bvandeusen/FabledScribe
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases 53 Wiki Activity

Security Dashboard #108

New Issue
Open
opened 2026-08-09 20:58:29 -04:00 by renovate-bot · 0 comments
renovate-bot commented 2026-08-09 20:58:29 -04:00
Collaborator
Copy Link
Copy Source

Automated weekly security sweep — last rewritten 2026-10-19 07:32 UTC (runs).

This issue is maintained like the Renovate Dependency Dashboard: every sweep run rewrites it in place. Don't edit findings here — fix them, or allowlist them with a written reason (this repo's .gitleaks.toml for secrets, an inline # nosemgrep: <rule-id> -- <reason> for code findings). There is no per-push security lane; this dashboard and the on-demand deep review are where security findings surface.

Secrets (gitleaks)

  • tests/test_services_backup_s3.py:13 — rule aws-access-token, commit ff4f2ee5 2026-10-15T21:31:08Z
  • tests/test_services_backup_s3.py:26 — rule aws-access-token, commit ff4f2ee5 2026-10-15T21:31:08Z
  • tests/test_services_backup_s3.py:69 — rule aws-access-token, commit ff4f2ee5 2026-10-15T21:31:08Z
  • tests/test_retrieval_query_scrubbing.py:49 — rule generic-api-key, commit bfa2d419 2026-09-11T19:38:40Z
  • tests/test_retrieval_query_scrubbing.py:55 — rule generic-api-key, commit bfa2d419 2026-09-11T19:38:40Z
  • tests/test_retrieval_query_scrubbing.py:121 — rule generic-api-key, commit bfa2d419 2026-09-11T19:38:40Z
  • tests/test_retrieval_query_scrubbing.py:58 — rule private-key, commit bfa2d419 2026-09-11T19:38:40Z

Code findings (semgrep, curated family ruleset)

ERROR — believed-real on this family's code (13):

  • alembic/versions/0053_drop_chat_journal_push_curator_tables.py:65 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0089_rule_embeddings.py:44 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0102_milestone_embeddings.py:45 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0107_system_embeddings.py:53 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0108_trigger_leaves_the_stored_title.py:45 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0108_trigger_leaves_the_stored_title.py:58 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0109_embeddings_record_their_model.py:35 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0109_embeddings_record_their_model.py:36 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0109_embeddings_record_their_model.py:37 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0109_embeddings_record_their_model.py:42 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0121_retire_report_preference.py:45 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0121_retire_report_preference.py:46 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
  • alembic/versions/0121_retire_report_preference.py:51 opt.security-rules.fabled-sql-string-interpolation — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation.
    WARNING — useful, precision not yet proven (14):
  • frontend/src/components/InlineAssistPanel.vue:40 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/components/InlineAssistPanel.vue:71 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/components/NoteCard.vue:44 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/components/TaskLogSection.vue:134 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/components/WorkspaceTaskPanel.vue:320 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/GraphView.vue:562 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/LessonDetailView.vue:174 