{
  "schema_version": 1,
  "app_id": "io.thepeoples.Joplin",
  "slug": "joplin",
  "version": "3.7.21",
  "scanned_at": "2026-10-12T06:51:13Z",
  "scanner": {
    "name": "trivy",
    "version": "0.73.0",
    "db_updated_at": "2026-10-12T01:14:57Z"
  },
  "input": {
    "kind": "deb",
    "filename": "Joplin-3.7.21.deb",
    "sha256": "14de2d5524e45341de5f0b68a1e78191b796a6c9817949c49b80afe5cd6ab965",
    "extracted_without_scripts": true
  },
  "gate": {
    "result": "pass",
    "fail_on": "wrap CRITICAL"
  },
  "counts": {
    "wrap": {
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0,
      "unknown": 0
    },
    "vendor": {
      "critical": 7,
      "high": 74,
      "medium": 37,
      "low": 7,
      "unknown": 0
    }
  },
  "coverage": {
    "packages_seen": 338,
    "wrap": {
      "status": "inventoried",
      "packages_seen": 0,
      "notes": []
    },
    "vendor": {
      "status": "inventoried",
      "packages_seen": 338,
      "notes": [
        "electron asar",
        "electron 39.8.5 from package.json",
        "read 224 package.json file(s)",
        "trivy sbom on 228 derived PURLs"
      ]
    }
  },
  "findings": [
    {
      "id": "CVE-2017-16137",
      "severity": "LOW",
      "pkg": "debug",
      "installed": "4.1.0",
      "fixed": "2.6.9, 3.1.0, 3.2.7, 4.3.1",
      "class": "vendor",
      "title": "nodejs-debug: Regular expression Denial of Service"
    },
    {
      "id": "CVE-2020-7598",
      "severity": "MEDIUM",
      "pkg": "minimist",
      "installed": "1.2.0",
      "fixed": "0.2.1, 1.2.3",
      "class": "vendor",
      "title": "nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload"
    },
    {
      "id": "CVE-2020-7788",
      "severity": "HIGH",
      "pkg": "ini",
      "installed": "1.3.0",
      "fixed": "1.3.6",
      "class": "vendor",
      "title": "nodejs-ini: Prototype pollution via malicious INI file"
    },
    {
      "id": "CVE-2021-27290",
      "severity": "HIGH",
      "pkg": "ssri",
      "installed": "8.0.0",
      "fixed": "6.0.2, 7.1.1, 8.0.1",
      "class": "vendor",
      "title": "nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode"
    },
    {
      "id": "CVE-2021-32803",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "3.2.3, 4.4.15, 5.0.7, 6.1.2",
      "class": "vendor",
      "title": "nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite"
    },
    {
      "id": "CVE-2021-32804",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "3.2.2, 4.4.14, 5.0.6, 6.1.1",
      "class": "vendor",
      "title": "nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite"
    },
    {
      "id": "CVE-2021-37701",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "4.4.16, 5.0.8, 6.1.7",
      "class": "vendor",
      "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite"
    },
    {
      "id": "CVE-2021-37701",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "4.4.16, 5.0.8, 6.1.7",
      "class": "vendor",
      "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite"
    },
    {
      "id": "CVE-2021-37712",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "4.4.18, 5.0.10, 6.1.9",
      "class": "vendor",
      "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite"
    },
    {
      "id": "CVE-2021-37712",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "4.4.18, 5.0.10, 6.1.9",
      "class": "vendor",
      "title": "nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite"
    },
    {
      "id": "CVE-2021-37713",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "4.4.18, 5.0.10, 6.1.9",
      "class": "vendor",
      "title": "nodejs-tar: Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization"
    },
    {
      "id": "CVE-2021-37713",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "4.4.18, 5.0.10, 6.1.9",
      "class": "vendor",
      "title": "nodejs-tar: Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization"
    },
    {
      "id": "CVE-2021-44906",
      "severity": "CRITICAL",
      "pkg": "minimist",
      "installed": "1.2.0",
      "fixed": "1.2.6, 0.2.4",
      "class": "vendor",
      "title": "minimist: prototype pollution"
    },
    {
      "id": "CVE-2021-44906",
      "severity": "CRITICAL",
