From a1126c4e8f9d07882be30afb647bf54e794fd9b9 Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Thu, 6 Aug 2026 15:53:36 +1000 Subject: [PATCH 1/2] UID2-7633, UID2-7619: suppress 2 CVEs in .trivyignore (exp 2026-09-06) - CVE-2026-18446 (UID2-7633) - CVE-2026-69152 (UID2-7619) Each is present but not reachable from this service; see the linked tickets for the per-CVE impact assessments. Reachability alone determines suppress-vs-fix. --- .trivyignore | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.trivyignore b/.trivyignore index 6b0a57e..9649c9c 100644 --- a/.trivyignore +++ b/.trivyignore @@ -20,3 +20,18 @@ CVE-2026-22184 exp:2026-09-09 # 2.8.3+); forcing it across the major breaks the create-react-app build. Suppressing until # react-scripts is upgraded/removed. See: UID2-7555 (fix precedent UID2-6698) GHSA-2p49-hgcm-8545 exp:2026-08-23 + +# CVE-2026-18446 — fast-uri (transitive via ajv) (HIGH). +# Not exploitable here: react-client-side resolves fast-uri 3.1.4 (prod, via ajv build +# tooling); client-server & google-secure-signals server-side resolve 3.1.2 dev-only; no direct +# fast-uri import; sample-app build/dev tooling +# See: UID2-7633 +CVE-2026-18446 exp:2026-09-06 + +# CVE-2026-69152 — brace-expansion (npm, transitive via minimatch) (HIGH). +# Not exploitable here: web-integrations/server-side/package-lock.json:600 brace- +# expansion@5.0.8 via minimatch@10.2.4 (dev/build tooling); server.js requires only +# axios/express/cookie-session/ejs/nocache/crypto; no minimatch/glob/brace-expansion on request +# path +# See: UID2-7619 +CVE-2026-69152 exp:2026-09-06 From 3ab495e2b717f11dac71e205d7accb5a0d612460 Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Thu, 6 Aug 2026 16:06:25 +1000 Subject: [PATCH 2/2] extend suppression window to 3 months (exp 2026-11-06) --- .trivyignore | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.trivyignore b/.trivyignore index 9649c9c..b5dff8a 100644 --- a/.trivyignore +++ b/.trivyignore @@ -26,7 +26,7 @@ GHSA-2p49-hgcm-8545 exp:2026-08-23 # tooling); client-server & google-secure-signals server-side resolve 3.1.2 dev-only; no direct # fast-uri import; sample-app build/dev tooling # See: UID2-7633 -CVE-2026-18446 exp:2026-09-06 +CVE-2026-18446 exp:2026-11-06 # CVE-2026-69152 — brace-expansion (npm, transitive via minimatch) (HIGH). # Not exploitable here: web-integrations/server-side/package-lock.json:600 brace- @@ -34,4 +34,4 @@ CVE-2026-18446 exp:2026-09-06 # axios/express/cookie-session/ejs/nocache/crypto; no minimatch/glob/brace-expansion on request # path # See: UID2-7619 -CVE-2026-69152 exp:2026-09-06 +CVE-2026-69152 exp:2026-11-06