{
  "asset": {
    "id": "6ac9f748f2bbb17afa29b781",
    "name": "adieuu",
    "version": "0.4.37",
    "type": "asset",
    "vulnerabilities": [
      {
        "cveId": "CVE-2023-29827",
        "onCISAKev": false,
        "triageStatus": "NotAffected",
        "description": "ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input.",
        "publishedDate": "2023-05-04T14:15:11.363Z",
        "cvssScore": 9.8,
        "cvssSeverity": "CRITICAL",
        "epssPercentile": 0.92649,
        "affectedComponents": [
          "pkg:npm/ejs@6.0.1"
        ],
        "justification": "vulnerableCodeIsNotInExecutePath",
        "scope": "allVersionsOfThisAssetForever",
        "statusNotes": "Disputed finding (NVD; vendor out-of-scope; GitLab false positive). CVE-2023-29827 requires an attacker-controlled EJS template plus an attacker-controlled closeDelimiter passed into render, as in res.render(view, req.query). This repository has no EJS view engine and no first-party ejs call. The only consumer is app-builder-lib’s MSI target, which ejs.compiles its own templates/msi/template.xml with default options. Desktop packaging builds NSIS only, so that call is not executed, and ejs is not shipped in dist/**/* or in the API, web, mobile, or Lambda artifacts. The workspace SBOM includes it because it is in the lockfile. Not affected.",
        "source": "NVD"
      },
      {
        "cveId": "CVE-2026-93748",
        "onCISAKev": false,
        "triageStatus": "NotAffected",
        "description": "http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.",
        "publishedDate": "2026-09-18T18:18:33.330Z",
        "cvssScore": 8.7,
        "cvssSeverity": "HIGH",
        "epssPercentile": 0.43107,
        "affectedComponents": [
          "pkg:npm/http-cache-semantics@4.2.0"
        ],
        "justification": "otherProvideImpactStatement",
        "scope": "allVersionsOfThisAssetForever",
        "statusNotes": "Disputed by devs, withdrawal requested. Monitoring but no reason as of yet to consider this a valid vulnerability.",
        "source": "OSV"
      },
      {
        "cveId": "CVE-2026-97058",
        "onCISAKev": false,
        "triageStatus": "NotAffected",
        "description": "(sprintf-js through 1.1.3 passes unbounded precision specifiers to toFi ...)",
        "publishedDate": "2026-09-24T00:00:00.000Z",
        "cvssScore": 6.9,
        "cvssSeverity": "MEDIUM",
        "epssPercentile": 0.28365,
        "affectedComponents": [
          "pkg:npm/sprintf-js@1.1.3"
        ],
        "justification": "vulnerableCodeIsNotInExecutePath",
        "scope": "allVersionsOfThisAssetForever",
        "statusNotes": "The bug throws a RangeError when a format string has a precision specifier larger than JavaScript allows (toFixed, toExponential, toPrecision). The caller has to control that format string. There is no fixed npm release; 1.1.3 is still the latest, so a lockfile change cannot clear it.\n\nIn this tree it is optional and only used while packaging the desktop app:\n\nelectron-builder@26.15.7 → app-builder-lib → @electron/get@3.1.0 → optional global-agent@3.0.0 → optional roarr@2.15.4 → sprintf-js@1.1.3\n\nglobal-agent loads only if GLOBAL_AGENT_* is set while Electron is downloaded. roarr formats its own log templates, not user input. The shipped desktop app, API, web, chat, and mobile runtimes do not include this chain (electron itself uses @electron/get 5, which does not). Severity is medium (CVSS 3.1 5.3), so it does not fail the critical/high gate. Mark it Not Affected with that reachability note, and revisit if a release newer than 1.1.3 appears.",
        "source": "OSV"
      },
      {
        "cveId": "CVE-2025-66803",
        "onCISAKev": false,
        "triageStatus": "NotAffected",
        "description": "Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays (e.g. delaying requests based on sequence or timing) or by physically proximate attackers when the race condition occurs naturally on shared computers.",
        "publishedDate": "2026-01-20T19:15:49.537Z",
        "cvssScore": 4.8,
        "cvssSeverity": "MEDIUM",
        "epssPercentile": 0.184,
        "affectedComponents": [
          "pkg:npm/turbo@2.9.16"
        ],
        "justification": "vulnerableCodeNotPresent",
        "scope": "allVersionsOfThisAssetForever",
        "statusNotes": "Justification: CVE-2025-66803 is a Hotwired Turbo Frames cookie race in @hotwired/turbo versions through 8.0.20, fixed in 8.0.21. This repository depends on npm turbo@2.9.16, which is Turborepo, a build CLI. That package has no 8.0.21 release. There is no @hotwired/turbo dependency and no turbo-frame usage in the React apps. A delayed frame response cannot restore a session cookie here because no frame requests are issued. Not affected.",
        "source": "NVD"
      }
    ]
  },
  "metadata": {
    "generatedAt": "2026-10-10T08:29:13.963Z",
    "sourceOrg": "653452b385c6253be38e7721",
    "totalVulnerabilities": 4
  }
}