{"metadata": {"vulnerability": "CVE-2026-96889", "count": 50, "kinds": {"milestone": 12, "sighting": 9, "kev": 0, "other": 29}}, "data": [{"timestamp": "2026-09-23T09:29:12.429Z", "date_only": false, "value": "2026-09-23T09:29:12.429Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat", "record": "CVE-2026-96889", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-09-23T12:00:00Z", "date_only": false, "value": "2026-09-23T12:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-96889", "field": "containers.cna.datePublic"}, {"timestamp": "2026-09-23T12:00:00Z", "date_only": false, "value": "2026-09-23T12:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_rustsec \u00b7 RUSTSEC-2026-0305", "record": "RUSTSEC-2026-0305", "field": "published"}, {"timestamp": "2026-09-23T12:00:00Z", "date_only": false, "value": "2026-09-23T12:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat", "record": "CVE-2026-96889", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-09-23T18:52:33.922Z", "date_only": false, "value": "2026-09-23T18:52:33.922Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-96889", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-23T19:40:14.793Z", "date_only": false, "value": "2026-09-23T19:40:14.793Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-96889", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-23T19:40:14.793Z", "date_only": false, "value": "2026-09-23T19:40:14.793Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / redhat", "record": "CVE-2026-96889", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T20:17:00Z", "date_only": false, "value": "2026-09-23T20:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-96889", "record": "UBUNTU-CVE-2026-96889", "field": "published"}, {"timestamp": "2026-09-23T20:17:27.587Z", "date_only": false, "value": "2026-09-23T20:17:27.587", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96889", "record": "FKIE_CVE-2026-96889", "field": "published"}, {"timestamp": "2026-09-25T04:00:13Z", "date_only": false, "value": "2026-09-25T04:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103293", "record": "CVE-2026-96889", "field": "creation_timestamp", "uuid": "2a9b7641-7849-4492-91c6-cba4cb9a7275", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a VectorFreed\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rafabd1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 8  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 03:07:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThis repository documents the VectorFreed RCE chain and includes a PoC for CVE-2026-96889.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103293"}, {"timestamp": "2026-09-25T04:00:13Z", "date_only": false, "value": "2026-09-25T04:00:13.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103293", "record": "CVE-2026-96889", "field": "creation_timestamp", "uuid": "2b3aac87-9bc3-40e0-b34d-ccfea17c699f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a VectorFreed\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rafabd1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 8  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 03:07:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThis repository documents the VectorFreed RCE chain and includes a PoC for CVE-2026-96889.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103293"}, {"timestamp": "2026-09-25T17:53:42.623Z", "date_only": false, "value": "2026-09-25T17:53:42.623078Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96889", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-25T17:53:42.623Z", "date_only": false, "value": "2026-09-25T17:53:42.623078Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96889", "record": "FKIE_CVE-2026-96889", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-25T17:53:52.750Z", "date_only": false, "value": "2026-09-25T17:53:52.750Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-96889", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-25T17:53:52.750Z", "date_only": false, "value": "2026-09-25T17:53:52.750Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-96889", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-25T18:17:34.240Z", "date_only": false, "value": "2026-09-25T18:17:34.240", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96889", "record": "FKIE_CVE-2026-96889", "field": "lastModified"}, {"timestamp": "2026-09-27T23:30:17Z", "date_only": false, "value": "2026-09-27T23:30:17.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-96889", "record": "MSRC_CVE-2026-96889", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-27T23:30:17Z", "date_only": false, "value": "2026-09-27T23:30:17.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-96889", "record": "MSRC_CVE-2026-96889", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-09-27T23:30:17Z", "date_only": false, "value": "2026-09-27T23:30:17.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-96889", "record": "MSRC_CVE-2026-96889", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-28T14:50:13Z", "date_only": false, "value": "2026-09-28T14:50:13.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-96889", "record": "MSRC_CVE-2026-96889", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-01T19:14:05Z", "date_only": false, "value": "2026-10-01T19:14:05Z", "kind": "other", "label": "Updated", "source": "osv_rustsec \u00b7 RUSTSEC-2026-0305", "record": "RUSTSEC-2026-0305", "field": "modified"}, {"timestamp": "2026-10-05T14:57:11Z", "date_only": false, "value": "2026-10-05T14:57:11.