[GHSA-w2cq-g8g3-gm83] content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE #6026
Conversation
|
Hi there @EvanHahn! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Pull Request Overview
This PR updates a GitHub Security Advisory (GHSA-w2cq-g8g3-gm83) for a prototype pollution vulnerability in the content-security-policy-parser package by adding additional metadata and references.
- Updates the modified timestamp to reflect the changes
- Adds an additional CWE identifier (CWE-1395) to complement the existing CWE-1321
- Includes a reference to another related advisory (GHSA-m4gq-x24j-jpmf) for prototype pollution context
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
github-actions
bot
changed the base branch from
main
to
byt3n33dl3/advisory-improvement-6026
| @@ -1,7 +1,7 @@ | |||
| { | |||
| "schema_version": "1.4.0", | |||
| "id": "GHSA-w2cq-g8g3-gm83", | |||
| "modified": "2025-08-12T19:19:42Z", | |||
| "modified": "2025-08-12T19:19:44Z", | |||
There was a problem hiding this comment.
Should this be changed to a more recent time?
| { | ||
| "type": "PACKAGE", | ||
| "url": "https://github.com/helmetjs/content-security-policy-parser" | ||
| } | ||
| ], | ||
| "database_specific": { | ||
| "cwe_ids": [ | ||
| "CWE-1321" | ||
| "CWE-1321", | ||
| "CWE-1395" |
There was a problem hiding this comment.
I don't think CWE-1395 applies here. I think that refers to vulnerable dependencies, which was unrelated to this issue.
| { | ||
| "type": "ADVISORY", | ||
| "url": "https://github.com/advisories/GHSA-m4gq-x24j-jpmf" | ||
| }, |
|
👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the |
Updates
Comments
Adding References based on my GHSA Mermaid's bundled version of DOMPurify for Prototype Pollution