diff options
| author | Tobias Järvelöv <tobias.jarvelov@mullvad.net> | 2026-04-21 15:30:59 +0200 |
|---|---|---|
| committer | Tobias Järvelöv <tobias.jarvelov@mullvad.net> | 2026-04-22 10:27:42 +0200 |
| commit | a68b7dddfb5bc2257a1f041fe329b80ba78c14d1 (patch) | |
| tree | fe0f4182b297751c0bfb972ea0ede9aef1050489 | |
| parent | 9e2f04c612001e5fd5755eb5a9f7b6e7a4252d16 (diff) | |
| download | mullvadvpn-a68b7dddfb5bc2257a1f041fe329b80ba78c14d1.tar.xz mullvadvpn-a68b7dddfb5bc2257a1f041fe329b80ba78c14d1.zip | |
Ignore `node-gettext` for 4 months
Note:
The library has seen a new patch version (3.0.1), but the vulnerability
exists in that version as well. The security advisory just has not been
updated to include that version.
| -rw-r--r-- | desktop/osv-scanner.toml | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/desktop/osv-scanner.toml b/desktop/osv-scanner.toml index 756c8cd5c1..bb7219294c 100644 --- a/desktop/osv-scanner.toml +++ b/desktop/osv-scanner.toml @@ -3,7 +3,7 @@ # node-gettext: Prototype Pullution via the addTranslations function [[IgnoredVulns]] id = "CVE-2024-21528" # GHSA-g974-hxvm-x689 -ignoreUntil = 2026-04-16 # The vulnerability is ignored for 6 months as the affected library is not receiving updates and we can not patch the vulnerability without migrating to another library, which is no minor feat. +ignoreUntil = 2026-08-16 # The vulnerability is ignored for 4 months as no patch for the affected library exists and we can not address the vulnerability without migrating to another library, which is no minor feat. reason = "There is no fix yet and we don't send untrusted input to the first argument of addTranslations" # ajv: ajv has ReDoS when using $data option |