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-96889", "record": "MSRC_CVE-2026-96889", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-06T15:30:31Z", "date_only": false, "value": "2026-10-06T15:30:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/d1f4346440fcedb1efb5807a4a7b9ac1", "record": "CVE-2026-96889", "field": "creation_timestamp", "uuid": "60dc8c2c-76c5-4ae8-b421-319e8c5d295a", "content": "# GHSA-WQ5F-XC86-PV6W: CVE-2026-96889: Remote Code Execution via Use-After-Free in librsvg (VectorFreed)\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/GHSA-WQ5F-XC86-PV6W\n\n## Summary\nVectorFreed identifies a critical Use-After-Free (UAF) memory corruption vulnerability in librsvg (CVE-2026-96889), which manifests when parsing structured SVG documents containing nested XML inclusions (XIncludes) and duplicate entity declarations. The flaw results from an entity ownership conflict where librsvg prematurely deallocates an xmlEntity structure still actively referenced by the underlying libxml2 parser context. When transitively compiled into downstream applications such as the high-performance sharp image processing library, this vulnerability facilitates denial of service and unauthenticated remote code execution on the host operating system.\n\n## TL;DR\nA Use-After-Free vulnerability in librsvg (CVE-2026-96889) allows remote code execution when processing crafted SVG files with nested XML Inclusions (XInclude) and duplicate entity declarations, transitively impacting sharp, Next.js, and Ghost.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-416\n- **Attack Vector**: Local / Network via Transitive Library Calls\n- **CVSS Base Score**: 7.8 (High)\n- **EPSS Score**: 0.00129 (Percentile: 2.15%)\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- librsvg\n- sharp (npm package)\n- Next.js (ImageResponse Node.js runtime path)\n- Ghost (Bookmark Cards processing)\n- Satori\n- **librsvg**: < 2.63.2 (Fixed in: `2.63.2`)\n- **sharp**: < 0.35.5 (Fixed in: `0.35.5`)\n- **Next.js**: >= 16.2.0, <= 16.3.5 (Fixed in: `16.3.6`)\n- **Ghost**: >= 6.56.0, < 6.67.0 (Fixed in: `6.67.0`)\n\n## Mitigation\n\n- Disable SVG loading operation inside sharp if vector graphics processing is not required.\n- Apply security updates to downstream web frameworks (Next.js, Ghost) that handle server-side image generation.\n- Deploy host-level binary protections including ASLR and PIE to hinder heap exploitation techniques.\n\n**Remediation Steps:**\n1. Identify all instances of the sharp library in package.json files.\n2. Run 'npm install sharp@0.35.5' or update the dependency range to ensure sharp-libvips version 1.3.4 is pulled.\n3. For system-wide installations of librsvg on Linux, update the system packages using 'apt-get install librsvg2-dev' or 'yum update librsvg2'.\n4. Verify the installed version of librsvg is 2.63.2 or one of the backported versions (2.62.4, 2.61.5, 2.60.3).\n\n## References\n\n- [GitHub Advisory: Use-After-Free in sharp bundled dependency](https://github.com/lovell/sharp/security/advisories/GHSA-wq5f-xc86-pv6w)\n- [RustSec Security Advisory: Memory corruption in librsvg](https://rustsec.org/advisories/RUSTSEC-2026-0305.html)\n- [CVE Record: CVE-2026-96889](https://www.cve.org/CVERecord?id=CVE-2026-96889)\n- [Vercel Next.js Downstream Security Advisory](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j)\n- [Ghost Downstream Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-788w-68h3-cvxp)\n- [Satori HTML/XML Escaping Bypass Advisory](https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-WQ5F-XC86-PV6W) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/d1f4346440fcedb1efb5807a4a7b9ac1"}, {"timestamp": "2026-10-06T21:04:59Z", "date_only": false, "value": "2026-10-06T21:04:59Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-96889", "record": "UBUNTU-CVE-2026-96889", "field": "modified"}, {"timestamp": "2026-10-07T02:00:08Z", "date_only": false, "value": "2026-10-07T02:00:08.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-96889", "record": "MSRC_CVE-2026-96889", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-10-07T02:00:08Z", "date_only": false, "value": "2026-10-07T02:00:08.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-96889", "record": "MSRC_CVE-2026-96889", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-07T07:01:57.926Z", "date_only": false, "value": "2026-10-07T07:01:57.926Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-96889", "record": "MSRC_CVE-2026-96889", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-08T06:13:45Z", "date_only": false, "value": "2026-10-08T06:13:45Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2026:24117-1", "record": "SUSE-SU-2026:24117-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-08T06:13:45Z", "date_only": false, "value": "2026-10-08T06:13:45Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2026:24117-1", "record": "SUSE-SU-2026:24117-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-10-08T06:13:45Z", "date_only": false, "value": "2026-10-08T06:13:45Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2026:24117-1", "record": "SUSE-SU-2026:24117-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-08T06:13:45Z", "date_only": false, "value": "2026-10-08T06:13:45Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2026:24117-1", "record": "SUSE-SU-2026:24117-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-13T09:46:19Z", "date_only": false, "value": "2026-10-13T09:46:19Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2026:24117-1", "record": "SUSE-SU-2026:24117-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-14T12:19:50Z", "date_only": false, "value": "2026-10-14T12:19:50Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-OL77428", "record": "CLEANSTART-2026-OL77428", "field": "modified"}, {"timestamp": "2026-10-14T21:09:33Z", "date_only": false, "value": "2026-10-14T21:09:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/citadelculture/f547237e942234ee96a65a3016b9418f", "record": "CVE-2026-96889", "field": "creation_timestamp", "uuid": "cc6f1f14-0db0-4ac7-af16-6ea046469ca5", "content": "{\n  \"candidate-npm-ci\": {\n    \"stdout\": \"\",\n    \"stderr\": \"npm error code ERESOLVE\\nnpm error ERESOLVE could not resolve\\nnpm error\\nnpm error While resolving: eslint-plugin-jsx-a11y@6.10.2\\nnpm error Found: eslint@10.11.0\\nnpm error node_modules/eslint\\nnpm error   dev eslint@\\\"^10.11.0\\\" from the root project\\nnpm error   peer eslint@\\\"^6.0.0 || ^7.0.0 || >=8.0.0\\\" from @eslint-community/eslint-utils@4.9.1\\nnpm error   node_modules/@eslint-community/eslint-utils\\nnpm error     @eslint-community/eslint-utils@\\\"^4.8.0\\\" from eslint@10.11.0\\nnpm error   2 more (@eslint/js, eslint-plugin-react-hooks)\\nnpm error\\nnpm error Could not resolve dependency:\\nnpm error peer eslint@\\\"^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9\\\" from eslint-plugin-jsx-a11y@6.10.2\\nnpm error node_modules/eslint-plugin-jsx-a11y\\nnpm error   dev eslint-plugin-jsx-a11y@\\\"^6.10.2\\\" from the root project\\nnpm error\\nnpm error Conflicting peer dependency: eslint@9.39.5\\nnpm error node_modules/eslint\\nnpm error   peer eslint@\\\"^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9\\\" from eslint-plugin-jsx-a11y@6.10.2\\nnpm error   node_modules/eslint-plugin-jsx-a11y\\nnpm error     dev eslint-plugin-jsx-a11y@\\\"^6.10.2\\\" from the root project\\nnpm error\\nnpm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.