      "pkg": "minimist",
      "installed": "1.2.3",
      "fixed": "1.2.6, 0.2.4",
      "class": "vendor",
      "title": "minimist: prototype pollution"
    },
    {
      "id": "CVE-2022-0355",
      "severity": "HIGH",
      "pkg": "simple-get",
      "installed": "4.0.0",
      "fixed": "4.0.1, 3.1.1, 2.8.2",
      "class": "vendor",
      "title": "simple-get: exposure of sensitive information to an unauthorized actor"
    },
    {
      "id": "CVE-2022-24713",
      "severity": "HIGH",
      "pkg": "regex",
      "installed": "1.4.6",
      "fixed": "1.5.5",
      "class": "vendor",
      "title": "Mozilla: Denial of Service via complex regular expressions"
    },
    {
      "id": "CVE-2022-25881",
      "severity": "HIGH",
      "pkg": "http-cache-semantics",
      "installed": "4.1.0",
      "fixed": "4.1.1",
      "class": "vendor",
      "title": "http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability"
    },
    {
      "id": "CVE-2022-25883",
      "severity": "HIGH",
      "pkg": "semver",
      "installed": "6.0.0",
      "fixed": "7.5.2, 6.3.1, 5.7.2",
      "class": "vendor",
      "title": "nodejs-semver: Regular expression denial of service"
    },
    {
      "id": "CVE-2022-25883",
      "severity": "HIGH",
      "pkg": "semver",
      "installed": "7.3.2",
      "fixed": "7.5.2, 6.3.1, 5.7.2",
      "class": "vendor",
      "title": "nodejs-semver: Regular expression denial of service"
    },
    {
      "id": "CVE-2022-25883",
      "severity": "HIGH",
      "pkg": "semver",
      "installed": "7.3.5",
      "fixed": "7.5.2, 6.3.1, 5.7.2",
      "class": "vendor",
      "title": "nodejs-semver: Regular expression denial of service"
    },
    {
      "id": "CVE-2022-3517",
      "severity": "HIGH",
      "pkg": "minimatch",
      "installed": "3.0.4",
      "fixed": "3.0.5",
      "class": "vendor",
      "title": "nodejs-minimatch: ReDoS via the braceExpand function"
    },
    {
      "id": "CVE-2023-36665",
      "severity": "CRITICAL",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "7.2.5, 6.11.4",
      "class": "vendor",
      "title": "protobufjs: prototype pollution using user-controlled protobuf message"
    },
    {
      "id": "CVE-2023-42282",
      "severity": "LOW",
      "pkg": "ip",
      "installed": "1.1.5",
      "fixed": "2.0.1, 1.1.9",
      "class": "vendor",
      "title": "nodejs-ip: arbitrary code execution via the isPublic() function"
    },
    {
      "id": "CVE-2024-12905",
      "severity": "HIGH",
      "pkg": "tar-fs",
      "installed": "2.0.0",
      "fixed": "1.16.4, 2.1.2, 3.0.7",
      "class": "vendor",
      "title": "tar-fs: link following and path traversal via maliciously crafted tar file"
    },
    {
      "id": "CVE-2024-28863",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "6.2.1",
      "class": "vendor",
      "title": "node-tar: denial of service while parsing a tar file due to lack of folders depth validation"
    },
    {
      "id": "CVE-2024-28863",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "6.2.1",
      "class": "vendor",
      "title": "node-tar: denial of service while parsing a tar file due to lack of folders depth validation"
    },
    {
      "id": "CVE-2024-28863",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "6.2.1",
      "class": "vendor",
      "title": "node-tar: denial of service while parsing a tar file due to lack of folders depth validation"
    },
    {
      "id": "CVE-2024-29415",
      "severity": "HIGH",
      "pkg": "ip",
      "installed": "1.1.5",
      "fixed": "",
      "class": "vendor",
      "title": "node-ip: Incomplete fix for CVE-2023-42282"
    },
    {
      "id": "CVE-2025-48387",
      "severity": "HIGH",
      "pkg": "tar-fs",
      "installed": "2.0.0",
      "fixed": "1.16.5, 2.1.3, 3.0.9",
      "class": "vendor",
      "title": "tar-fs: tar-fs has issue where extract can write outside the specified dir with a specific tarball"
    },
    {
      "id": "CVE-2025-58160",
      "severity": "LOW",
      "pkg": "tracing-subscriber",
      "installed": "0.2.25",
      "fixed": "0.3.20",
      "class": "vendor",
      "title": "tracing-subscriber: Tracing log pollution"
    },
    {
      "id": "CVE-2025-5889",
