From 8ec3707e325cb2c58a95c869720b501bbaef4268 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 7 Mar 2026 06:50:14 +0000 Subject: [PATCH] fix: allowlist CVE-2026-2297 and GHSA-qffp-2rhf-9h96 in security scans - CVE-2026-2297: Python 3.13 SourcelessFileLoader audit hook bypass, no fix available in base image - GHSA-qffp-2rhf-9h96: tar hardlink path traversal, from nodejs_wheel bundled npm, not used in application runtime code Co-authored-by: Ishaan Jaff --- ci_cd/security_scans.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh index 0e50f15d043..62440d13ebb 100755 --- a/ci_cd/security_scans.sh +++ b/ci_cd/security_scans.sh @@ -161,6 +161,8 @@ run_grype_scans() { "GHSA-3ppc-4f35-3m26" # minimatch ReDoS via repeated wildcards - from nodejs_wheel bundled npm, not used in application runtime code "GHSA-83g3-92jg-28cx" # tar arbitrary file read/write via hardlink - from nodejs_wheel bundled npm, not used in application runtime code "CVE-2026-25639" # axios - full fix requires 1.x major version bump; pinned to >=0.30.2 to clear other axios CVEs, upgrade to 1.x in follow-up + "CVE-2026-2297" # Python 3.13 SourcelessFileLoader audit hook bypass - no fix available in base image + "GHSA-qffp-2rhf-9h96" # tar hardlink path traversal - from nodejs_wheel bundled npm, not used in application runtime code ) # Build JSON array of allowlisted CVE IDs for jq