[Git][security-tracker-team/security-tracker][master] Add new node-brace-expansion issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
1fca5c4f by Salvatore Bonaccorso at 2026-09-30T07:57:19+02:00
Add new node-brace-expansion issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1119,11 +1119,26 @@ CVE-2026-102279 (Laravel is a web application framework. Prior to 12.69.0 and 13
 	NOTE: https://github.com/laravel/framework/pull/61381
 	NOTE: Fixed by: https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12 (v12.69.0)
 CVE-2026-102278 (The brace-expansion library generates arbitrary strings containing a c ...)
-	TODO: check
+	- node-brace-expansion <unfixed>
+	NOTE: https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7
+	NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c (v5.0.11)
+	NOTE: Fxied by: https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db (v3.0.8)
+	NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/1ba3c71f89fb3448c8be6dcf2d17b543c2738f16 (v2.1.6)
+	NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b (v1.1.20)
 CVE-2026-102277 (The brace-expansion library generates arbitrary strings containing a c ...)
-	TODO: check
+	- node-brace-expansion <unfixed>
+	NOTE: https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr
+	NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96 (v5.0.12)
+	NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364 (v3.0.9)
+	NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22 (v2.1.7)
+	NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e (v1.1.21)
 CVE-2026-102276 (The brace-expansion library generates arbitrary strings containing a c ...)
-	TODO: check
+	- node-brace-expansion <unfixed>
+	NOTE: https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p
+	NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3 (v5.0.10)
+	NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c (v3.0.7)
+	NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc (v2.1.5)
+	NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc (v1.1.19)
 CVE-2026-102275 (PyJWT is a Python implementation of JSON Web Token standards. From 2.1 ...)
 	- pyjwt 2.15.0-1
 	NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1fca5c4fd1509f87fa9ac89fd2ce20821a105e62

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1fca5c4fd1509f87fa9ac89fd2ce20821a105e62
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/02e96b43/attachment.htm>