      "severity": "LOW",
      "pkg": "brace-expansion",
      "installed": "1.1.7",
      "fixed": "2.0.2, 1.1.12, 3.0.1, 4.0.1",
      "class": "vendor",
      "title": "brace-expansion: juliangruber brace-expansion index.js expand redos"
    },
    {
      "id": "CVE-2025-59343",
      "severity": "HIGH",
      "pkg": "tar-fs",
      "installed": "2.0.0",
      "fixed": "3.1.1, 2.1.4, 1.16.6",
      "class": "vendor",
      "title": "tar-fs: tar-fs symlink validation bypass"
    },
    {
      "id": "CVE-2026-102276",
      "severity": "HIGH",
      "pkg": "brace-expansion",
      "installed": "1.1.7",
      "fixed": "5.0.10, 3.0.7, 2.1.5, 1.1.19",
      "class": "vendor",
      "title": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns"
    },
    {
      "id": "CVE-2026-102277",
      "severity": "MEDIUM",
      "pkg": "brace-expansion",
      "installed": "1.1.7",
      "fixed": "5.0.12, 3.0.9, 2.1.7, 1.1.21",
      "class": "vendor",
      "title": "brace-expansion: brace-expansion: Denial of Service via crafted brace patterns"
    },
    {
      "id": "CVE-2026-102278",
      "severity": "HIGH",
      "pkg": "brace-expansion",
      "installed": "1.1.7",
      "fixed": "5.0.11, 3.0.8, 2.1.6, 1.1.20",
      "class": "vendor",
      "title": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns"
    },
    {
      "id": "CVE-2026-102282",
      "severity": "HIGH",
      "pkg": "adm-zip",
      "installed": "0.5.16",
      "fixed": "0.6.1",
      "class": "vendor",
      "title": "adm-zip: adm-zip: Privilege escalation via unfiltered permission bits in extracted archives"
    },
    {
      "id": "CVE-2026-102672",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.10, 41.10.5, 42.0.0-beta.2",
      "class": "vendor",
      "title": "Electron: Local race condition in Squirrel.Mac update installation on macOS"
    },
    {
      "id": "CVE-2026-102673",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "41.10.4, 42.5.2, 43.0.0",
      "class": "vendor",
      "title": "electron: Electron: Sandbox bypass via popups opened from sandboxed iframes"
    },
    {
      "id": "CVE-2026-102674",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: Electron: Sandbox bypass via popup window creation"
    },
    {
      "id": "CVE-2026-102675",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers"
    },
    {
      "id": "CVE-2026-102676",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: electron: Privilege escalation via unauthorized Node.js integration in web workers"
    },
    {
      "id": "CVE-2026-13149",
      "severity": "HIGH",
      "pkg": "brace-expansion",
      "installed": "1.1.7",
      "fixed": "5.0.7, 1.1.16, 2.1.2",
      "class": "vendor",
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "id": "CVE-2026-14257",
      "severity": "HIGH",
      "pkg": "brace-expansion",
      "installed": "1.1.7",
      "fixed": "5.0.8, 3.0.3, 2.1.3, 1.1.17",
      "class": "vendor",
      "title": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function"
    },
    {
      "id": "CVE-2026-23745",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.3",
      "class": "vendor",
      "title": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives"
    },
    {
      "id": "CVE-2026-23745",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.3",
      "class": "vendor",
      "title": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives"
    },
    {
      "id": "CVE-2026-23745",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.3",
      "class": "vendor",
      "title": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives"
    },
    {
      "id": "CVE-2026-23950",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.4",
      "class": "vendor",
      "title": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition"
    },
    {
      "id": "CVE-2026-23950",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.4",
      "class": "vendor",
      "title": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition"
    },
    {
      "id": "CVE-2026-23950",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.4",
      "class": "vendor",
      "title": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition"