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/NoteEditorView.vue:418 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/NoteEditorView.vue:442 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/NoteViewerView.vue:262 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/ProjectView.vue:1053 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/SnippetDetailView.vue:188 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/TaskEditorView.vue:519 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i
  • frontend/src/views/TaskEditorView.vue:544 opt.security-rules.fabled-vue-v-html — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i

Dependency CVEs (osv-scanner)

Published image (trivy)

  • HIGH CVE-2026-76642 — bsdutils 1:2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78408 — bsdutils 1:2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78409 — bsdutils 1:2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78410 — bsdutils 1:2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-54369 — libacl1 2.3.2-2+b1 (no fix released)
  • HIGH CVE-2026-76642 — libblkid1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78408 — libblkid1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78409 — libblkid1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78410 — libblkid1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-76642 — liblastlog2-2 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78408 — liblastlog2-2 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78409 — liblastlog2-2 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78410 — liblastlog2-2 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-76642 — libmount1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78408 — libmount1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78409 — libmount1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78410 — libmount1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2025-69720 — libncursesw6 6.5+20250216-2 (no fix released)
  • HIGH CVE-2026-76642 — libsmartcols1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78408 — libsmartcols1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78409 — libsmartcols1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78410 — libsmartcols1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-16742 — libsystemd0 257.13-1~deb13u1 (no fix released)
  • HIGH CVE-2025-69720 — libtinfo6 6.5+20250216-2 (no fix released)
  • HIGH CVE-2026-16742 — libudev1 257.13-1~deb13u1 (no fix released)
  • HIGH CVE-2026-76642 — libuuid1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78408 — libuuid1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78409 — libuuid1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78410 — libuuid1 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-76642 — login 1:4.16.0-2+really2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78408 — login 1:4.16.0-2+really2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78409 — login 1:4.16.0-2+really2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78410 — login 1:4.16.0-2+really2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-76642 — mount 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78408 — mount 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78409 — mount 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2026-78410 — mount 2.41.5-0+deb13u1 (no fix released)
  • HIGH CVE-2025-69720 — ncurses-base 6.5+20250216-2 (no fix released)
