Skip to content

Commit 24fe8f4

Browse files
eoftedalgithub-actions[bot]
eoftedal
and
github-actions[bot]
authored
Auto-update jsrepository: angular, tinymce, ua-parser-js | GHSA-7x27-g8rg-x87w, GHSA-pjwm-rvh2-c87w, GHSA-v98h-vmpc-fpqv (#600)
Updated libraries (3): angular, tinymce, ua-parser-js Updated vulnerability IDs (3): GHSA-7x27-g8rg-x87w, GHSA-pjwm-rvh2-c87w, GHSA-v98h-vmpc-fpqv Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent ae874c5 commit 24fe8f4

9 files changed

Lines changed: 411 additions & 188 deletions

‎repository/jsrepository-master.json‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1958,7 +1958,7 @@
19581958
"ranges": [
19591959
{
19601960
"atOrAbove": "0",
1961-
"below": "5.11.1"
1961+
"below": "5.10.10"
19621962
},
19631963
{
19641964
"atOrAbove": "6.0.0",
@@ -3413,6 +3413,35 @@
34133413
"info": [
34143414
"https://github.com/advisories/GHSA-2qqx-w9hr-q5gx"
34153415
]
3416+
},
3417+
{
3418+
"ranges": [
3419+
{
3420+
"atOrAbove": "1.2.0-rc.3",
3421+
"below": "1.8.4"
3422+
}
3423+
],
3424+
"summary": "Angular's deprecated package has a Cross-Site Scripting issue",
3425+
"details": "A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session.\n\n\nSCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire URLs against regular expression matchers can result in partial matches for certain types of regular expressions, effectively bypassing the policies and allowing the use of unsafe values as resource URLs.\n\n\nThis issue affects AngularJS versions greater than or equal to 1.2.0-rc.3.\n\n\nNote:\nThe AngularJS project was already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see the  End-of-Life announcement https://docs.angularjs.org/misc/version-support-status .",
3426+
"identifiers": {
3427+
"githubID": "GHSA-7x27-g8rg-x87w",
3428+
"CVE": [
3429+
"CVE-2026-11998"
3430+
]
3431+
},
3432+
"severity": "high",
3433+
"cwe": [
3434+
"CWE-79",
3435+
"CWE-791"
3436+
],
3437+
"info": [
3438+
"https://access.redhat.com/security/cve/CVE-2026-11998",
3439+
"https://bugzilla.redhat.com/show_bug.cgi?id=2492579",
3440+
"https://codepen.io/herodevs/pen/JobQdmz/5b3896f56fab66f20cd25e698cf3faa8",
3441+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11998.json",
3442+
"https://www.herodevs.com/vulnerability-directory/cve-2026-11998",
3443+
"https://www.herodevs.com/vulnerability-directory/cve-2026-11998?nes-for-angularjs"
3444+
]
34163445
}
34173446
],
34183447
"extractors": {
@@ -11356,7 +11385,7 @@
1135611385
],
1135711386
"summary": "Embedded malware in ua-parser-js",
1135811387
"cwe": [
11359-
"CWE-829",
11388+
"CWE-506",
1136011389
"CWE-912"
1136111390
],
1136211391
"severity": "high",