    },
    {
      "id": "CVE-2026-24842",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.7",
      "class": "vendor",
      "title": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check"
    },
    {
      "id": "CVE-2026-24842",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.7",
      "class": "vendor",
      "title": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check"
    },
    {
      "id": "CVE-2026-24842",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.7",
      "class": "vendor",
      "title": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check"
    },
    {
      "id": "CVE-2026-25541",
      "severity": "MEDIUM",
      "pkg": "bytes",
      "installed": "1.10.1",
      "fixed": "1.11.1",
      "class": "vendor",
      "title": "Bytes is a utility library for working with bytes. From version 1.2.1  ..."
    },
    {
      "id": "CVE-2026-25727",
      "severity": "MEDIUM",
      "pkg": "time",
      "installed": "0.3.44",
      "fixed": "0.3.47",
      "class": "vendor",
      "title": "time: time affected by a stack exhaustion denial of service attack"
    },
    {
      "id": "CVE-2026-26960",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.8",
      "class": "vendor",
      "title": "node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation"
    },
    {
      "id": "CVE-2026-26960",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.8",
      "class": "vendor",
      "title": "node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation"
    },
    {
      "id": "CVE-2026-26960",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.8",
      "class": "vendor",
      "title": "node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation"
    },
    {
      "id": "CVE-2026-26996",
      "severity": "HIGH",
      "pkg": "minimatch",
      "installed": "3.0.4",
      "fixed": "10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3",
      "class": "vendor",
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "id": "CVE-2026-27903",
      "severity": "HIGH",
      "pkg": "minimatch",
      "installed": "3.0.4",
      "fixed": "10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3",
      "class": "vendor",
      "title": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns"
    },
    {
      "id": "CVE-2026-27904",
      "severity": "HIGH",
      "pkg": "minimatch",
      "installed": "3.0.4",
      "fixed": "10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4",
      "class": "vendor",
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
    },
    {
      "id": "CVE-2026-29786",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.10",
      "class": "vendor",
      "title": "node-tar: hardlink path traversal via drive-relative linkpath"
    },
    {
      "id": "CVE-2026-29786",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.10",
      "class": "vendor",
      "title": "node-tar: hardlink path traversal via drive-relative linkpath"
    },
    {
      "id": "CVE-2026-29786",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.10",
      "class": "vendor",
      "title": "node-tar: hardlink path traversal via drive-relative linkpath"
    },
    {
      "id": "CVE-2026-31802",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.11",
      "class": "vendor",
      "title": "tar: tar: File overwrite via drive-relative symlink traversal"
    },
    {
      "id": "CVE-2026-31802",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.11",
      "class": "vendor",
      "title": "tar: tar: File overwrite via drive-relative symlink traversal"
    },
    {
      "id": "CVE-2026-31802",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.11",
      "class": "vendor",
      "title": "tar: tar: File overwrite via drive-relative symlink traversal"
    },
    {
      "id": "CVE-2026-33750",
      "severity": "MEDIUM",
      "pkg": "brace-expansion",
      "installed": "1.1.7",
      "fixed": "5.0.5, 3.0.2, 2.0.3, 1.1.13",
      "class": "vendor",
      "title": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern"
    },
    {
      "id": "CVE-2026-39244",
      "severity": "HIGH",
      "pkg": "adm-zip",
      "installed": "0.5.16",
      "fixed": "0.6.0",
      "class": "vendor",