  • HIGH CVE-2025-69720 — ncurses-bin 6.5+20250216-2 (no fix released)
  • HIGH CVE-2026-9538 — perl-base 5.40.1-6+deb13u1 (no fix released)
    …and 39 more line(s) truncated — run the scanner locally or trigger the sweep with only= for the full list.

Coverage & limits

  • All four scanners ran with nothing skipped.
<!-- fabledsentry-security-dashboard --> _Automated weekly security sweep — last rewritten 2026-10-19 07:32 UTC ([runs](https://git.fabledsword.com/bvandeusen/CI-runner/actions))._ This issue is maintained like the Renovate Dependency Dashboard: every sweep run rewrites it in place. Don't edit findings here — fix them, or allowlist them **with a written reason** (this repo's `.gitleaks.toml` for secrets, an inline `# nosemgrep: <rule-id> -- <reason>` for code findings). There is no per-push security lane; this dashboard and the on-demand deep review are where security findings surface. ## Secrets (gitleaks) - `tests/test_services_backup_s3.py:13` — rule `aws-access-token`, commit `ff4f2ee5` 2026-10-15T21:31:08Z - `tests/test_services_backup_s3.py:26` — rule `aws-access-token`, commit `ff4f2ee5` 2026-10-15T21:31:08Z - `tests/test_services_backup_s3.py:69` — rule `aws-access-token`, commit `ff4f2ee5` 2026-10-15T21:31:08Z - `tests/test_retrieval_query_scrubbing.py:49` — rule `generic-api-key`, commit `bfa2d419` 2026-09-11T19:38:40Z - `tests/test_retrieval_query_scrubbing.py:55` — rule `generic-api-key`, commit `bfa2d419` 2026-09-11T19:38:40Z - `tests/test_retrieval_query_scrubbing.py:121` — rule `generic-api-key`, commit `bfa2d419` 2026-09-11T19:38:40Z - `tests/test_retrieval_query_scrubbing.py:58` — rule `private-key`, commit `bfa2d419` 2026-09-11T19:38:40Z ## Code findings (semgrep, curated family ruleset) **ERROR — believed-real on this family's code (13):** - `alembic/versions/0053_drop_chat_journal_push_curator_tables.py:65` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0089_rule_embeddings.py:44` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0102_milestone_embeddings.py:45` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0107_system_embeddings.py:53` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0108_trigger_leaves_the_stored_title.py:45` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0108_trigger_leaves_the_stored_title.py:58` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0109_embeddings_record_their_model.py:35` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0109_embeddings_record_their_model.py:36` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0109_embeddings_record_their_model.py:37` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0109_embeddings_record_their_model.py:42` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0121_retire_report_preference.py:45` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0121_retire_report_preference.py:46` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. - `alembic/versions/0121_retire_report_preference.py:51` `opt.security-rules.fabled-sql-string-interpolation` — SQL built by string interpolation. This family is ORM-first; raw SQL assembled from an f-string bypasses parameter binding. Use bound parameters — text("... :id"), {"id": value} — not interpolation. **WARNING — useful, precision not yet proven (14):** - `frontend/src/components/InlineAssistPanel.vue:40` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/components/InlineAssistPanel.vue:71` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/components/NoteCard.vue:44` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/components/TaskLogSection.vue:134` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/components/WorkspaceTaskPanel.vue:320` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/GraphView.vue:562` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/LessonDetailView.vue:174` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/NoteEditorView.vue:418` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/NoteEditorView.vue:442` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/NoteViewerView.vue:262` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/ProjectView.vue:1053` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/SnippetDetailView.vue:188` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/TaskEditorView.vue:519` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i - `frontend/src/views/TaskEditorView.vue:544` `opt.security-rules.fabled-vue-v-html` — v-html renders raw HTML into the DOM. Legitimate only when the value is server-escaped (FabledForge's Reader is). Confirm the source is escaped server-side; if it is user-supplied and unescaped this i ## Dependency CVEs (osv-scanner) - `@protobufjs/utf8 1.1.0` (npm, `frontend/package-lock.json`): [GHSA-q6x5-8v7m-xcrf](https://osv.dev/vulnerability/GHSA-q6x5-8v7m-xcrf) - `@tiptap/core 3.20.1` (npm, `frontend/package-lock.json`): [GHSA-cp6q-959q-f8rh](https://osv.dev/vulnerability/GHSA-cp6q-959q-f8rh), [GHSA-j95f-988m-3j2f](https://osv.dev/vulnerability/GHSA-j95f-988m-3j2f) - `@vue/server-renderer 3.5.30` (npm, `frontend/package-lock.json`): [GHSA-g2v6-rqmx-r4w6](https://osv.dev/vulnerability/GHSA-g2v6-rqmx-r4w6) - `braces 3.0.3` (npm, `frontend/package-lock.json`): [GHSA-vfj7-8cjw-p6xm](https://osv.dev/vulnerability/GHSA-vfj7-8cjw-p6xm) - `dompurify 3.3.2` (npm, `frontend/package-lock.json`): [GHSA-39q2-94rc-95cp](https://osv.dev/vulnerability/GHSA-39q2-94rc-95cp), [GHSA-55q2-fjhq-7xh7](https://osv.dev/vulnerability/GHSA-55q2-fjhq-7xh7), [GHSA-6688-9rhm-gjv2](https://osv.dev/vulnerability/GHSA-6688-9rhm-gjv2), [GHSA-76mc-f452-cxcm](https://osv.dev/vulnerability/GHSA-76mc-f452-cxcm), [GHSA-c2j3-45gr-mqc4](https://osv.dev/vulnerability/GHSA-c2j3-45gr-mqc4), [GHSA-cmwh-pvxp-8882](https://osv.dev/vulnerability/GHSA-cmwh-pvxp-8882), [GHSA-crv5-9vww-q3g8](https://osv.dev/vulnerability/GHSA-crv5-9vww-q3g8), [GHSA-gvmj-g25r-r7wr](https://osv.dev/vulnerability/GHSA-gvmj-g25r-r7wr), [GHSA-h7mw-gpvr-xq4m](https://osv.dev/vulnerability/GHSA-h7mw-gpvr-xq4m), [GHSA-hpcv-96wg-7vj8](https://osv.dev/vulnerability/GHSA-hpcv-96wg-7vj8), [GHSA-r47g-fvhr-h676](https://osv.dev/vulnerability/GHSA-r47g-fvhr-h676), [GHSA-rp9w-3fw7-7cwq](https://osv.dev/vulnerability/GHSA-rp9w-3fw7-7cwq), [GHSA-v9jr-rg53-9pgp](https://osv.dev/vulnerability/GHSA-v9jr-rg53-9pgp), [GHSA-vxr8-fq34-vvx9](https://osv.dev/vulnerability/GHSA-vxr8-fq34-vvx9), [GHSA-x4vx-rjvf-j5p4](https://osv.dev/vulnerability/GHSA-x4vx-rjvf-j5p4) - `esbuild 0.27.3` (npm, `frontend/package-lock.json`): [GHSA-g7r4-m6w7-qqqr](https://osv.dev/vulnerability/GHSA-g7r4-m6w7-qqqr) - `linkify-it 5.0.0` (npm, `frontend/package-lock.json`): [GHSA-22p9-wv53-3rq4](https://osv.dev/vulnerability/GHSA-22p9-wv53-3rq4), [GHSA-v245-v573-v5vm](https://osv.dev/vulnerability/GHSA-v245-v573-v5vm) - `markdown-it 14.1.1` (npm, `frontend/package-lock.json`): [GHSA-253c-mchw-3w2r](https://osv.dev/vulnerability/GHSA-253c-mchw-3w2r), [GHSA-6v5v-wf23-fmfq](https://osv.dev/vulnerability/GHSA-6v5v-wf23-fmfq) - `nanoid 