mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-10-14 12:02:27 +08:00
shaw
0f9d460dc6
- Bump vue to ^3.5.43 so @vue/server-renderer is >= 3.5.42 (GHSA-g2v6-rqmx-r4w6). - Override source-map-js to >= 1.2.2 (GHSA-68fv-2mgg-jv7q). - Renew the expired xlsx exceptions until 2027-01-06: xlsx has no patched release on npm and is only used for XLSX.write export in the admin usage view; both advisories require parsing a crafted file and no read path exists. Lockfile regenerated with pnpm 9 to match CI.
45 lines
2.3 KiB
YAML
45 lines
2.3 KiB
YAML
version: 1
|
|
exceptions:
|
|
- package: xlsx
|
|
advisory: "GHSA-4r6h-8v6p-xvw6"
|
|
severity: high
|
|
reason: "Write-only: admin UsageView lazily imports xlsx solely for XLSX.write export; the advisory requires parsing a crafted file and no XLSX.read path exists (CVE-2023-30533)"
|
|
mitigation: "Never parse untrusted spreadsheets with xlsx; no patched version on npm, migrate to SheetJS CDN build or another writer before expiry"
|
|
expires_on: "2027-01-06"
|
|
owner: "security@your-domain"
|
|
- package: xlsx
|
|
advisory: "GHSA-5pgg-2g8v-p4x9"
|
|
severity: high
|
|
reason: "Write-only: admin UsageView lazily imports xlsx solely for XLSX.write export; the advisory requires parsing a crafted file and no XLSX.read path exists (CVE-2024-22363)"
|
|
mitigation: "Never parse untrusted spreadsheets with xlsx; no patched version on npm, migrate to SheetJS CDN build or another writer before expiry"
|
|
expires_on: "2027-01-06"
|
|
owner: "security@your-domain"
|
|
- package: lodash
|
|
advisory: "GHSA-r5fr-rjxr-66jc"
|
|
severity: high
|
|
reason: "lodash _.template not used with untrusted input; only internal admin UI templates"
|
|
mitigation: "No user-controlled template strings; plan to migrate to lodash-es tree-shaken imports"
|
|
expires_on: "2026-07-02"
|
|
owner: "security@your-domain"
|
|
- package: lodash-es
|
|
advisory: "GHSA-r5fr-rjxr-66jc"
|
|
severity: high
|
|
reason: "lodash-es _.template not used with untrusted input; only internal admin UI templates"
|
|
mitigation: "No user-controlled template strings; plan to migrate to native JS alternatives"
|
|
expires_on: "2026-07-02"
|
|
owner: "security@your-domain"
|
|
- package: axios
|
|
advisory: "GHSA-3p68-rc4w-qgx5"
|
|
severity: critical
|
|
reason: "NO_PROXY bypass not exploitable; all API calls go to known endpoints via server-side proxy"
|
|
mitigation: "Proxy configuration not user-controlled; upgrade when axios releases fix"
|
|
expires_on: "2026-07-10"
|
|
owner: "security@your-domain"
|
|
- package: nanoid
|
|
advisory: "GHSA-2v37-7h3g-55p8"
|
|
severity: high
|
|
reason: "Custom generator with size=0 not used; all nanoid calls use default size or positive values"
|
|
mitigation: "No zero-size custom generators in codebase; upgrade when nanoid releases fix"
|
|
expires_on: "2026-10-13"
|
|
owner: "security@your-domain"
|