VEX / grist

grist

3 statements, issued 2026-11-01.Each one is a scanner finding that is not exploitable in this image, and why.

@id https://quench-works.com/vex/grist/2026-11-01

1. CVE-2026-118764

   not affected · vulnerable code not present
   • minimatch 3.1.5

   The advisory: minimatch before 11.0.1 expands attacker-controlled **/.. segments in firstPhasePreProcess() and compares them pairwise in secondPhasePreProcess(), run at optimizationLevel 2 or higher. Those functions and the optimizationLevel option arrived with the minimatch 7+ rewrite; 3.1.5 is the old single-file implementation. Verified 2026-11-01 on the npm tarball minimatch-3.1.5.tgz: grep -c 'firstPhasePreProcess\|optimizationLevel' package/minimatch.js returned 0. The 3.1.5 copy in grist 1.7.21 is pulled by glob 7 and readdir-glob 1.1.1 (yarn.lock).

2. CVE-2026-118773

   not affected · vulnerable code not in execute path
   • glob 10.5.0

   The advisory: in glob 9.0.0 to 14.0.1 the abort branches of walkCB/walkCB2/walkCBSync/walkCB2Sync (src/walker.ts) invoke callbacks without returning after an AbortSignal fires, so traversal continues past the timeout. The branches are reached only when a caller passes the signal option. In grist 1.7.21 glob 10.5.0 is required by typeorm 0.3.31 and archiver-utils 5.0.2 (yarn.lock; mocha is a dev dependency, removed by yarn install --production). typeorm calls glob.sync(dir) with no options (util/DirectoryExportedClassesLoader.js:32 and :58); archiver-utils calls glob.sync(pattern, options) in file.js:65 and the word signal appears nowhere in that package; its only consumer here, zip-stream 6.0.1, uses util.defaults, sanitizePath and dateify (index.js:62, :77, :91) and never file.expand. Grist does not depend on glob directly. Verified 2026-11-01 with grep over the npm tarballs of typeorm 0.3.31, archiver-utils 5.0.2 and zip-stream 6.0.1.

3. CVE-2026-118764

   not affected · vulnerable code cannot be controlled by adversary
   • minimatch 9.0.9

   The advisory needs an attacker-controlled glob pattern with **/.. segments. In the grist 1.7.21 production tree minimatch 9.0.9 is reached only through glob 10.5.0 (its other dependents, typescript-estree and mocha, are dev dependencies). glob 10.5.0 is called by typeorm with the TypeORM entity, migration and subscriber globs built from a code constant in app/server/lib/dbUtils.ts:183-191 (`${codeRoot}/app/gen-server/entity/*.js` and siblings), and archiver-utils' glob path is never called (zip-stream 6.0.1 uses only defaults, sanitizePath and dateify). No request or document value reaches a glob pattern. Verified 2026-11-01 by grep over the grist v1.7.21 source and the npm tarballs of typeorm 0.3.31, archiver-utils 5.0.2 and zip-stream 6.0.1.