\\nnpm error\\nnpm error\\nnpm error For a full report see:\\nnpm error /private/tmp/tasknode-pr306-review-20261014/npm-cache/_logs/2026-10-14T20_58_48_032Z-eresolve-report.txt\\nnpm error A complete log of this run can be found in: /private/tmp/tasknode-pr306-review-20261014/npm-cache/_logs/2026-10-14T20_58_48_032Z-debug-0.log\\n\"\n  },\n  \"patched-npm-ci\": {\n    \"stdout\": \"\\nadded 385 packages in 4s\\n\",\n    \"stderr\": \"npm warn deprecated text-encoding@0.6.4: no longer maintained\\nnpm warn deprecated eslint@9.39.5: This version is no longer supported. Please see https://eslint.org/version-support for other options.\\n\"\n  },\n  \"patched-repository-check\": {\n    \"stdout\": \"\\n> tasknode@0.1.0 check\\n> npm run check:fast && npm run test:unit && npm run test:integration && npm run test:smoke && npm run build && npm run bundle-budget-check && npm run test:e2e\\n\\n\\n> tasknode@0.1.0 check:fast\\n> npm run file-size-check && npm run format-check && npm run lint && npm run api-reference-check && npm run security\\n\\n\\n> tasknode@0.1.0 file-size-check\\n> node scripts/check-file-size.mjs\\n\\nfile size check ok: 0 active exceptions, no file over its configured limit\\n\\n> tasknode@0.1.0 format-check\\n> node scripts/format-check.mjs\\n\\nformat check ok\\n\\n> tasknode@0.1.0 lint\\n> eslint src server scripts shared\\n\\n\\n> tasknode@0.1.0 api-reference-check\\n> node scripts/generate-api-reference.mjs\\n\\nAPI reference ok: 185 policies match the generated inventory\\n\\n> tasknode@0.1.0 security\\n> npm audit --audit-level=high && npm run public-help-check && npm run route-auth-policy-smoke && npm run trusted-proxy-rate-limit-smoke && npm run account-data-lifecycle-smoke && npm run data-retention-smoke && npm run data-recovery-safety-smoke && npm run asset-provenance-check && npm run dependency-license-check\\n\\n# npm audit report\\n\\nsharp  <0.35.5\\nSeverity: high\\nsharp : Vulnerability in librsvg dependency CVE-2026-96889 - https://github.com/advisories/GHSA-wq5f-xc86-pv6w\\nfix available via `npm audit fix`\\nnode_modules/sharp\\n\\n1 high severity vulnerability\\n\\nTo address all issues, run:\\n  npm audit fix\\n\",\n    \"stderr\": \"\"\n  },\n  \"patched-build\": {\n    \"stdout\": \"\\n> tasknode@0.1.0 build\\n> vite build\\n\\nvite v8.3.2 building client environment for production...\\ntransforming...\\n\\u2713 2124 modules transformed.\\nrendering chunks...\\ncomputing gzip size...\\ndist/index.html                                        1.14 kB \\u2502 gzip:   0.47 kB\\ndist/assets/ProfileView-BVxCwmxO.css                   2.18 kB \\u2502 gzip:   0.83 kB\\ndist/assets/directory-DMKWU4le.css                     8.11 kB \\u2502 gzip:   1.98 kB\\ndist/assets/HiveGroupChat-D8bdY2SF.css                 9.19 kB \\u2502 gzip:   2.43 kB\\ndist/assets/MemoryView-DVfFL2Q8.css                   10.90 kB \\u2502 gzip:   2.26 kB\\ndist/assets/MessagesView-Cl1Kf81C.css                 12.92 kB \\u2502 gzip:   2.82 kB\\ndist/assets/DocsView-C_l2ZHJj.css                     17.39 kB \\u2502 gzip:   3.20 kB\\ndist/assets/DocsLibraryView-CPoI_RhW.css              29.02 kB \\u2502 gzip:   5.64 kB\\ndist/assets/TeamView-DC6clVC-.css                     49.21 kB \\u2502 gzip:   8.88 kB\\ndist/assets/hive-SAa3Ep0G.css                         93.68 kB \\u2502 gzip:  13.90 kB\\ndist/assets/index-CZjstBCf.css                       215.68 kB \\u2502 gzip:  34.45 kB\\ndist/assets/rolldown-runtime-B0Z9INg1.js               0.90 kB \\u2502 gzip:   0.51 kB\\ndist/assets/collaboration-client-yfNBQRzB.js           1.00 kB \\u2502 gzip:   0.56 kB\\ndist/assets/defect-repair-rule-DSbTbELw.js             2.24 kB \\u2502 gzip:   1.12 kB\\ndist/assets/BlacklistView-DaNPtgbO.js                  2.63 kB \\u2502 gzip:   1.03 kB\\ndist/assets/search-DJtweN0N.js                         3.42 kB \\u2502 gzip:   1.54 kB\\ndist/assets/refine-context-pt5AH4qh.js                 3.46 kB \\u2502 gzip:   1.50 kB\\ndist/assets/agents-C0lR5fLZ.js                         3.78 kB \\u2502 gzip:   1.67 kB\\ndist/assets/directory-B-9h-Ot2.js                      4.39 kB \\u2502 gzip:   2.02 kB\\ndist/assets/messages-C-x6xXRl.js                       4.39 kB \\u2502 gzip:   2.00 kB\\ndist/assets/encryption-BOuf7_b3.js                     5.01 kB \\u2502 gzip:   2.02 kB\\ndist/assets/bootup-DKkpSK5t.js                         5.59 kB \\u2502 gzip:   2.63 kB\\ndist/assets/wiki-D4Pdf3Wg.js                           6.40 kB \\u2502 gzip:   2.88 kB\\ndist/assets/context-DLoGecnu.js                        6.42 kB \\u2502 gzip:   2.68 kB\\ndist/assets/ai-providers-B-9Xn9ld.js                   6.59 kB \\u2502 gzip:   3.01 kB\\ndist/assets/HiveBrainView-Dfngyx37.js                  6.83 kB \\u2502 gzip:   2.50 kB\\ndist/assets/DirectoryView-BP9QuLs5.js                  6.93 kB \\u2502 gzip:   2.44 kB\\ndist/assets/team-Cc-GV_iy.js                           7.21 kB \\u2502 gzip:   3.18 kB\\ndist/assets/style-guide-B4T05OD7.js                    7.22 kB \\u2502 gzip:   3.29 kB\\ndist/assets/docs-CJRXPP_A.js                          10.33 kB \\u2502 gzip:   4.33 kB\\ndist/assets/current-system-DAMcSM14.js                11.63 kB \\u2502 gzip:   4.88 kB\\ndist/assets/wallet-core-Bk5bBAat.js                   12.36 kB \\u2502 gzip:   4.20 