From f9fbffa7cf87a5a07a7f089c5acb13b337d69145 Mon Sep 17 00:00:00 2001 From: shin-bot-litellm Date: Sat, 31 Jan 2026 21:27:58 +0000 Subject: [PATCH] ci(security): allowlist GHSA-34x7-hfp2-rc4v (node-tar hardlink) Not applicable - tar CLI not exposed in application code --- ci_cd/security_scans.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh index 6384720805f..3a212a56f64 100755 --- a/ci_cd/security_scans.sh +++ b/ci_cd/security_scans.sh @@ -137,6 +137,7 @@ run_grype_scans() { "CVE-2019-1010025" # glibc pthread heap address leak - awaiting patched Wolfi glibc build "CVE-2026-22184" # zlib untgz buffer overflow - untgz unused + no fixed Wolfi build yet "GHSA-58pv-8j8x-9vj2" # jaraco.context path traversal - setuptools vendored only (v5.3.0), not used in application code (using v6.1.0+) + "GHSA-34x7-hfp2-rc4v" # node-tar hardlink path traversal - not applicable, tar CLI not exposed in application code "GHSA-r6q2-hw4h-h46w" # node-tar not used by application runtime, Linux-only container, not affect by macOS APFS-specific exploit "GHSA-8rrh-rw8j-w5fx" # wheel is from chainguard and will be handled by then TODO: Remove this after Chainguard updates the wheel "CVE-2025-59465" # We do not use Node in application runtime, only used for building Admin UI