‎repository/jsrepository-v2.json‎

Lines changed: 47 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1559,6 +1559,26 @@
15591559
"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
15601560
]
15611561
},
1562+
{
1563+
"atOrAbove": "0",
1564+
"below": "5.10.10",
1565+
"severity": "high",
1566+
"cwe": [
1567+
"CWE-79"
1568+
],
1569+
"identifiers": {
1570+
"summary": "TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",
1571+
"githubID": "GHSA-v98h-vmpc-fpqv",
1572+
"CVE": [
1573+
"CVE-2026-47762"
1574+
]
1575+
},
1576+
"info": [
1577+
"https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv",
1578+
"https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview",
1579+
"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
1580+
]
1581+
},
15621582
{
15631583
"atOrAbove": "0",
15641584
"below": "5.10.10",
@@ -1632,26 +1652,6 @@
16321652
"https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview"
16331653
]
16341654
},
1635-
{
1636-
"atOrAbove": "0",
1637-
"below": "5.11.1",
1638-
"severity": "high",
1639-
"cwe": [
1640-
"CWE-79"
1641-
],
1642-
"identifiers": {
1643-
"summary": "TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",
1644-
"githubID": "GHSA-v98h-vmpc-fpqv",
1645-
"CVE": [
1646-
"CVE-2026-47762"
1647-
]
1648-
},
1649-
"info": [
1650-
"https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv",
1651-
"https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview",
1652-
"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
1653-
]
1654-
},
16551655
{
16561656
"atOrAbove": "6.0.0",
16571657
"below": "6.3.1",
@@ -3456,6 +3456,30 @@
34563456
"https://www.herodevs.com/vulnerability-directory/cve-2024-8373"
34573457
]
34583458
},
3459+
{
3460+
"atOrAbove": "1.2.0-rc.3",
3461+
"below": "1.8.4",
3462+
"severity": "high",
3463+
"cwe": [
3464+
"CWE-79",
3465+
"CWE-791"
3466+
],
3467+
"identifiers": {
3468+
"summary": "Angular's deprecated package has a Cross-Site Scripting issue",
3469+
"githubID": "GHSA-7x27-g8rg-x87w",
3470+
"CVE": [
3471+
"CVE-2026-11998"
3472+
]
3473+
},
3474+
"info": [
3475+
"https://access.redhat.com/security/cve/CVE-2026-11998",
3476+
"https://bugzilla.redhat.com/show_bug.cgi?id=2492579",
3477+
"https://codepen.io/herodevs/pen/JobQdmz/5b3896f56fab66f20cd25e698cf3faa8",
3478+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11998.json",
3479+
"https://www.herodevs.com/vulnerability-directory/cve-2026-11998",
3480+
"https://www.herodevs.com/vulnerability-directory/cve-2026-11998?nes-for-angularjs"
3481+
]
3482+
},
34593483
{
34603484
"atOrAbove": "1.3.0",
34613485
"below": "1.8.4",
@@ -12882,7 +12906,7 @@
1288212906
"atOrAbove": "0.7.29",
1288312907
"below": "0.7.30",
1288412908
"cwe": [
12885-
"CWE-829",
12909+
"CWE-506",
1288612910
"CWE-912"
1288712911
],
1288812912
"severity": "high",
@@ -12929,7 +12953,7 @@
1292912953
"atOrAbove": "0.8.0",
1293012954
"below": "0.8.1",
1293112955
"cwe": [
12932-
"CWE-829",
12956+
"CWE-506",
1293312957
"CWE-912"
1293412958
],
1293512959
"severity": "high",
@@ -12952,7 +12976,7 @@
1295212976
"atOrAbove": "1.0.0",
1295312977
"below": "1.0.1",
1295412978
"cwe": [
12955-
"CWE-829",
12979+
"CWE-506",
1295612980
"CWE-912"
1295712981
],
1295812982
"severity": "high",

‎repository/jsrepository-v3.json‎

Lines changed: 47 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1615,6 +1615,26 @@
16151615
"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
16161616
]
16171617
},
1618+
{
1619+
"atOrAbove": "0",
1620+
"below": "5.10.10",
1621+
"severity": "high",
1622+
"cwe": [
1623+
"CWE-79"
1624+
],
1625+
"identifiers": {
1626+
"summary": "TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",
1627+
"githubID": "GHSA-v98h-vmpc-fpqv",
1628+
"CVE": [
1629+
"CVE-2026-47762"
1630+
]
1631+
},
1632+
"info": [
1633+
"https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv",
1634+
"https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview",
1635+
"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
1636+
]
1637+
},
16181638
{
16191639
"atOrAbove": "0",
16201640
"below": "5.10.10",
@@ -1688,26 +1708,6 @@
16881708
"https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview"
16891709
]
16901710
},
1691-
{
1692-
"atOrAbove": "0",
1693-
"below": "5.11.1",
1694-
"severity": "high",
1695-
"cwe": [
1696-
"CWE-79"
1697-
],
1698-
"identifiers": {
1699-
"summary": "TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",
1700-
"githubID": "GHSA-v98h-vmpc-fpqv",
1701-
"CVE": [
1702-
"CVE-2026-47762"
1703-
]
1704-
},
1705-
"info": [
1706-
"https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv",
1707-
"https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview",
1708-
"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
1709-
]
1710-
},
17111711
{
17121712
"atOrAbove": "6.0.0",
17131713
"below": "6.3.1",
@@ -3529,6 +3529,30 @@
35293529
"https://www.herodevs.com/vulnerability-directory/cve-2024-8373"
35303530
]
35313531
},
3532+
{
3533+
"atOrAbove": "1.2.0-rc.3",
3534+
"below": "1.8.4",
3535+
"severity": "high",
3536+
"cwe": [
3537+
"CWE-79",
3538+
"CWE-791"
3539+
],
3540+
"identifiers": {
3541+
"summary": "Angular's deprecated package has a Cross-Site Scripting issue",
3542+
"githubID": "GHSA-7x27-g8rg-x87w",
3543+
"CVE": [
3544+
"CVE-2026-11998"
3545+
]
3546+
},
3547+
"info": [
3548+
"https://access.redhat.com/security/cve/CVE-2026-11998",
3549+
"https://bugzilla.redhat.com/show_bug.cgi?id=2492579",
3550+
"https://codepen.io/herodevs/pen/JobQdmz/5b3896f56fab66f20cd25e698cf3faa8",
3551+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11998.json",
3552+
"https://www.herodevs.com/vulnerability-directory/cve-2026-11998",
3553+
"https://www.herodevs.com/vulnerability-directory/cve-2026-11998?nes-for-angularjs"
3554+
]
3555+
},
35323556
{
35333557
"atOrAbove": "1.3.0",
35343558
"below": "1.8.4",
@@ -13073,7 +13097,7 @@
1307313097
"atOrAbove": "0.7.29",
1307413098
"below": "0.7.30",
1307513099
"cwe": [
13076-
"CWE-829",
13100+
"CWE-506",
1307713101
"CWE-912"
1307813102
],
1307913103
"severity": "high",
@@ -13120,7 +13144,7 @@
1312013144
"atOrAbove": "0.8.0",
1312113145
"below": "0.8.1",
1312213146
"cwe": [
13123-
"CWE-829",
13147+
"CWE-506",
1312413148
"CWE-912"
1312513149
],
1312613150
"severity": "high",
@@ -13143,7 +13167,7 @@
1314313167
"atOrAbove": "1.0.0",
1314413168
"below": "1.0.1",
1314513169
"cwe": [
13146-
"CWE-829",
13170+
"CWE-506",
1314713171
"CWE-912"
1314813172
],
1314913173
"severity": "high",