      "title": "adm-zip: adm-zip: Denial of Service via crafted ZIP file leading to excessive memory allocation"
    },
    {
      "id": "CVE-2026-41242",
      "severity": "CRITICAL",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "8.0.1, 7.5.5",
      "class": "vendor",
      "title": "protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields"
    },
    {
      "id": "CVE-2026-44288",
      "severity": "MEDIUM",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "7.5.6, 8.0.2",
      "class": "vendor",
      "title": "protobufjs: protobufjs: Security control bypass due to improper handling of overlong UTF-8 sequences"
    },
    {
      "id": "CVE-2026-44289",
      "severity": "HIGH",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "7.5.6, 8.0.2",
      "class": "vendor",
      "title": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding"
    },
    {
      "id": "CVE-2026-44290",
      "severity": "HIGH",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "7.5.6, 8.0.2",
      "class": "vendor",
      "title": "protobufjs: protobufjs: Denial of Service via crafted schema"
    },
    {
      "id": "CVE-2026-44291",
      "severity": "HIGH",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "7.5.6, 8.0.2",
      "class": "vendor",
      "title": "protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution"
    },
    {
      "id": "CVE-2026-44292",
      "severity": "MEDIUM",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "7.5.6, 8.0.2",
      "class": "vendor",
      "title": "protobufjs: protobufjs: Data integrity impact due to prototype pollution"
    },
    {
      "id": "CVE-2026-44293",
      "severity": "HIGH",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "7.5.6, 8.0.2",
      "class": "vendor",
      "title": "protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors"
    },
    {
      "id": "CVE-2026-44294",
      "severity": "MEDIUM",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "7.5.6, 8.0.2",
      "class": "vendor",
      "title": "protobufjs: protobufjs: Denial of Service due to unescaped control characters in field names"
    },
    {
      "id": "CVE-2026-45740",
      "severity": "MEDIUM",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "7.5.8, 8.2.0",
      "class": "vendor",
      "title": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors"
    },
    {
      "id": "CVE-2026-48712",
      "severity": "HIGH",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "7.6.1, 8.4.1",
      "class": "vendor",
      "title": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload"
    },
    {
      "id": "CVE-2026-53655",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.16",
      "class": "vendor",
      "title": "node-tar: node-tar: File smuggling due to inconsistent tar archive parsing"
    },
    {
      "id": "CVE-2026-53655",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.16",
      "class": "vendor",
      "title": "node-tar: node-tar: File smuggling due to inconsistent tar archive parsing"
    },
    {
      "id": "CVE-2026-53655",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.16",
      "class": "vendor",
      "title": "node-tar: node-tar: File smuggling due to inconsistent tar archive parsing"
    },
    {
      "id": "CVE-2026-54269",
      "severity": "MEDIUM",
      "pkg": "protobufjs",
      "installed": "7.2.4",
      "fixed": "7.6.3, 8.6.0",
      "class": "vendor",
      "title": "protobufjs: protobufjs-cli: protobufjs: Denial of Service due to name collision with runtime helpers"
    },
    {
      "id": "CVE-2026-59871",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.18",
      "class": "vendor",
      "title": "node-tar: node-tar: Denial of Service due to incorrect PAX path handling"
    },
    {
      "id": "CVE-2026-59871",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.18",
      "class": "vendor",
      "title": "node-tar: node-tar: Denial of Service due to incorrect PAX path handling"
    },
    {
      "id": "CVE-2026-59871",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.18",
      "class": "vendor",
      "title": "node-tar: node-tar: Denial of Service due to incorrect PAX path handling"
    },
    {
