VEX / Coolify Helper

Coolify Helper

2 statements, issued 2026-10-13.Each one is a scanner finding that is not exploitable in this image, and why.

@id https://quench-works.com/vex/coolify-helper/2026-10-13

1. GHSA-7gcf-g7xr-8hxj

   not affected · vulnerable code not present
   • serde_with 2.3.3

   GHSA-7gcf-g7xr-8hxj is a panic in serde_with's KeyValueMap serializer. nixpacks 1.41.0 (the last release; serde_with 2.x, fix only in 3.21.0) uses serde_with only for the #[serde_with::skip_serializing_none] attribute (src/nixpacks/nix/pkg.rs:5, plan/phase.rs:14 and :50, plan/mod.rs:29); grep for KeyValueMap over nixpacks src returned 0 matches. KeyValueMap is a generic serde_as adapter that is only compiled when named, so its code is not in the binary. The recipe fails the build if nixpacks ever names KeyValueMap. Verified 2026-10-13.

2. GHSA-mc8h-8q98-g5hr

   not affected · vulnerable code not present
   • remove_dir_all 0.5.3

   GHSA-mc8h-8q98-g5hr is a TOCTOU race in remove_dir_all's own directory walk. nixpacks reaches remove_dir_all 0.5.3 only through tempdir 0.3.7 (TempDir drop, tempdir src/lib.rs:326). Read the source of remove_dir_all 0.5.3: src/lib.rs compiles its own fs module only under cfg(windows) and on every other target is `pub use std::fs::remove_dir_all`, so this Linux image runs the standard library implementation (rust 1.96, which carries the CVE-2022-21658 fix), not the vulnerable walk. The 0.5 line has no fixed release. Verified 2026-10-13.