3.3.11` (npm, `frontend/package-lock.json`): [GHSA-28wg-ghj8-5hjv](https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv), [GHSA-2v37-7h3g-55p8](https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8), [GHSA-xwg4-73v4-xw9w](https://osv.dev/vulnerability/GHSA-xwg4-73v4-xw9w) - `picomatch 4.0.3` (npm, `frontend/package-lock.json`): [GHSA-3v7f-55p6-f55p](https://osv.dev/vulnerability/GHSA-3v7f-55p6-f55p), [GHSA-c2c7-rcm5-vvqj](https://osv.dev/vulnerability/GHSA-c2c7-rcm5-vvqj) - `postcss 8.5.8` (npm, `frontend/package-lock.json`): [GHSA-6g55-p6wh-862q](https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q), [GHSA-fxqj-rqcc-2cmp](https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp), [GHSA-qx2v-qp2m-jg93](https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93), [GHSA-r28c-9q8g-f849](https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849) - `prosemirror-view 1.41.6` (npm, `frontend/package-lock.json`): [GHSA-c8x8-7fp4-3x9w](https://osv.dev/vulnerability/GHSA-c8x8-7fp4-3x9w) - `protobufjs 7.5.5` (npm, `frontend/package-lock.json`): [GHSA-2pr8-phx7-x9h3](https://osv.dev/vulnerability/GHSA-2pr8-phx7-x9h3), [GHSA-66ff-xgx4-vchm](https://osv.dev/vulnerability/GHSA-66ff-xgx4-vchm), [GHSA-685m-2w69-288q](https://osv.dev/vulnerability/GHSA-685m-2w69-288q), [GHSA-75px-5xx7-5xc7](https://osv.dev/vulnerability/GHSA-75px-5xx7-5xc7), [GHSA-f38q-mgvj-vph7](https://osv.dev/vulnerability/GHSA-f38q-mgvj-vph7), [GHSA-fx83-v9x8-x52w](https://osv.dev/vulnerability/GHSA-fx83-v9x8-x52w), [GHSA-j3f2-48v5-ccww](https://osv.dev/vulnerability/GHSA-j3f2-48v5-ccww), [GHSA-jggg-4jg4-v7c6](https://osv.dev/vulnerability/GHSA-jggg-4jg4-v7c6), [GHSA-jvwf-75h9-cwgg](https://osv.dev/vulnerability/GHSA-jvwf-75h9-cwgg), [GHSA-q6x5-8v7m-xcrf](https://osv.dev/vulnerability/GHSA-q6x5-8v7m-xcrf), [GHSA-wcpc-wj8m-hjx6](https://osv.dev/vulnerability/GHSA-wcpc-wj8m-hjx6) - `source-map-js 1.2.1` (npm, `frontend/package-lock.json`): [GHSA-68fv-2mgg-jv7q](https://osv.dev/vulnerability/GHSA-68fv-2mgg-jv7q) - `vite 7.3.1` (npm, `frontend/package-lock.json`): [GHSA-4w7w-66w2-5vf9](https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9), [GHSA-fx2h-pf6j-xcff](https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff), [GHSA-p9ff-h696-f583](https://osv.dev/vulnerability/GHSA-p9ff-h696-f583), [GHSA-v2wj-q39q-566r](https://osv.dev/vulnerability/GHSA-v2wj-q39q-566r), [GHSA-v6wh-96g9-6wx3](https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3) - `yaml 2.8.2` (npm, `frontend/package-lock.json`): [GHSA-48c2-rrv3-qjmp](https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp) - `aiosmtplib 5.1.0` (PyPI, `uv.lock`): [GHSA-v3q9-hj7j-63hq](https://osv.dev/vulnerability/GHSA-v3q9-hj7j-63hq), [GHSA-vxj7-4xrp-5vr4](https://osv.dev/vulnerability/GHSA-vxj7-4xrp-5vr4), [PYSEC-2026-2338](https://osv.dev/vulnerability/PYSEC-2026-2338), [PYSEC-2026-3805](https://osv.dev/vulnerability/PYSEC-2026-3805) - `anyio 4.13.0` (PyPI, `uv.lock`): [GHSA-5p39-cfhj-2xmp](https://osv.dev/vulnerability/GHSA-5p39-cfhj-2xmp), [GHSA-82r6-8w77-94w6](https://osv.dev/vulnerability/GHSA-82r6-8w77-94w6), [PYSEC-2026-4024](https://osv.dev/vulnerability/PYSEC-2026-4024), [PYSEC-2026-4025](https://osv.dev/vulnerability/PYSEC-2026-4025) - `cryptography 