تخطَّ إلى المحتوى
QuenchWorks

VEXCoolify Realtime

Coolify Realtime

1 بيان, صدرت في .كل بيان نتيجةٌ من الماسح غير قابلة للاستغلال في هذه الصورة، مع السبب.

الصورةOpenVEX JSON

@id https://quench-works.com/vex/coolify-realtime/2026-11-02

  1. CVE-2026-118764

    غير متأثر · الشيفرة المعرّضة غير موجودة
    • minimatch 5.1.8

    The advisory: minimatch before 11.0.1 expands attacker-controlled **/.. segments in firstPhasePreProcess() and compares them pairwise in secondPhasePreProcess(), run at optimizationLevel 2 or higher. Those functions and the optimizationLevel option arrived with the minimatch 7+ rewrite. Verified 2026-11-02 on the npm tarball minimatch-5.1.8.tgz (sha256 3effb35e05b4291721c5a37775dfcf9350cf7a031def3f7b674ecc638219cd4a): grep -c 'firstPhasePreProcess\|optimizationLevel' returned 0 for package/minimatch.js and package/lib/path.js, the only JavaScript files it ships. 5.1.8 is the glob-scoped copy under pm2's glob 8, which needs minimatch ^5.