From 80afcd1c80d1b60f78c9a647da166006714b44e1 Mon Sep 17 00:00:00 2001 From: Mohammad Al Faiyaz Date: Thu, 27 Aug 2026 13:06:15 -0400 Subject: [PATCH] chore(deps): exclude GHSA-w4pp-8pjf-rmxw pacote DoS advisory pacote's addGitSha() has a DoS via malicious spec.rawSpec (CVE-2026-9496, CVSS 7.7). pacote is only pulled in transitively via dev/build tooling (lerna pinned to pacote@21.0.1, @npmcli/arborist, yeoman-generator) and never processes untrusted input - specs come only from our own package.json/yarn.lock. No fixed pacote version is compatible with lerna's current pin, so exclude per existing pattern in osv-scanner.toml. TICKET: WEB-000 --- osv-scanner.toml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/osv-scanner.toml b/osv-scanner.toml index 2e5c6dd8c3..8651e29490 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -70,6 +70,10 @@ reason = "fast-uri host confusion via literal backslash authority (CVE-2026-1622 id = "GHSA-jmr9-qjv8-65gv" reason = "extract-zip unvalidated symlink path traversal on extraction (CVE-2026-56876); transitive via cypress and @puppeteer/browsers, both dev-only tooling; extracted archives are Cypress/Chromium binary release downloads from trusted sources, never untrusted user-supplied zips; no upstream fix (last_affected: 2.0.1, which is the latest release). Re-evaluate on 2026-11-13: drop this exclusion if extract-zip ships a patched release" +[[IgnoredVulns]] +id = "GHSA-w4pp-8pjf-rmxw" +reason = "pacote DoS via addGitSha on malicious spec.rawSpec (CVE-2026-9496); transitive via lerna (pinned pacote@21.0.1), @npmcli/arborist, and yeoman-generator (dev-time only); fix only in pacote 21.5.1+/22.0.0 which lerna does not yet support; all specs processed come from our own package.json/yarn.lock, never untrusted input" + [[IgnoredVulns]] id = "GHSA-r292-9mhp-454m" reason = "tar stack-overflow DoS in tar.x()/tar.t() member-selection filtering; transitive via lerna and yeoman-generator requiring tar <7.5.21; fix only in tar 7.5.21+ which breaks lerna packDirectory (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only, not extraction of untrusted archives"