46.0.7` (PyPI, `uv.lock`): [GHSA-537c-gmf6-5ccf](https://osv.dev/vulnerability/GHSA-537c-gmf6-5ccf), [GHSA-g6cj-pr64-35w5](https://osv.dev/vulnerability/GHSA-g6cj-pr64-35w5), [GHSA-jwv3-5hgf-82ww](https://osv.dev/vulnerability/GHSA-jwv3-5hgf-82ww), [GHSA-m2h6-j472-rp4c](https://osv.dev/vulnerability/GHSA-m2h6-j472-rp4c), [PYSEC-2026-3552](https://osv.dev/vulnerability/PYSEC-2026-3552), [PYSEC-2026-3553](https://osv.dev/vulnerability/PYSEC-2026-3553), [PYSEC-2026-3554](https://osv.dev/vulnerability/PYSEC-2026-3554) - `fsspec 2026.3.0` (PyPI, `uv.lock`): [GHSA-27vj-qcqg-25rc](https://osv.dev/vulnerability/GHSA-27vj-qcqg-25rc), [PYSEC-2026-4217](https://osv.dev/vulnerability/PYSEC-2026-4217) - `h2 4.3.0` (PyPI, `uv.lock`): [GHSA-6hr6-w5qg-qmwg](https://osv.dev/vulnerability/GHSA-6hr6-w5qg-qmwg), [PYSEC-2026-3628](https://osv.dev/vulnerability/PYSEC-2026-3628) - `hpack 4.1.0` (PyPI, `uv.lock`): [GHSA-8v8h-hg4w-mvq2](https://osv.dev/vulnerability/GHSA-8v8h-hg4w-mvq2), [PYSEC-2026-4053](https://osv.dev/vulnerability/PYSEC-2026-4053) - `lxml 6.0.3` (PyPI, `uv.lock`): [GHSA-vfmq-68hx-4jfw](https://osv.dev/vulnerability/GHSA-vfmq-68hx-4jfw), [PYSEC-2026-87](https://osv.dev/vulnerability/PYSEC-2026-87) - `mako 1.3.10` (PyPI, `uv.lock`): [GHSA-2h4p-vjrc-8xpq](https://osv.dev/vulnerability/GHSA-2h4p-vjrc-8xpq), [GHSA-5639-2j2p-m4mx](https://osv.dev/vulnerability/GHSA-5639-2j2p-m4mx), [GHSA-v92g-xgxw-vvmm](https://osv.dev/vulnerability/GHSA-v92g-xgxw-vvmm), [PYSEC-2026-2617](https://osv.dev/vulnerability/PYSEC-2026-2617), [PYSEC-2026-4243](https://osv.dev/vulnerability/PYSEC-2026-4243), [PYSEC-2026-88](https://osv.dev/vulnerability/PYSEC-2026-88) - `pillow 12.2.0` (PyPI, `uv.lock`): [GHSA-45hq-cxwh-f6vc](https://osv.dev/vulnerability/GHSA-45hq-cxwh-f6vc), [GHSA-4x4j-2g7c-83w6](https://osv.dev/vulnerability/GHSA-4x4j-2g7c-83w6), [GHSA-5x94-69rx-g8h2](https://osv.dev/vulnerability/GHSA-5x94-69rx-g8h2), [GHSA-62p4-gmf7-7g93](https://osv.dev/vulnerability/GHSA-62p4-gmf7-7g93), [GHSA-6r8x-57c9-28j4](https://osv.dev/vulnerability/GHSA-6r8x-57c9-28j4), [GHSA-8v84-f9pq-wr9x](https://osv.dev/vulnerability/GHSA-8v84-f9pq-wr9x), [GHSA-9hw9-ch79-4vh6](https://osv.dev/vulnerability/GHSA-9hw9-ch79-4vh6), [GHSA-fj7v-r99m-22gq](https://osv.dev/vulnerability/GHSA-fj7v-r99m-22gq), [GHSA-jjj6-mw9f-p565](https://osv.dev/vulnerability/GHSA-jjj6-mw9f-p565), [GHSA-pg7v-jwj7-p798](https://osv.dev/vulnerability/GHSA-pg7v-jwj7-p798), [GHSA-phj9-mv4w-65pm](https://osv.dev/vulnerability/GHSA-phj9-mv4w-65pm), [GHSA-vjc4-5qp5-m44j](https://osv.dev/vulnerability/GHSA-vjc4-5qp5-m44j), [GHSA-xj96-63gp-2gmr](https://osv.dev/vulnerability/GHSA-xj96-63gp-2gmr), [PYSEC-2026-2253](https://osv.dev/vulnerability/PYSEC-2026-2253), [PYSEC-2026-2254](https://osv.dev/vulnerability/PYSEC-2026-2254), [PYSEC-2026-2255](https://osv.dev/vulnerability/PYSEC-2026-2255), [PYSEC-2026-2256](https://osv.dev/vulnerability/PYSEC-2026-2256), [PYSEC-2026-2257](https://osv.dev/vulnerability/PYSEC-2026-2257), [PYSEC-2026-3451](https://osv.dev/vulnerability/PYSEC-2026-3451), [PYSEC-2026-3452](https://osv.dev/vulnerability/PYSEC-2026-3452), [PYSEC-2026-3453](https://osv.dev/vulnerability/PYSEC-2026-3453), [PYSEC-2026-3454](https://osv.dev/vulnerability/PYSEC-2026-3454), [PYSEC-2026-3493](https://osv.dev/vulnerability/PYSEC-2026-3493), [PYSEC-2026-3494](https://osv.dev/vulnerability/PYSEC-2026-3494), [PYSEC-2026-3495](https://osv.dev/vulnerability/PYSEC-2026-3495), [PYSEC-2026-3496](https://osv.dev/vulnerability/PYSEC-2026-3496) - `pyjwt 