kB\\ndist/assets/auth-wallet-boundary-CTRrpWFQ.js          13.09 kB \\u2502 gzip:   5.25 kB\\ndist/assets/wallet-BCXpCxx0.js                        13.75 kB \\u2502 gzip:   5.33 kB\\ndist/assets/memory-CyKOI16q.js                        14.02 kB \\u2502 gzip:   5.07 kB\\ndist/assets/MemoryView-D70_iDxm.js                    15.01 kB \\u2502 gzip:   4.58 kB\\ndist/assets/HiveGroupChat-DB20NlLZ.js                 15.65 kB \\u2502 gzip:   5.66 kB\\ndist/assets/context-rewrite-By6AzoMP.js               16.29 kB \\u2502 gzip:   6.22 kB\\ndist/assets/MessagesView-DoxHTaiA.js                  16.50 kB \\u2502 gzip:   5.28 kB\\ndist/assets/auth-and-connected-accounts-BWogPvpV.js   17.78 kB \\u2502 gzip:   6.58 kB\\ndist/assets/daily-airdrop-BjXARxXt.js                 19.18 kB \\u2502 gzip:   7.38 kB\\ndist/assets/TeamView-DFgN9msX.js                      21.41 kB \\u2502 gzip:   6.10 kB\\ndist/assets/ContextView-Pmz-PPFV.js                   24.91 kB \\u2502 gzip:   7.73 kB\\ndist/assets/icon-runtime-CtP0mBt_.js                  25.25 kB \\u2502 gzip:   8.60 kB\\ndist/assets/nostr-messages-Cl9vh3ag.js                30.91 kB \\u2502 gzip:   9.70 kB\\ndist/assets/DocsView-D_3GLklX.js                      38.38 kB \\u2502 gzip:  11.75 kB\\ndist/assets/user-guide-BFx3pKFX.js                    39.81 kB \\u2502 gzip:  13.50 kB\\ndist/assets/chat-B8rb9Ono.js                          40.77 kB \\u2502 gzip:  14.91 kB\\ndist/assets/WalletView-CtgqRG8I.js                    42.56 kB \\u2502 gzip:  11.50 kB\\ndist/assets/DocsLibraryView-83sDX6fd.js               46.41 kB \\u2502 gzip:  13.09 kB\\ndist/assets/profile-BC35JDW7.js                       52.28 kB \\u2502 gzip:  19.09 kB\\ndist/assets/hive-BKSWhKT1.js                          64.92 kB \\u2502 gzip:  22.50 kB\\ndist/assets/tasks-a7p0_TA1.js                         67.33 kB \\u2502 gzip:  22.82 kB\\ndist/assets/HiveView-DQJrrDF-.js                      70.25 kB \\u2502 gzip:  18.77 kB\\ndist/assets/key-cryptography-D-IO3ZXl.js              83.01 kB \\u2502 gzip:  33.43 kB\\ndist/assets/ProfileView-sRns-Nqj.js                   96.89 kB \\u2502 gzip:  26.26 kB\\ndist/assets/react-runtime-CBh5Aghr.js                189.59 kB \\u2502 gzip:  59.61 kB\\ndist/assets/index-9tyW7MZH.js                        331.83 kB \\u2502 gzip:  95.10 kB\\ndist/assets/libsodium-wrappers-C8DxAFyY.js           432.34 kB \\u2502 gzip: 152.73 kB\\ndist/assets/wallet-encoding-BdH8Cwk9.js              449.13 kB \\u2502 gzip: 129.40 kB\\n\\n\\u2713 built in 804ms\\n\",\n    \"stderr\": \"\"\n  },\n  \"patched-bundle-budget\": {\n    \"stdout\": \"\\n> tasknode@0.1.0 bundle-budget-check\\n> node scripts/bundle-budget-check.mjs\\n\\nbundle budget ok: 59 built assets checked\\n\",\n    \"stderr\": \"\"\n  },\n  \"patched-full-audit\": {\n    \"stdout\": \"{\\n  \\\"auditReportVersion\\\": 2,\\n  \\\"vulnerabilities\\\": {\\n    \\\"sharp\\\": {\\n      \\\"name\\\": \\\"sharp\\\",\\n      \\\"severity\\\": \\\"high\\\",\\n      \\\"isDirect\\\": true,\\n      \\\"via\\\": [\\n        {\\n          \\\"source\\\": 1241331,\\n          \\\"name\\\": \\\"sharp\\\",\\n          \\\"dependency\\\": \\\"sharp\\\",\\n          \\\"title\\\": \\\"sharp : Vulnerability in librsvg dependency CVE-2026-96889\\\",\\n          \\\"url\\\": \\\"https://github.com/advisories/GHSA-wq5f-xc86-pv6w\\\",\\n          \\\"severity\\\": \\\"high\\\",\\n          \\\"cwe\\\": [\\n            \\\"CWE-416\\\",\\n            \\\"CWE-1395\\\"\\n          ],\\n          \\\"cvss\\\": {\\n            \\\"score\\\": 0,\\n            \\\"vectorString\\\": null\\n          },\\n          \\\"range\\\": \\\"<0.35.5\\\"\\n        }\\n      ],\\n      \\\"effects\\\": [],\\n      \\\"range\\\": \\\"<0.35.5\\\",\\n      \\\"nodes\\\": [\\n        \\\"node_modules/sharp\\\"\\n      ],\\n      \\\"fixAvailable\\\": true\\n    },\\n    \\\"source-map-js\\\": {\\n      \\\"name\\\": \\\"source-map-js\\\",\\n      \\\"severity\\\": \\\"high\\\",\\n      \\\"isDirect\\\": false,\\n      \\\"via\\\": [\\n        {\\n          \\\"source\\\": 1241209,\\n          \\\"name\\\": \\\"source-map-js\\\",\\n          \\\"dependency\\\": \\\"source-map-js\\\",\\n          \\\"title\\\": \\\"source-map-js allows event-loop denial of service through indexed source-map section offsets\\\",\\n          \\\"url\\\": \\\"https://github.com/advisories/GHSA-68fv-2mgg-jv7q\\\",\\n          \\\"severity\\\": \\\"high\\\",\\n          \\\"cwe\\\": [\\n            \\\"CWE-1284\\\"\\n          ],\\n          \\\"cvss\\\": {\\n            \\\"score\\\": 7.5,\\n            \\\"vectorString\\\": \\\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\\\"\\n          },\\n          \\\"range\\\": \\\">=1.0.0 <1.2.2\\\"\\n        }\\n      ],\\n      \\\"effects\\\": [],\\n      \\\"range\\\": \\\"1.0.0 - 1.2.1\\\",\\n      \\\"nodes\\\": [\\n        \\\"node_modules/source-map-js\\\"\\n      ],\\n      \\\"fixAvailable\\\": true\\n    }\\n  },\\n  \\\"metadata\\\": {\\n    \\\"vulnerabilities\\\": {\\n      \\\"info\\\": 0,\\n      \\\"low\\\": 0,\\n      \\\"moderate\\\": 0,\\n      \\\"high\\\": 2,\\n      \\\"critical\\\": 0,\\n      \\\"total\\\": 2\\n    },\\n    \\\"dependencies\\\": {\\n      \\\"prod\\\": 115,\\n      \\\"dev\\\": 290,\\n      \\\"optional\\\": 79,\\n      \\\"peer\\\": 0,\\n      \\\"peerOptional\\\": 0,\\n      \\\"total\\\": 456\\n    }\\n  }\\n}\\n\",\n    \"stderr\": \"\"\n  },\n  \"patched-peer-tree\": {\n    \"stdout\": \"{\\n  \\\"version\\\": \\\"0.1.0\\\",\\n  \\\"name\\\": \\\"tasknode\\\",\\n  \\\"dependencies\\\": {\\n    \\\"@eslint/js\\\": {\\n      \\\"version\\\": \\\"9.39.5\\\",\\n      \\\"resolved\\\": \\\"https://registry.npmjs.org/@eslint/js/-/js-9.39.5.tgz\\\",\\n      \\\"overridden\\\": false\\n    },\\n    \\\"eslint-plugin-jsx-a11y\\\": {\\n      \\\"version\\\": \\\"6.10.2\\\",\\n      \\\"resolved\\\": \\\"https://registry.npmjs.org/eslint-plugin-jsx-a11y/-/eslint-plugin-jsx-a11y-6.10.2.tgz\\\",\\n      \\\"overridden\\\": false,\\n      \\\"dependencies\\\": {\\n        \\\"eslint\\\": {\\n          \\\"version\\\": \\\"9.39.5\\\"\\n        }\\n      }\\n    },\\n    \\\"eslint-plugin-react-hooks\\\": {\\n      \\\"version\\\": \\\"7.1.1\\\",\\n      \\\"resolved\\\": \\\"https://registry.npmjs.org/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-7.1.1.tgz\\\",\\n      \\\"overridden\\\": false,\\n      \\\"dependencies\\\": {\\n        \\\"eslint\\\": {\\n          \\\"version\\\": \\\"9.39.5\\\"\\n        }\\n      }\\n    },\\n    \\\"eslint-plugin-react\\\": {\\n      \\\"version\\\": \\\"7.37.5\\\",\\n      \\\"resolved\\\": \\\"https://registry.npmjs.org/eslint-plugin-react/-/eslint-plugin-react-7.37.5.tgz\\\",\\n      \\\"overridden\\\": false,\\n      \\\"dependencies\\\": {\\n        \\\"eslint\\\": {\\n          \\\"version\\\": \\\"9.39.5\\\"\\n        }\\n      }\\n    },\\n    \\\"eslint\\\": {\\n      \\\"version\\\": \\\"9.39.5\\\",\\n      \\\"resolved\\\": \\\"https://registry.npmjs.org/eslint/-/eslint-9.39.5.tgz\\\",\\n      \\\"overridden\\\": false,\\n      \\\"dependencies\\\": {\\n        \\\"@eslint-community/eslint-utils\\\": {\\n          \\\"version\\\": \\\"4.9.1\\\",\\n          \\\"resolved\\\": \\\"https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz\\\",\\n          \\\"overridden\\\": false,\\n          \\\"dependencies\\\": {\\n            \\\"eslint\\\": {\\n              \\\"version\\\": \\\"9.39.5\\\"\\n            }\\n          }\\n        },\\n        \\\"@eslint/eslintrc\\\": {\\n          \\\"version\\\": \\\"3.3.7\\\",\\n          \\\"resolved\\\": \\\"https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.7.tgz\\\",\\n          \\\"overridden\\\": false,\\n          \\\"dependencies\\\": {\\n            \\\"globals\\\": {\\n              \\\"version\\\": \\\"14.0.0\\\",\\n              \\\"resolved\\\": \\\"https://registry.npmjs.org/globals/-/globals-14.0.0.tgz\\\",\\n              \\\"overridden\\\": false\\n            }\\n          }\\n        },\\n        \\\"@eslint/js\\\": {\\n          \\\"version\\\": \\\"9.39.5\\\"\\n        }\\n      }\\n    },\\n    \\\"globals\\\": {\\n      \\\"version\\\": \\\"17.13.0\\\",\\n      \\\"resolved\\\": \\\"https://registry.npmjs.org/globals/-/globals-17.13.0.tgz\\\",\\n      \\\"overridden\\\": false\\n    },\\n    \\\"vite\\\": {\\n      \\\"version\\\": \\\"8.3.2\\\",\\n      \\\"resolved\\\": \\\"https://registry.npmjs.org/vite/-/vite-8.3.2.tgz\\\",\\n      \\\"overridden\\\": false\\n    }\\n  }\\n}\\n\",\n    \"stderr\": \"\"\n  }\n}\n", "url": "https://gist.github.com/citadelculture/f547237e942234ee96a65a3016b9418f"}, {"timestamp": "2026-10-14T23:51:15Z", "date_only": false, "value": "2026-10-14T23:51:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/citadelculture/ea2ae808678f11e4a694532f65d35721", "record": "CVE-2026-96889", "field": "creation_timestamp", "uuid": "1da277e3-c663-4ff7-a5c9-d9db83f5d4cd", "content": "# npm audit report\n\nsharp  <0.35.5\nSeverity: high\nsharp : Vulnerability in librsvg dependency CVE-2026-96889 - https://github.com/advisories/GHSA-wq5f-xc86-pv6w\nfix available via `npm audit fix`\nnode_modules/sharp\n\nsource-map-js  1.0.0 - 1.2.1\nSeverity: high\nsource-map-js allows event-loop denial of service through indexed source-map section offsets - https://github.com/advisories/GHSA-68fv-2mgg-jv7q\nfix available via `npm audit fix`\nnode_modules/source-map-js\n\n2 high severity vulnerabilities\n\nTo address all issues, run:\n  npm audit fix\n", "url": "https://gist.github.com/citadelculture/ea2ae808678f11e4a694532f65d35721"}, {"timestamp": "2026-10-15T00:40:56.641Z", "date_only": false, "value": "2026-10-15T00:40:56.641655Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-OL77428", "record": "CLEANSTART-2026-OL77428", "field": "published"}, {"timestamp": "2026-10-15T04:56:01.983Z", "date_only": false, "value": "2026-10-15T04:56:01.983426Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxvbinezfz2r", "record": "CVE-2026-96889", "field": "creation_timestamp", "uuid": "2abd9e51-dde8-47d2-986f-1b1e4bbbe2e8", "content": "The Next.js security update fixes two critical unauthenticated remote code execution flaws, including CVE-2026-96889. Upgrade to 16.4.1 or 15.5.28.\n\n#NextJS #Vercel #React #CVE202696889 #RemoteCodeExecution #WebSecurity #PatchNow #CyberSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxvbinezfz2r"}, {"timestamp": "2026-10-15T05:47:57Z", "date_only": false, "value": "2026-10-15T05:47:57.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/citadelculture/ff69bfc5b660b3e22da69e16fc7660df", "record": "CVE-2026-96889", "field": "creation_timestamp", "uuid": "081dc564-d6f0-4114-bc6d-45fee8878189", "content": "# Conditional root security adoption without the React minor upgrade\n\nCandidate `a9355fb565c97215c3bb0fca3021ebb4348354d7` on main `41bb94647cd2e6183d0cbe193b568d179c79a9b6` changes only root package.json/package-lock.json: Sharp0.35.4\u21920.35.5 and27 required Sharp/@img records. All unrelated records and the React/ReactDOM19.2.6/scheduler0.27.0 pair remain unchanged. The other four non-React PR306 upgrades were not required by the observed advisory gate and are excluded for minimum scope. No app, wallet/vault, API, runtime manifest or load-policy change is included.\n\nThe [Sharp advisory](https://github.com/advisories/GHSA-wq5f-xc86-pv6w) names versions below0.35.5; the observed baseline audit has this production finding and a separate dev source-map-js finding. The candidate's actual production audit exits0 with no findings; full audit changes2 high\u21921 high, retaining only source-map-js. This is not a zero-finding full security claim.\n\nCurrent [RSC RCE](https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3), [October RSC DoS](https://github.com/react/react/security/advisories/GHSA-h3gv-c5rc-p453) and [July RSC DoS](https://github.com/react/react/security/advisories/GHSA-wx67-qw84-cm4g) advisories concern react-server-dom packages absent from the selected root/runtime manifests/locks and app/server source scan. Bare React/ReactDOM are not reported by the fresh exact-lock audit. This supports the scoped separation; it does not say19.2.6 is latest or promise general security equivalence. React19.3.0 is not being silently rolled back from production: current main already resolves19.2.6.