and distribution obligations require review, not MIT"
},
{
"packages": [
"pyinstaller@6.21.0",
"pyinstaller-hooks-contrib@2026.9"
],
"terms": "GPL and Apache file scopes; PyInstaller bootloader exception and isolated-module MIT alternative",
"status": "declared; apply exact file scope and preserve dependency obligations"
},
{
"packages": [
"esptool@5.6.0"
],
"terms": "GPL-2.0-or-later with additional bundled stub notices",
"status": "declared; frozen artifact contents and notices remain unqualified"
},
{
"packages": [
"rns@1.3.5"
],
"terms": "Published wheel and sdist omit LICENSE despite metadata declaration",
"status": "exact release-tag commit LICENSE retained as source evidence; ensure distributed notices include applicable terms"
}
],
"python_resolution_scope": {
"environment": {
"implementation_name": "cpython",
"implementation_version": "3.13.5",
"os_name": "posix",
"platform_machine": "x86_64",
"platform_release": "6.12.113+deb13-amd64",
"platform_system": "Linux",
"platform_version": "#1 SMP PREEMPT_DYNAMIC Debian 6.12.113-1 (2026-10-15)",
"python_full_version": "3.13.5",
"platform_python_implementation": "CPython",
"python_version": "3.13",
"sys_platform": "linux"
},
"components": 20,
"roots": [
"esptool==4.8.1",
"lxmf==1.0.1",
"pyinstaller==6.21.0",
"rns==1.3.5"
],
"qualification": "20 coordinates queried; one high finding represented by GHSA/PYSEC aliases; platform-specific point-in-time report, not a checked-in lock"
}
}
Reference in New Issue View Git Blame Copy Permalink