‎repository/jsrepository-v4.json‎

Lines changed: 47 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1614,6 +1614,26 @@
16141614
"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
16151615
]
16161616
},
1617+
{
1618+
"atOrAbove": "0",
1619+
"below": "5.10.10",
1620+
"severity": "high",
1621+
"cwe": [
1622+
"CWE-79"
1623+
],
1624+
"identifiers": {
1625+
"summary": "TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",
1626+
"githubID": "GHSA-v98h-vmpc-fpqv",
1627+
"CVE": [
1628+
"CVE-2026-47762"
1629+
]
1630+
},
1631+
"info": [
1632+
"https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv",
1633+
"https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview",
1634+
"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
1635+
]
1636+
},
16171637
{
16181638
"atOrAbove": "0",
16191639
"below": "5.10.10",
@@ -1687,26 +1707,6 @@
16871707
"https://www.tiny.cloud/docs/tinymce/7/7.2-release-notes/#overview"
16881708
]
16891709
},
1690-
{
1691-
"atOrAbove": "0",
1692-
"below": "5.11.1",
1693-
"severity": "high",
1694-
"cwe": [
1695-
"CWE-79"
1696-
],
1697-
"identifiers": {
1698-
"summary": "TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",
1699-
"githubID": "GHSA-v98h-vmpc-fpqv",
1700-
"CVE": [
1701-
"CVE-2026-47762"
1702-
]
1703-
},
1704-
"info": [
1705-
"https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv",
1706-
"https://www.tiny.cloud/docs/tinymce/7/7.9.3-release-notes/#overview",
1707-
"https://www.tiny.cloud/docs/tinymce/8/8.5.1-release-notes/#overview"
1708-
]
1709-
},
17101710
{
17111711
"atOrAbove": "6.0.0",
17121712
"below": "6.3.1",
@@ -3528,6 +3528,30 @@
35283528
"https://www.herodevs.com/vulnerability-directory/cve-2024-8373"
35293529
]
35303530
},
3531+
{
3532+
"atOrAbove": "1.2.0-rc.3",
3533+
"below": "1.8.4",
3534+
"severity": "high",
3535+
"cwe": [
3536+
"CWE-79",
3537+
"CWE-791"
3538+
],
3539+
"identifiers": {
3540+
"summary": "Angular's deprecated package has a Cross-Site Scripting issue",
3541+
"githubID": "GHSA-7x27-g8rg-x87w",
3542+
"CVE": [
3543+
"CVE-2026-11998"
3544+
]
3545+
},
3546+
"info": [
3547+
"https://access.redhat.com/security/cve/CVE-2026-11998",
3548+
"https://bugzilla.redhat.com/show_bug.cgi?id=2492579",
3549+
"https://codepen.io/herodevs/pen/JobQdmz/5b3896f56fab66f20cd25e698cf3faa8",
3550+
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11998.json",
3551+
"https://www.herodevs.com/vulnerability-directory/cve-2026-11998",
3552+
"https://www.herodevs.com/vulnerability-directory/cve-2026-11998?nes-for-angularjs"
3553+
]
3554+
},
35313555
{
35323556
"atOrAbove": "1.3.0",
35333557
"below": "1.8.4",
@@ -13072,7 +13096,7 @@
1307213096
"atOrAbove": "0.7.29",
1307313097
"below": "0.7.30",
1307413098
"cwe": [
13075-
"CWE-829",
13099+
"CWE-506",
1307613100
"CWE-912"
1307713101
],
1307813102
"severity": "high",
@@ -13119,7 +13143,7 @@
1311913143
"atOrAbove": "0.8.0",
1312013144
"below": "0.8.1",
1312113145
"cwe": [
13122-
"CWE-829",
13146+
"CWE-506",
1312313147
"CWE-912"
1312413148
],
1312513149
"severity": "high",
@@ -13142,7 +13166,7 @@
1314213166
"atOrAbove": "1.0.0",
1314313167
"below": "1.0.1",
1314413168
"cwe": [
13145-
"CWE-829",
13169+
"CWE-506",
1314613170
"CWE-912"
1314713171
],
1314813172
"severity": "high",

0 commit comments

Comments
 (0)