      "id": "CVE-2026-59873",
      "severity": "CRITICAL",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.19",
      "class": "vendor",
      "title": "tar: node-tar: Denial of Service via crafted gzip bomb"
    },
    {
      "id": "CVE-2026-59873",
      "severity": "CRITICAL",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.19",
      "class": "vendor",
      "title": "tar: node-tar: Denial of Service via crafted gzip bomb"
    },
    {
      "id": "CVE-2026-59873",
      "severity": "CRITICAL",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.19",
      "class": "vendor",
      "title": "tar: node-tar: Denial of Service via crafted gzip bomb"
    },
    {
      "id": "CVE-2026-59874",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.18",
      "class": "vendor",
      "title": "tar: Node-tar: Denial of Service via malformed tar archive header"
    },
    {
      "id": "CVE-2026-59874",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.18",
      "class": "vendor",
      "title": "tar: Node-tar: Denial of Service via malformed tar archive header"
    },
    {
      "id": "CVE-2026-59874",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.18",
      "class": "vendor",
      "title": "tar: Node-tar: Denial of Service via malformed tar archive header"
    },
    {
      "id": "CVE-2026-59875",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.17",
      "class": "vendor",
      "title": "node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata"
    },
    {
      "id": "CVE-2026-59875",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.17",
      "class": "vendor",
      "title": "node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata"
    },
    {
      "id": "CVE-2026-59875",
      "severity": "MEDIUM",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.17",
      "class": "vendor",
      "title": "node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata"
    },
    {
      "id": "CVE-2026-69152",
      "severity": "HIGH",
      "pkg": "brace-expansion",
      "installed": "1.1.7",
      "fixed": "1.1.18, 2.1.4, 3.0.6, 5.0.9",
      "class": "vendor",
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
    },
    {
      "id": "CVE-2026-70597",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Parent process code-sign check is spoofable"
    },
    {
      "id": "CVE-2026-70598",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.10, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size"
    },
    {
      "id": "CVE-2026-70599",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin"
    },
    {
      "id": "CVE-2026-70600",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Cross-origin iframe can position native autofill popup"
    },
    {
      "id": "CVE-2026-70601",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5",
      "class": "vendor",
      "title": "Electron: Context isolation bypass via Function.prototype.bind hijack"
    },
    {
      "id": "CVE-2026-70602",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Extension tab APIs operate across session boundaries"
    },
    {
      "id": "CVE-2026-70603",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "42.0.0-beta.1, 41.1.1, 40.9.0, 39.8.6",
      "class": "vendor",
      "title": "Electron: shell.openPath path validation bypass via embedded null byte"
    },
    {
      "id": "CVE-2026-70604",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "42.0.0, 41.4.0, 40.9.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads"
    },
    {
      "id": "CVE-2026-70605",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: HTTP redirect followed into local file loader"
    },
    {
      "id": "CVE-2026-70607",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: window.open features string controls some window options considered privileged"
    },
    {
      "id": "CVE-2026-70608",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "42.0.1, 41.10.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path"
    },
    {
      "id": "CVE-2026-70609",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"
    },
    {
      "id": "CVE-2026-70610",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4",
      "class": "vendor",
