VEX / ghost

ghost

1 بيان, صدرت في 2026-11-01.كل بيان نتيجةٌ من الماسح غير قابلة للاستغلال في هذه الصورة، مع السبب.

@id https://quench-works.com/vex/ghost/2026-11-01

1. CVE-2026-118764

   غير متأثر · الشيفرة المعرّضة غير موجودة
   • minimatch 3.1.5

   The advisory: minimatch before 11.0.1 expands attacker-controlled **/.. segments in firstPhasePreProcess() and compares them pairwise in secondPhasePreProcess(), run at optimizationLevel 2 or higher. Those functions and the optimizationLevel option arrived with the minimatch 7+ rewrite; 3.1.5 is the old single-file implementation. Verified 2026-11-01 on the npm tarball minimatch-3.1.5.tgz: grep -c 'firstPhasePreProcess\|optimizationLevel' package/minimatch.js returned 0. The 10.x copies in this image are overridden to 11.0.1 instead (melange.yaml).