Summary
central/gen-advisory writes advisory/VEX output to a path built from the record's cveId, which is taken verbatim from record content (records are fetched from the remote MITRE API, cveawg.mitre.org) and never validated. This is an untrusted-input → arbitrary-file-write boundary.
Location
central/gen-advisory:912-915 (also 909-910, 258)
Confirmed
A record with cveId: "../ESCAPED" and --out-dir out/batch wrote out/ESCAPED.csaf.json / out/ESCAPED.cdx.json outside the intended directory.
Fix
In parse_record, reject any cve_id not matching ^CVE-[0-9]{4}-[0-9]{4,}$ before it is used to build a filename. Apply the same validation to --advisory-id.
Severity
High — arbitrary file write from remotely-sourced input.
Found in an internal review (2026-07-23). Tracked internally as SBOM-gpex.1.
Summary
central/gen-advisorywrites advisory/VEX output to a path built from the record'scveId, which is taken verbatim from record content (records are fetched from the remote MITRE API,cveawg.mitre.org) and never validated. This is an untrusted-input → arbitrary-file-write boundary.Location
central/gen-advisory:912-915(also909-910,258)Confirmed
A record with
cveId: "../ESCAPED"and--out-dir out/batchwroteout/ESCAPED.csaf.json/out/ESCAPED.cdx.jsonoutside the intended directory.Fix
In
parse_record, reject anycve_idnot matching^CVE-[0-9]{4}-[0-9]{4,}$before it is used to build a filename. Apply the same validation to--advisory-id.Severity
High — arbitrary file write from remotely-sourced input.
Found in an internal review (2026-07-23). Tracked internally as SBOM-gpex.1.