      "title": "Electron: contextBridge object copy honors prototype setters"
    },
    {
      "id": "CVE-2026-70611",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: DevTools embedder handler executes arbitrary files via shell open"
    },
    {
      "id": "CVE-2026-70612",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "39.8.5",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Sandboxed iframes can launch external protocol handlers"
    },
    {
      "id": "CVE-2026-73566",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.0.2",
      "fixed": "7.5.21",
      "class": "vendor",
      "title": "tar: node-tar: Denial of Service via crafted long-path tar archive"
    },
    {
      "id": "CVE-2026-73566",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.11",
      "fixed": "7.5.21",
      "class": "vendor",
      "title": "tar: node-tar: Denial of Service via crafted long-path tar archive"
    },
    {
      "id": "CVE-2026-73566",
      "severity": "HIGH",
      "pkg": "tar",
      "installed": "6.1.2",
      "fixed": "7.5.21",
      "class": "vendor",
      "title": "tar: node-tar: Denial of Service via crafted long-path tar archive"
    },
    {
      "id": "CVE-2026-76845",
      "severity": "MEDIUM",
      "pkg": "adm-zip",
      "installed": "0.5.16",
      "fixed": "",
      "class": "vendor",
      "title": "adm-zip: adm-zip: Arbitrary File Overwrite via Symlink Following"
    },
    {
      "id": "CVE-2026-77301",
      "severity": "HIGH",
      "pkg": "adm-zip",
      "installed": "0.5.16",
      "fixed": "0.6.1",
      "class": "vendor",
      "title": "adm-zip: adm-zip: Denial of Service via uncontrolled memory allocation"
    },
    {
      "id": "CVE-2026-93748",
      "severity": "HIGH",
      "pkg": "http-cache-semantics",
      "installed": "4.1.0",
      "fixed": "",
      "class": "vendor",
      "title": "http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive"
    },
    {
      "id": "CVE-2026-97058",
      "severity": "MEDIUM",
      "pkg": "sprintf-js",
      "installed": "1.1.2",
      "fixed": "",
      "class": "vendor",
      "title": "sprintf-js: sprintf-js: Denial of Service via unbounded precision specifiers"
    },
    {
      "id": "GHSA-8238-w5pm-2374",
      "severity": "HIGH",
      "pkg": "adm-zip",
      "installed": "0.5.16",
      "fixed": "0.6.1",
      "class": "vendor",
      "title": "adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)"
    },
    {
      "id": "GHSA-c6fg-446q-cg94",
      "severity": "MEDIUM",
      "pkg": "adm-zip",
      "installed": "0.5.16",
      "fixed": "0.6.1",
      "class": "vendor",
      "title": "adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path"
    },
    {
      "id": "GHSA-cq8v-f236-94qc",
      "severity": "LOW",
      "pkg": "rand",
      "installed": "0.7.3",
      "fixed": "0.9.3, 0.10.1, 0.8.6",
      "class": "vendor",
      "title": "Rand is unsound with a custom logger using rand::rng()"
    },
    {
      "id": "GHSA-f88m-g3jw-g9cj",
      "severity": "HIGH",
      "pkg": "sharp",
      "installed": "0.34.5",
      "fixed": "0.35.0",
      "class": "vendor",
      "title": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591"
    },
    {
      "id": "GHSA-p634-w6r4-rjp2",
      "severity": "MEDIUM",
      "pkg": "adm-zip",
      "installed": "0.5.16",
      "fixed": "0.6.1",
      "class": "vendor",
      "title": "adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content"
    },
    {
      "id": "GHSA-rcw4-f5rp-g42v",
      "severity": "HIGH",
      "pkg": "adm-zip",
      "installed": "0.5.16",
      "fixed": "0.6.1",
      "class": "vendor",
      "title": "adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0"
    },
    {
      "id": "GHSA-rgj7-g3m4-5g8c",
      "severity": "HIGH",
      "pkg": "sharp",
      "installed": "0.34.5",
      "fixed": "0.35.4",
      "class": "vendor",
      "title": "sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545"
    },
    {
      "id": "GHSA-wq5f-xc86-pv6w",
      "severity": "HIGH",
      "pkg": "sharp",
      "installed": "0.34.5",
      "fixed": "0.35.5",
      "class": "vendor",
      "title": "sharp : Vulnerability in librsvg dependency CVE-2026-96889"
    }
  ]
}