[GHSA-5mq8-78gm-pjmq] defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag - #9711
Conversation
|
Hi there @kepano! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
|
Two changes here are not intended. The form does not accept E:P in the CVSS 4.0 vector (#5357), so I had to remove it, and the severity went from LOW to MODERATE. The form also dropped the CVSS 3.1 vector, see #9628. Please restore |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The CVSS v4 vector and affected-version metadata require correction before approval.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 2
Open (2)
What changed in this PR
Updates metadata for the defuddle XSS advisory.
Changes:
- Revises CVSS and severity metadata.
- Updates affected-version metadata and modification timestamp.
| File | Review |
|---|---|
advisories/github-reviewed/2026/03/GHSA-5mq8-78gm-pjmq/GHSA-5mq8-78gm-pjmq.json |
Two moderate issues: restore /E:P in both CVSS v4 vectors and preserve database_specific with the corrected < 0.9.0 bound. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| { | ||
| "type": "CVSS_V4", | ||
| "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P" | ||
| "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" |
| "database_specific": { | ||
| "last_known_affected_version_range": "<= 0.7.0" | ||
| } | ||
| ] |
There was a problem hiding this comment.
This is not a hand edit. The file is generated from the advisory, and last_known_affected_version_range only appears when the range and the patched version disagree. I changed the range to < 0.9.0, which is the same as "fixed": "0.9.0", so there is nothing left for that field to hold. See the explanation from GitHub in #470 (comment)
Updates
Comments
The range should end at < 0.9.0, not <= 0.7.0. Version 0.8.0 came out after 0.7.0 and does not have the fix.
The fix kepano/defuddle@f154cb7 is in tag 0.9.0 and not in tag 0.8.0.
So version 0.8.0 is still vulnerable but is outside the current range.
The form does not accept the E:P metric in the CVSS 4.0 vector (see #5357), so I had to remove it. Please keep E:P, I did not mean to change the severity.