Repository navigation
Add npm @actions/glob package data to GHSA-2gwh-2hvc-7qgh (CVE-2025-5890) - #10367
Open
incr3d1ble wants to merge 2 commits into
Open
incr3d1ble wants to merge 2 commits into
incr3d1ble wants to merge 2 commits into
Conversation
) Refs github#10230. The advisory existed but had no affected package, so it never appeared in the OSV export. Add the npm package with the version range supported by the available evidence: - introduced 0.5.0, per the CVE record and VulDB (affected at 0.5.0) - every published release from 0.5.0 onward is listed (0.5.0, 0.5.1, 0.6.0, 0.6.1, 0.7.0), matching Snyk, which still flags the latest release as vulnerable - no fixed event: the upstream mitigation (actions/toolkit#2057) remains open and unmerged, and no patched npm release exists Also adds a Snyk reference and a summary. Signed-off-by: augustkevinsanjaya <120900788+incr3d1ble@users.noreply.github.com>
github-actions
Bot
changed the base branch from
main
to
incr3d1ble/advisory-improvement-10367
October 15, 2026 05:23
The advisory-improvement processor rejects 'NPM' with: The NPM ecosystem does not have a valid OSV mapping. The repo convention for unreviewed advisory JSON files is the lowercase OSV schema value (ecosystem: npm), e.g. GHSA-8p5q-j9m2-g8wr.json. Signed-off-by: augustkevinsanjaya <120900788+incr3d1ble@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refs #10230.
GHSA-2gwh-2hvc-7qgh (CVE-2025-5890) existed but carried no affected package, so it never appeared in the OSV export — which is exactly the gap reported in #10230: "CVE-2025-5890 affects npm @actions/glob but has no GHSA, so it is absent from OSV". The advisory record exists; it is the package binding that is missing.
This PR adds the npm package with the version range supported by the available evidence:
0.5.0— per the CVE record and VulDB ("affected at 0.5.0")0.5.0(2024-08-15),0.5.1(2026-01-27),0.6.0(2026-01-29),0.6.1(2026-01-29),0.7.0(2026-04-21) — matching Snyk, which currently flags all listed versions including the latest release as vulnerablefixedevent — the upstream mitigation (actions/toolkit#2057) remains open and unmerged, and no patched npm release exists. If a patched release ships, afixedevent should be added then.Verification
globEscapeinpackages/glob/src/internal-pattern.ts, upstream fix PR still open (checked via API,mergeable_state: dirty, never merged)@actions/globHappy to adjust the introduced version if review turns up evidence that versions before 0.5.0 are (or are not) affected — the VulDB/CVE record pins 0.5.0, so that is what I encoded.
Signed-off-by: augustkevinsanjaya 120900788+incr3d1ble@users.noreply.github.com