VEXgrist
grist
3 declaraciones, emitidas el .Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.
@id https://quench-works.com/vex/grist/2026-11-01
CVE-2026-118764
no afectado · código vulnerable ausente- minimatch 3.1.5
The advisory: minimatch before 11.0.1 expands attacker-controlled **/.. segments in firstPhasePreProcess() and compares them pairwise in secondPhasePreProcess(), run at optimizationLevel 2 or higher. Those functions and the optimizationLevel option arrived with the minimatch 7+ rewrite; 3.1.5 is the old single-file implementation. Verified 2026-11-01 on the npm tarball minimatch-3.1.5.tgz: grep -c 'firstPhasePreProcess\|optimizationLevel' package/minimatch.js returned 0. The 3.1.5 copy in grist 1.7.21 is pulled by glob 7 and readdir-glob 1.1.1 (yarn.lock).
CVE-2026-118773
no afectado · código vulnerable fuera de la ruta de ejecución- glob 10.5.0
The advisory: in glob 9.0.0 to 14.0.1 the abort branches of walkCB/walkCB2/walkCBSync/walkCB2Sync (src/walker.ts) invoke callbacks without returning after an AbortSignal fires, so traversal continues past the timeout. The branches are reached only when a caller passes the signal option. In grist 1.7.21 glob 10.5.0 is required by typeorm 0.3.31 and archiver-utils 5.0.2 (yarn.lock; mocha is a dev dependency, removed by yarn install --production). typeorm calls glob.sync(dir) with no options (util/DirectoryExportedClassesLoader.js:32 and :58); archiver-utils calls glob.sync(pattern, options) in file.js:65 and the word signal appears nowhere in that package; its only consumer here, zip-stream 6.0.1, uses util.defaults, sanitizePath and dateify (index.js:62, :77, :91) and never file.expand. Grist does not depend on glob directly. Verified 2026-11-01 with grep over the npm tarballs of typeorm 0.3.31, archiver-utils 5.0.2 and zip-stream 6.0.1.
CVE-2026-118764
no afectado · el atacante no puede controlar el código vulnerable- minimatch 9.0.9
The advisory needs an attacker-controlled glob pattern with **/.. segments. In the grist 1.7.21 production tree minimatch 9.0.9 is reached only through glob 10.5.0 (its other dependents, typescript-estree and mocha, are dev dependencies). glob 10.5.0 is called by typeorm with the TypeORM entity, migration and subscriber globs built from a code constant in app/server/lib/dbUtils.ts:183-191 (`${codeRoot}/app/gen-server/entity/*.js` and siblings), and archiver-utils' glob path is never called (zip-stream 6.0.1 uses only defaults, sanitizePath and dateify). No request or document value reaches a glob pattern. Verified 2026-11-01 by grep over the grist v1.7.21 source and the npm tarballs of typeorm 0.3.31, archiver-utils 5.0.2 and zip-stream 6.0.1.