\n\nActual Node24.21.0/npm11.19.0 strict installation, existing repository image-proxy smoke and six actual repository thumbnail-function controls pass. Tests use generated benign image bytes and malformed/empty-input controls, with no DB/provider/account/mint/signing use. Native Sharp reports0.35.5, libvips8.18.7 and rsvg2.63.2 on macOS; Linux/glibc exploit or container behavior was not tested.\n\nThe real production build and unchanged bundle checker both pass across59 assets. React is **189590 raw/58818 gzip9 bytes**, below unchanged **195000/61000** limits. No threshold raise, chunk shuffle or client source edit occurs. The real required npm run check passes file-size, format, lint and API inventory, then stops at the independent source-map-js audit; its later security/unit/integration/smoke/build/budget/e2e stages are skipped. Build/budget and the two image checks were run separately, with their actual outputs retained.\n\nRecommend CODEOWNER review of this minimal root patch as the supported security-only alternative to PR306's coupled React minor change. Keep PR315's dev source-map fix and PR316/317's separate web/worker locks as explicit release dependencies; their implementation and prior evidence are not claimed again. Full candidate CI, platform/container coverage and CODEOWNER approval remain external. Hold production/full-security clearance until these conditions are satisfied. No own approval, main merge, deployment or financial action occurred.\n\nAn initial added-control harness used an obsolete private Sharp file path and failed before any assertion. Its original failure is retained; package-export resolution was corrected without changing six inputs/expectations. Successful install and repository smoke were not repeated. All public transcripts disclose that input repair. This contribution claims the new root implementation and budget/security separation only, excluding prior PR306 analysis and existing315/316/317 fixes.\n\n\n{\n  \"observedAt\": \"2026-10-15T05:32:45.138823+00:00\",\n  \"source\": \"41bb94647cd2e6183d0cbe193b568d179c79a9b6\",\n  \"exit\": 1,\n  \"versions\": {\n    \"node\": \"v24.21.0\",\n    \"npm\": \"11.19.0\"\n  },\n  \"vulnerabilities\": {\n    \"sharp\": {\n      \"name\": \"sharp\",\n      \"severity\": \"high\",\n      \"isDirect\": true,\n      \"via\": [\n        {\n          \"source\": 1241331,\n          \"name\": \"sharp\",\n          \"dependency\": \"sharp\",\n          \"title\": \"sharp : Vulnerability in librsvg dependency CVE-2026-96889\",\n          \"url\": \"https://github.com/advisories/GHSA-wq5f-xc86-pv6w\",\n          \"severity\": \"high\",\n          \"cwe\": [\n            \"CWE-416\",\n            \"CWE-1395\"\n          ],\n          \"cvss\": {\n            \"score\": 0,\n            \"vectorString\": null\n          },\n          \"range\": \"<0.35.5\"\n        }\n      ],\n      \"effects\": [],\n      \"range\": \"<0.35.5\",\n      \"nodes\": [\n        \"node_modules/sharp\"\n      ],\n      \"fixAvailable\": true\n    },\n    \"source-map-js\": {\n      \"name\": \"source-map-js\",\n      \"severity\": \"high\",\n      \"isDirect\": false,\n      \"via\": [\n        {\n          \"source\": 1241209,\n          \"name\": \"source-map-js\",\n          \"dependency\": \"source-map-js\",\n          \"title\": \"source-map-js allows event-loop denial of service through indexed source-map section offsets\",\n          \"url\": \"https://github.com/advisories/GHSA-68fv-2mgg-jv7q\",\n          \"severity\": \"high\",\n          \"cwe\": [\n            \"CWE-1284\"\n          ],\n          \"cvss\": {\n            \"score\": 7.5,\n            \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"\n          },\n          \"range\": \">=1.0.0 <1.2.2\"\n        }\n      ],\n      \"effects\": [],\n      \"range\": \"1.0.0 - 1.2.1\",\n      \"nodes\": [\n        \"node_modules/source-map-js\"\n      ],\n      \"fixAvailable\": true\n    }\n  },\n  \"metadata\": {\n    \"vulnerabilities\": {\n      \"info\": 0,\n      \"low\": 0,\n      \"moderate\": 0,\n      \"high\": 2,\n      \"critical\": 0,\n      \"total\": 2\n    },\n    \"dependencies\": {\n      \"prod\": 115,\n      \"dev\": 290,\n      \"optional\": 79,\n      \"peer\": 0,\n      \"peerOptional\": 0,\n      \"total\": 456\n    }\n  }\n}\n\n\n{\n  \"exit\": 1,\n  \"vulnerabilities\": {\n    \"source-map-js\": {\n      \"name\": \"source-map-js\",\n      \"severity\": \"high\",\n      \"isDirect\": false,\n      \"via\": [\n        {\n          \"source\": 1241209,\n          \"name\": \"source-map-js\",\n          \"dependency\": \"source-map-js\",\n          \"title\": \"source-map-js allows event-loop denial of service through indexed source-map section offsets\",\n          \"url\": \"https://github.com/advisories/GHSA-68fv-2mgg-jv7q\",\n          \"severity\": \"high\",\n          \"cwe\": [\n            \"CWE-1284\"\n          ],\n          \"cvss\": {\n            \"score\": 7.5,\n            \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"\n          },\n          \"range\": \">=1.0.0 <1.2.2\"\n        }\n      ],\n      \"effects\": [],\n      \"range\": \"1.0.0 - 1.2.1\",\n      \"nodes\": [\n        \"node_modules/source-map-js\"\n      ],\n      \"fixAvailable\": true\n    }\n  },\n  \"metadata\": {\n    \"vulnerabilities\": {\n      \"info\": 0,\n      \"low\": 0,\n      \"moderate\": 0,\n      \"high\": 1,\n      \"critical\": 0,\n      \"total\": 1\n    },\n    \"dependencies\": {\n      \"prod\": 115,\n      \"dev\": 290,\n      \"optional\": 79,\n      \"peer\": 0,\n      \"peerOptional\": 0,\n      \"total\": 456\n    }\n  }\n}\n\n\n{\n  \"steps\": [\n    {\n      \"phase\": \"strict-install\",\n      \"args\": [\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/bin/node\",\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/lib/node_modules/npm/bin/npm-cli.js\",\n        \"ci\",\n        \"--strict-peer-deps\",\n        \"--engine-strict\",\n        \"--no-audit\",\n        \"--no-fund\"\n      ],\n      \"exit\": 0,\n      \"startedAt\": \"2026-10-15T05:37:45.156191+00:00\",\n      \"finishedAt\": \"2026-10-15T05:39:08.039470+00:00\",\n      \"stdout\": \"\\nadded 385 packages in 1m\\n\",\n      \"stderr\": \"npm warn deprecated text-encoding@0.6.4: no longer maintained\\n\"\n    },\n    {\n      \"phase\": \"image-proxy-smoke\",\n      \"args\": [\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/bin/node\",\n        \"scripts/profile-nft-image-proxy-smoke.mjs\"\n      ],\n      \"exit\": 0,\n      \"startedAt\": \"2026-10-15T05:39:08.039912+00:00\",\n      \"finishedAt\": \"2026-10-15T05:39:09.511690+00:00\",\n      \"stdout\": \"profile-nft-image-proxy-smoke ok\\n\",\n      \"stderr\": \"\"\n    },\n    {\n      \"phase\": \"thumbnail-controls\",\n      \"args\": [\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/bin/node\",\n        \"/work/tasknode-runs/oct15-next-tasknode-budget-security-unblock/thumbnail-controls.mjs\",\n        \"\"\n      ],\n      \"exit\": 1,\n      \"startedAt\": \"2026-10-15T05:39:09.512231+00:00\",\n      \"finishedAt\": \"2026-10-15T05:39:09.596974+00:00\",\n      \"stdout\": \"\",\n      \"stderr\": \"node:internal/modules/esm/resolve:272\\n    throw new ERR_MODULE_NOT_FOUND(\\n          ^\\n\\nError [ERR_MODULE_NOT_FOUND]: Cannot find module ' imported from /work/tasknode-runs/oct15-next-tasknode-budget-security-unblock/thumbnail-controls.mjs\\n    at finalizeResolution (node:internal/modules/esm/resolve:272:11)\\n    at moduleResolve (node:internal/modules/esm/resolve:879:10)\\n    at defaultResolve (node:internal/modules/esm/resolve:1006:11)\\n    at #cachedDefaultResolve (node:internal/modules/esm/loader:705:20)\\n    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:725:38)\\n    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:763:56)\\n    at #resolve (node:internal/modules/esm/loader:687:17)\\n    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:607:35)\\n    at node:internal/modules/esm/loader:636:32\\n    at TracingChannel.tracePromise (node:diagnostics_channel:362:14) {\\n  code: 'ERR_MODULE_NOT_FOUND',\\n  url: 'file://\\n}\\n\\nNode.js v24.21.0\\n\"\n    },\n    {\n      \"phase\": \"thumbnail-controls-corrected\",\n      \"args\": [\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/bin/node\",\n        \"/work/tasknode-runs/oct15-next-tasknode-budget-security-unblock/thumbnail-controls.mjs\",\n        \"\"\n      ],\n      \"exit\": 0,\n      \"startedAt\": \"2026-10-15T05:40:29.659495+00:00\",\n      \"finishedAt\": \"2026-10-15T05:40:29.859495+00:00\",\n      \"stdout\": \"{\\\"ok\\\":true,\\\"checks\\\":[\\\"landscape-rgb\\\",\\\"portrait-rgba\\\",\\\"tiny-rgb\\\",\\\"benign-svg\\\",\\\"empty-input-rejected\\\",\\\"malformed-input-rejected\\\"],\\\"sharp\\\":\\\"0.35.5\\\",\\\"libvips\\\":\\\"8.18.7\\\",\\\"rsvg\\\":\\\"2.63.2\\\",\\\"scope\\\":\\\"Actual repository thumbnail function; benign generated bytes only, no DB/provider/account/mint/signing use.\\\"}\\n\",\n      \"stderr\": \"\"\n    },\n    {\n      \"phase\": \"production-build\",\n      \"args\": [\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/bin/node\",\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/lib/node_modules/npm/bin/npm-cli.js\",\n        \"run\",\n        \"build\"\n      ],\n      \"exit\": 0,\n      \"startedAt\": \"2026-10-15T05:40:29.860027+00:00\",\n      \"finishedAt\": \"2026-10-15T05:40:32.707604+00:00\",\n      \"stdout\": \"\\n> tasknode@0.1.0 build\\n> vite build\\n\\nvite v8.3.0 building client environment for production...\\ntransforming...\\n\\u2713 2124 modules transformed.\\nrendering chunks...\\ncomputing gzip size...\\ndist/index.html                                        1.14 kB \\u2502 gzip:   0.47 kB\\ndist/assets/ProfileView-BVxCwmxO.css                   2.18 kB \\u2502 gzip:   0.83 kB\\ndist/assets/directory-DMKWU4le.css                     8.11 kB \\u2502 gzip:   1.98 kB\\ndist/assets/HiveGroupChat-D8bdY2SF.css                 9.19 kB \\u2502 gzip:   2.43 kB\\ndist/assets/MemoryView-DVfFL2Q8.css                   10.90 kB \\u2502 gzip:   2.26 kB\\ndist/assets/MessagesView-Cl1Kf81C.css                 12.92 kB \\u2502 gzip:   2.82 kB\\ndist/assets/DocsView-C_l2ZHJj.css                     17.39 kB \\u2502 gzip:   3.20 kB\\ndist/assets/DocsLibraryView-CPoI_RhW.css              29.02 kB \\u2502 gzip:   5.64 kB\\ndist/assets/TeamView-DC6clVC-.css                     49.21 kB \\u2502 gzip:   8.88 kB\\ndist/assets/hive-SAa3Ep0G.css                         93.68 kB \\u2502 gzip:  13.90 kB\\ndist/assets/index-CZjstBCf.css                       215.68 kB \\u2502 gzip:  34.45 kB\\ndist/assets/rolldown-runtime-B0Z9INg1.js               0.90 kB \\u2502 gzip:   0.51 kB\\ndist/assets/collaboration-client-CNszoOLq.js           1.00 kB \\u2502 gzip:   0.56 kB\\ndist/assets/defect-repair-rule-DSbTbELw.js             2.24 kB \\u2502 gzip:   1.12 kB\\ndist/assets/BlacklistView-R5_fbfSa.js                  2.63 kB \\u2502 gzip:   1.03 kB\\ndist/assets/search-DJtweN0N.js                         3.42 kB \\u2502 gzip:   1.54 kB\\ndist/assets/refine-context-pt5AH4qh.js                 3.46 kB \\u2502 gzip:   1.50 kB\\ndist/assets/agents-C0lR5fLZ.js                         3.78 kB \\u2502 gzip:   1.67 kB\\ndist/assets/directory-B-9h-Ot2.js                      4.39 kB \\u2502 gzip:   2.02 kB\\ndist/assets/messages-C-x6xXRl.js                       4.39 kB \\u2502 gzip:   2.00 kB\\ndist/assets/encryption-BOuf7_b3.js                     5.01 kB \\u2502 gzip:   2.02 kB\\ndist/assets/bootup-DKkpSK5t.js                         5.59 kB \\u2502 gzip:   2.63 kB\\ndist/assets/wiki-D4Pdf3Wg.js                           6.40 kB \\u2502 gzip:   2.88 kB\\ndist/assets/context-DLoGecnu.js                        6.42 kB \\u2502 gzip:   2.68 kB\\ndist/assets/ai-providers-B-9Xn9ld.js                   6.59 kB \\u2502 gzip:   3.01 kB\\ndist/assets/HiveBrainView-BvAnBMxe.js                  6.83 kB \\u2502 gzip:   2.50 kB\\ndist/assets/DirectoryView-H-sI3u78.js                  6.93 kB \\u2502 