Skip to content

UID2-7812, UID2-7813, UID2-7814, UID2-7815: suppress 4 CVEs in .trivyignore #1059

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
swibi-ttd merged 1 commit into from
Sep 3, 2026
Merged

UID2-7812, UID2-7813, UID2-7814, UID2-7815: suppress 4 CVEs in .trivyignore #1059

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,3 +62,32 @@ CVE-2026-73088 exp:2026-12-02
# queries; served output is static HTML, no runtime browserslist() call.
# See: UID2-7803
CVE-2026-73089 exp:2026-12-02

# CVE-2026-75899 — fast-uri (HIGH).
# Not exploitable here: package-lock.json resolves fast-uri 3.1.4 only under node_modules/ajv-
# formats/node_modules/fast-uri and node_modules/schema-utils/node_modules/fast-uri (Docusaurus
# build tooling). fast-uri appears only in package.json overrides, lock, and .trivyignore — no
# source import.
# See: UID2-7812
CVE-2026-75899 exp:2026-12-03

# CVE-2026-75931 — fast-uri (HIGH).
# Not exploitable here: fast-uri@3.1.4 appears only under node_modules/ajv-formats and
# node_modules/schema-utils (transitive via ajv); overrides pin in package.json. Static
# Docusaurus site; no source import of fast-uri/ajv, no fastify. Vulnerable resolve()/equal()
# path not called by application code.
# See: UID2-7813
CVE-2026-75931 exp:2026-12-03

# CVE-2026-75975 — fast-uri (HIGH).
# Not exploitable here: fast-uri@3.1.4 only under ajv-formats/ajv and schema-utils/ajv in
# lockfile; overrides ^3.1.4. Docusaurus docs site with no direct fast-uri/ajv usage in source.
# See: UID2-7814
CVE-2026-75975 exp:2026-12-03

# CVE-2026-76172 — fast-uri (HIGH).
# Not exploitable here: fast-uri@3.1.4 only under node_modules/ajv-formats/node_modules/ajv and
# node_modules/schema-utils/node_modules/ajv (Docusaurus build). No direct fast-uri/ajv usage
# in source; ajv runs at build time parsing JSON Schema URIs.
# See: UID2-7815
CVE-2026-76172 exp:2026-12-03