2.13.0` (PyPI, `uv.lock`): [GHSA-2gx3-rcp4-g85q](https://osv.dev/vulnerability/GHSA-2gx3-rcp4-g85q), [GHSA-42vr-xj54-vc7v](https://osv.dev/vulnerability/GHSA-42vr-xj54-vc7v), [GHSA-8wjv-2p76-3863](https://osv.dev/vulnerability/GHSA-8wjv-2p76-3863), [GHSA-9j54-fg26-wv3r](https://osv.dev/vulnerability/GHSA-9j54-fg26-wv3r), [GHSA-9v7f-9g4p-ffgj](https://osv.dev/vulnerability/GHSA-9v7f-9g4p-ffgj), [GHSA-ffc3-869f-jxw9](https://osv.dev/vulnerability/GHSA-ffc3-869f-jxw9), [GHSA-gvp8-978c-rx2q](https://osv.dev/vulnerability/GHSA-gvp8-978c-rx2q), [GHSA-hxm8-2xgr-2p9m](https://osv.dev/vulnerability/GHSA-hxm8-2xgr-2p9m), [GHSA-jwrc-g2q2-pq5p](https://osv.dev/vulnerability/GHSA-jwrc-g2q2-pq5p), [GHSA-p4g4-x82p-q773](https://osv.dev/vulnerability/GHSA-p4g4-x82p-q773), [GHSA-r6x4-923q-g947](https://osv.dev/vulnerability/GHSA-r6x4-923q-g947), [GHSA-w2cx-738m-mc7w](https://osv.dev/vulnerability/GHSA-w2cx-738m-mc7w), [GHSA-w6j9-cwv2-h6wq](https://osv.dev/vulnerability/GHSA-w6j9-cwv2-h6wq), [GHSA-x33g-cr3x-6449](https://osv.dev/vulnerability/GHSA-x33g-cr3x-6449), [PYSEC-2026-4140](https://osv.dev/vulnerability/PYSEC-2026-4140), [PYSEC-2026-4141](https://osv.dev/vulnerability/PYSEC-2026-4141), [PYSEC-2026-4142](https://osv.dev/vulnerability/PYSEC-2026-4142), [PYSEC-2026-4143](https://osv.dev/vulnerability/PYSEC-2026-4143), [PYSEC-2026-4144](https://osv.dev/vulnerability/PYSEC-2026-4144), [PYSEC-2026-4145](https://osv.dev/vulnerability/PYSEC-2026-4145), [PYSEC-2026-4146](https://osv.dev/vulnerability/PYSEC-2026-4146), [PYSEC-2026-4147](https://osv.dev/vulnerability/PYSEC-2026-4147), [PYSEC-2026-4148](https://osv.dev/vulnerability/PYSEC-2026-4148), [PYSEC-2026-4149](https://osv.dev/vulnerability/PYSEC-2026-4149), [PYSEC-2026-4150](https://osv.dev/vulnerability/PYSEC-2026-4150), [PYSEC-2026-4151](https://osv.dev/vulnerability/PYSEC-2026-4151), [PYSEC-2026-4152](https://osv.dev/vulnerability/PYSEC-2026-4152), [PYSEC-2026-4183](https://osv.dev/vulnerability/PYSEC-2026-4183) - `python-multipart 0.0.29` (PyPI, `uv.lock`): [GHSA-5rvq-cxj2-64vf](https://osv.dev/vulnerability/GHSA-5rvq-cxj2-64vf), [GHSA-6jv3-5f52-599m](https://osv.dev/vulnerability/GHSA-6jv3-5f52-599m), [GHSA-v9pg-7xvm-68hf](https://osv.dev/vulnerability/GHSA-v9pg-7xvm-68hf), [GHSA-vffw-93wf-4j4q](https://osv.dev/vulnerability/GHSA-vffw-93wf-4j4q), [PYSEC-2026-3036](https://osv.dev/vulnerability/PYSEC-2026-3036), [PYSEC-2026-3037](https://osv.dev/vulnerability/PYSEC-2026-3037), [PYSEC-2026-3040](https://osv.dev/vulnerability/PYSEC-2026-3040), [PYSEC-2026-3041](https://osv.dev/vulnerability/PYSEC-2026-3041) - `starlette 1.2.0` (PyPI, `uv.lock`): [GHSA-82w8-qh3p-5jfq](https://osv.dev/vulnerability/GHSA-82w8-qh3p-5jfq), [GHSA-jp82-jpqv-5vv3](https://osv.dev/vulnerability/GHSA-jp82-jpqv-5vv3), [PYSEC-2026-248](https://osv.dev/vulnerability/PYSEC-2026-248), [PYSEC-2026-249](https://osv.dev/vulnerability/PYSEC-2026-249) - `urllib3 2.6.3` (PyPI, `uv.lock`): [GHSA-8988-9cw3-xx77](https://osv.dev/vulnerability/GHSA-8988-9cw3-xx77), [GHSA-gh4c-6fx4-qh6g](https://osv.dev/vulnerability/GHSA-gh4c-6fx4-qh6g), [GHSA-mf9v-mfxr-j63j](https://osv.dev/vulnerability/GHSA-mf9v-mfxr-j63j), [GHSA-qccp-gfcp-xxvc](https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc), [GHSA-vxq7-64xx-v4gw](https://osv.dev/vulnerability/GHSA-vxq7-64xx-v4gw), [PYSEC-2026-141](https://osv.dev/vulnerability/PYSEC-2026-141), [PYSEC-2026-142](https://osv.dev/vulnerability/PYSEC-2026-142), [PYSEC-2026-4175](https://osv.dev/vulnerability/PYSEC-2026-4175), [PYSEC-2026-4176](https://osv.dev/vulnerability/PYSEC-2026-4176), [PYSEC-2026-4177](https://osv.dev/vulnerability/PYSEC-2026-4177) - `werkzeug 