Merge pull request #7142 from github/Jenson3210-GHSA-qq5r-98hh-rxc9

advisory-database[bot] · web-flow · commit 1e49fada260c · 2026-03-10T18:44:41.000Z
diff --git a/advisories/github-reviewed/2026/02/GHSA-qq5r-98hh-rxc9/GHSA-qq5r-98hh-rxc9.json b/advisories/github-reviewed/2026/02/GHSA-qq5r-98hh-rxc9/GHSA-qq5r-98hh-rxc9.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qq5r-98hh-rxc9",
-  "modified": "2026-02-19T15:06:26Z",
+  "modified": "2026-02-19T15:06:29Z",
   "published": "2026-02-17T21:31:13Z",
   "aliases": [
     "CVE-2026-24733"
@@ -11,7 +11,7 @@
   "severity": [
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
@@ -28,7 +28,7 @@
               "introduced": "11.0.0-M1"
             },
             {
-              "fixed": "11.0.14"
+              "fixed": "11.0.15"
             }
           ]
         }
@@ -47,7 +47,7 @@
               "introduced": "10.1.0-M1"
             },
             {
-              "fixed": "10.1.49"
+              "fixed": "10.1.50"
             }
           ]
         }
@@ -66,7 +66,7 @@
               "introduced": "0"
             },
             {
-              "fixed": "9.0.112"
+              "fixed": "9.0.113"
             }
           ]
         }
@@ -85,7 +85,7 @@
               "introduced": "11.0.0-M1"
             },
             {
-              "fixed": "11.0.14"
+              "fixed": "11.0.15"
             }
           ]
         }
@@ -104,7 +104,7 @@
               "introduced": "10.1.0-M1"
             },
             {
-              "fixed": "10.1.49"
+              "fixed": "10.1.50"
             }
           ]
         }
@@ -123,7 +123,7 @@
               "introduced": "0"
             },
             {
-              "fixed": "9.0.112"
+              "fixed": "9.0.113"
             }
           ]
         }
@@ -142,7 +142,7 @@
               "introduced": "11.0.0-M1"
             },
             {
-              "fixed": "11.0.14"
+              "fixed": "11.0.15"
             }
           ]
         }
@@ -161,7 +161,7 @@
               "introduced": "10.1.0-M1"
             },
             {
-              "fixed": "10.1.49"
+              "fixed": "10.1.50"
             }
           ]
         }
@@ -180,7 +180,7 @@
               "introduced": "0"
             },
             {
-              "fixed": "9.0.112"
+              "fixed": "9.0.113"
             }
           ]
         }
@@ -229,7 +229,7 @@
     "cwe_ids": [
       "CWE-20"
     ],
-    "severity": "LOW",
+    "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-02-19T15:06:26Z",
     "nvd_published_at": "2026-02-17T19:21:56Z"

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"schema_version": "1.4.0",`
`3`	`3`	`"id": "GHSA-qq5r-98hh-rxc9",`
`4`		`- "modified": "2026-02-19T15:06:26Z",`
	`4`	`+ "modified": "2026-02-19T15:06:29Z",`
`5`	`5`	`"published": "2026-02-17T21:31:13Z",`
`6`	`6`	`"aliases": [`
`7`	`7`	`"CVE-2026-24733"`
`@@ -11,7 +11,7 @@`
`11`	`11`	`"severity": [`
`12`	`12`	`{`
`13`	`13`	`"type": "CVSS_V4",`
`14`		`- "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"`
	`14`	`+ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"`
`15`	`15`	`}`
`16`	`16`	`],`
`17`	`17`	`"affected": [`
`@@ -28,7 +28,7 @@`
`28`	`28`	`"introduced": "11.0.0-M1"`
`29`	`29`	`},`
`30`	`30`	`{`
`31`		`- "fixed": "11.0.14"`
	`31`	`+ "fixed": "11.0.15"`
`32`	`32`	`}`
`33`	`33`	`]`
`34`	`34`	`}`
`@@ -47,7 +47,7 @@`
`47`	`47`	`"introduced": "10.1.0-M1"`
`48`	`48`	`},`
`49`	`49`	`{`
`50`		`- "fixed": "10.1.49"`
	`50`	`+ "fixed": "10.1.50"`
`51`	`51`	`}`
`52`	`52`	`]`
`53`	`53`	`}`
`@@ -66,7 +66,7 @@`
`66`	`66`	`"introduced": "0"`
`67`	`67`	`},`
`68`	`68`	`{`
`69`		`- "fixed": "9.0.112"`
	`69`	`+ "fixed": "9.0.113"`
`70`	`70`	`}`
`71`	`71`	`]`
`72`	`72`	`}`
`@@ -85,7 +85,7 @@`
`85`	`85`	`"introduced": "11.0.0-M1"`
`86`	`86`	`},`
`87`	`87`	`{`
`88`		`- "fixed": "11.0.14"`
	`88`	`+ "fixed": "11.0.15"`
`89`	`89`	`}`
`90`	`90`	`]`
`91`	`91`	`}`
`@@ -104,7 +104,7 @@`
`104`	`104`	`"introduced": "10.1.0-M1"`
`105`	`105`	`},`
`106`	`106`	`{`
`107`		`- "fixed": "10.1.49"`
	`107`	`+ "fixed": "10.1.50"`
`108`	`108`	`}`
`109`	`109`	`]`
`110`	`110`	`}`
`@@ -123,7 +123,7 @@`
`123`	`123`	`"introduced": "0"`
`124`	`124`	`},`
`125`	`125`	`{`
`126`		`- "fixed": "9.0.112"`
	`126`	`+ "fixed": "9.0.113"`
`127`	`127`	`}`
`128`	`128`	`]`
`129`	`129`	`}`
`@@ -142,7 +142,7 @@`
`142`	`142`	`"introduced": "11.0.0-M1"`
`143`	`143`	`},`
`144`	`144`	`{`
`145`		`- "fixed": "11.0.14"`
	`145`	`+ "fixed": "11.0.15"`
`146`	`146`	`}`
`147`	`147`	`]`
`148`	`148`	`}`
`@@ -161,7 +161,7 @@`
`161`	`161`	`"introduced": "10.1.0-M1"`
`162`	`162`	`},`
`163`	`163`	`{`
`164`		`- "fixed": "10.1.49"`
	`164`	`+ "fixed": "10.1.50"`
`165`	`165`	`}`
`166`	`166`	`]`
`167`	`167`	`}`
`@@ -180,7 +180,7 @@`
`180`	`180`	`"introduced": "0"`
`181`	`181`	`},`
`182`	`182`	`{`
`183`		`- "fixed": "9.0.112"`
	`183`	`+ "fixed": "9.0.113"`
`184`	`184`	`}`
`185`	`185`	`]`
`186`	`186`	`}`
`@@ -229,7 +229,7 @@`
`229`	`229`	`"cwe_ids": [`
`230`	`230`	`"CWE-20"`
`231`	`231`	`],`
`232`		`- "severity": "LOW",`
	`232`	`+ "severity": "MODERATE",`
`233`	`233`	`"github_reviewed": true,`
`234`	`234`	`"github_reviewed_at": "2026-02-19T15:06:26Z",`
`235`	`235`	`"nvd_published_at": "2026-02-17T19:21:56Z"`