Skip to content

UID2-7658, UID2-7659: suppress 2 CVEs in .trivyignore #207

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
swibi-ttd wants to merge 1 commit into from
Closed

UID2-7658, UID2-7659: suppress 2 CVEs in .trivyignore #207

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,3 +35,19 @@ CVE-2026-18446 exp:2026-11-06
# path
# See: UID2-7619
CVE-2026-69152 exp:2026-11-06

# CVE-2026-67213 — nanoid (transitive via postcss) (HIGH).
# Not exploitable here: nanoid 3.3.16 is a single transitive dep of postcss in both scanned
# lockfiles (javascript-sdk & google-secure-signals react-client-side). No source imports
# nanoid or calls customAlphabet/customRandom; postcss uses only the default nanoid() for
# internal IDs, never the vulnerable custom* functions. postcss runs at CRA build time only.
# See: UID2-7658
CVE-2026-67213 exp:2026-11-11

# GHSA-5p4m-2wfm-xmqj — js-yaml (3.15.0 and 4.3.0, transitive npm dependency) (HIGH).
# Not exploitable here: js-yaml 3.15.0/4.3.0 appear only as dev/build transitives of eslint,
# react-scripts and @istanbuljs/load-nyc-config in static demo apps (package-lock entries
# marked dev:true); no source imports js-yaml or calls yaml.load, so no untrusted-YAML runtime
# path
# See: UID2-7659
GHSA-5p4m-2wfm-xmqj exp:2026-11-11