3.1.8` (PyPI, `uv.lock`): [GHSA-g6x2-hccm-hh4m](https://osv.dev/vulnerability/GHSA-g6x2-hccm-hh4m), [PYSEC-2026-4312](https://osv.dev/vulnerability/PYSEC-2026-4312) ## Published image (trivy) - **HIGH** CVE-2026-76642 — `bsdutils 1:2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78408 — `bsdutils 1:2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78409 — `bsdutils 1:2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78410 — `bsdutils 1:2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-54369 — `libacl1 2.3.2-2+b1` (no fix released) - **HIGH** CVE-2026-76642 — `libblkid1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78408 — `libblkid1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78409 — `libblkid1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78410 — `libblkid1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-76642 — `liblastlog2-2 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78408 — `liblastlog2-2 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78409 — `liblastlog2-2 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78410 — `liblastlog2-2 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-76642 — `libmount1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78408 — `libmount1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78409 — `libmount1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78410 — `libmount1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2025-69720 — `libncursesw6 6.5+20250216-2` (no fix released) - **HIGH** CVE-2026-76642 — `libsmartcols1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78408 — `libsmartcols1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78409 — `libsmartcols1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78410 — `libsmartcols1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-16742 — `libsystemd0 257.13-1~deb13u1` (no fix released) - **HIGH** CVE-2025-69720 — `libtinfo6 6.5+20250216-2` (no fix released) - **HIGH** CVE-2026-16742 — `libudev1 257.13-1~deb13u1` (no fix released) - **HIGH** CVE-2026-76642 — `libuuid1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78408 — `libuuid1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78409 — `libuuid1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78410 — `libuuid1 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-76642 — `login 1:4.16.0-2+really2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78408 — `login 1:4.16.0-2+really2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78409 — `login 1:4.16.0-2+really2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78410 — `login 1:4.16.0-2+really2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-76642 — `mount 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78408 — `mount 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78409 — `mount 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2026-78410 — `mount 2.41.5-0+deb13u1` (no fix released) - **HIGH** CVE-2025-69720 — `ncurses-base 6.5+20250216-2` (no fix released) - **HIGH** CVE-2025-69720 — `ncurses-bin 6.5+20250216-2` (no fix released) - **HIGH** CVE-2026-9538 — `perl-base 5.40.1-6+deb13u1` (no fix released) _…and 39 more line(s) truncated — run the scanner locally or trigger the sweep with `only=` for the full list._ ## Coverage & limits - All four scanners ran with nothing skipped.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate-bot bvandeusen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bvandeusen/FabledScribe#108