gzip:   2.44 kB\\ndist/assets/team-Cc-GV_iy.js                           7.21 kB \\u2502 gzip:   3.18 kB\\ndist/assets/style-guide-B4T05OD7.js                    7.22 kB \\u2502 gzip:   3.29 kB\\ndist/assets/docs-CJRXPP_A.js                          10.33 kB \\u2502 gzip:   4.33 kB\\ndist/assets/current-system-DAMcSM14.js                11.63 kB \\u2502 gzip:   4.88 kB\\ndist/assets/wallet-core-v3rtgT0B.js                   12.36 kB \\u2502 gzip:   4.20 kB\\ndist/assets/auth-wallet-boundary-CTRrpWFQ.js          13.09 kB \\u2502 gzip:   5.25 kB\\ndist/assets/wallet-BCXpCxx0.js                        13.75 kB \\u2502 gzip:   5.33 kB\\ndist/assets/memory-CyKOI16q.js                        14.02 kB \\u2502 gzip:   5.07 kB\\ndist/assets/MemoryView-DF8H0xav.js                    15.01 kB \\u2502 gzip:   4.58 kB\\ndist/assets/HiveGroupChat-BjK9op12.js                 15.65 kB \\u2502 gzip:   5.66 kB\\ndist/assets/context-rewrite-By6AzoMP.js               16.29 kB \\u2502 gzip:   6.22 kB\\ndist/assets/MessagesView-s3PvumNd.js                  16.50 kB \\u2502 gzip:   5.28 kB\\ndist/assets/auth-and-connected-accounts-BWogPvpV.js   17.78 kB \\u2502 gzip:   6.58 kB\\ndist/assets/daily-airdrop-BjXARxXt.js                 19.18 kB \\u2502 gzip:   7.38 kB\\ndist/assets/TeamView-BvbRSys6.js                      21.41 kB \\u2502 gzip:   6.10 kB\\ndist/assets/ContextView-DgqUBwaJ.js                   24.91 kB \\u2502 gzip:   7.73 kB\\ndist/assets/icon-runtime-CtP0mBt_.js                  25.25 kB \\u2502 gzip:   8.60 kB\\ndist/assets/nostr-messages-BKvCxZif.js                30.91 kB \\u2502 gzip:   9.70 kB\\ndist/assets/DocsView-C32u8myg.js                      38.38 kB \\u2502 gzip:  11.76 kB\\ndist/assets/user-guide-BFx3pKFX.js                    39.81 kB \\u2502 gzip:  13.50 kB\\ndist/assets/chat-B8rb9Ono.js                          40.77 kB \\u2502 gzip:  14.91 kB\\ndist/assets/WalletView-CA77i7Cg.js                    42.56 kB \\u2502 gzip:  11.50 kB\\ndist/assets/DocsLibraryView-CRrmOu9Q.js               46.41 kB \\u2502 gzip:  13.09 kB\\ndist/assets/profile-BC35JDW7.js                       52.28 kB \\u2502 gzip:  19.09 kB\\ndist/assets/hive-BKSWhKT1.js                          64.92 kB \\u2502 gzip:  22.50 kB\\ndist/assets/tasks-a7p0_TA1.js                         67.33 kB \\u2502 gzip:  22.82 kB\\ndist/assets/HiveView-Cn5C9vFV.js                      70.25 kB \\u2502 gzip:  18.78 kB\\ndist/assets/key-cryptography-D-IO3ZXl.js              83.01 kB \\u2502 gzip:  33.43 kB\\ndist/assets/ProfileView-BKtzOqVH.js                   96.89 kB \\u2502 gzip:  26.26 kB\\ndist/assets/react-runtime-CBh5Aghr.js                189.59 kB \\u2502 gzip:  59.61 kB\\ndist/assets/index-75hF9N7Q.js                        331.66 kB \\u2502 gzip:  95.07 kB\\ndist/assets/libsodium-wrappers-C8DxAFyY.js           432.34 kB \\u2502 gzip: 152.73 kB\\ndist/assets/wallet-encoding-BdH8Cwk9.js              449.13 kB \\u2502 gzip: 129.40 kB\\n\\n\\u2713 built in 801ms\\n\",\n      \"stderr\": \"\"\n    },\n    {\n      \"phase\": \"bundle-budget\",\n      \"args\": [\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/bin/node\",\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/lib/node_modules/npm/bin/npm-cli.js\",\n        \"run\",\n        \"bundle-budget-check\"\n      ],\n      \"exit\": 0,\n      \"startedAt\": \"2026-10-15T05:40:32.708193+00:00\",\n      \"finishedAt\": \"2026-10-15T05:40:32.979727+00:00\",\n      \"stdout\": \"\\n> tasknode@0.1.0 bundle-budget-check\\n> node scripts/bundle-budget-check.mjs\\n\\nbundle budget ok: 59 built assets checked\\n\",\n      \"stderr\": \"\"\n    },\n    {\n      \"phase\": \"production-audit\",\n      \"args\": [\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/bin/node\",\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/lib/node_modules/npm/bin/npm-cli.js\",\n        \"audit\",\n        \"--json\",\n        \"--ignore-scripts\",\n        \"--omit=dev\"\n      ],\n      \"exit\": 0,\n      \"startedAt\": \"2026-10-15T05:40:32.980185+00:00\",\n      \"finishedAt\": \"2026-10-15T05:40:34.185175+00:00\",\n      \"stdout\": \"{\\n  \\\"auditReportVersion\\\": 2,\\n  \\\"vulnerabilities\\\": {},\\n  \\\"metadata\\\": {\\n    \\\"vulnerabilities\\\": {\\n      \\\"info\\\": 0,\\n      \\\"low\\\": 0,\\n      \\\"moderate\\\": 0,\\n      \\\"high\\\": 0,\\n      \\\"critical\\\": 0,\\n      \\\"total\\\": 0\\n    },\\n    \\\"dependencies\\\": {\\n      \\\"prod\\\": 115,\\n      \\\"dev\\\": 290,\\n      \\\"optional\\\": 79,\\n      \\\"peer\\\": 0,\\n      \\\"peerOptional\\\": 0,\\n      \\\"total\\\": 456\\n    }\\n  }\\n}\\n\",\n      \"stderr\": \"\"\n    },\n    {\n      \"phase\": \"full-audit\",\n      \"args\": [\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/bin/node\",\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/lib/node_modules/npm/bin/npm-cli.js\",\n        \"audit\",\n        \"--json\",\n        \"--ignore-scripts\"\n      ],\n      \"exit\": 1,\n      \"startedAt\": \"2026-10-15T05:40:34.186073+00:00\",\n      \"finishedAt\": \"2026-10-15T05:40:35.199411+00:00\",\n      \"stdout\": \"{\\n  \\\"auditReportVersion\\\": 2,\\n  \\\"vulnerabilities\\\": {\\n    \\\"source-map-js\\\": {\\n      \\\"name\\\": \\\"source-map-js\\\",\\n      \\\"severity\\\": \\\"high\\\",\\n      \\\"isDirect\\\": false,\\n      \\\"via\\\": [\\n        {\\n          \\\"source\\\": 1241209,\\n          \\\"name\\\": \\\"source-map-js\\\",\\n          \\\"dependency\\\": \\\"source-map-js\\\",\\n          \\\"title\\\": \\\"source-map-js allows event-loop denial of service through indexed source-map section offsets\\\",\\n          \\\"url\\\": \\\"https://github.com/advisories/GHSA-68fv-2mgg-jv7q\\\",\\n          \\\"severity\\\": \\\"high\\\",\\n          \\\"cwe\\\": [\\n            \\\"CWE-1284\\\"\\n          ],\\n          \\\"cvss\\\": {\\n            \\\"score\\\": 7.5,\\n            \\\"vectorString\\\": \\\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\\\"\\n          },\\n          \\\"range\\\": \\\">=1.0.0 <1.2.2\\\"\\n        }\\n      ],\\n      \\\"effects\\\": [],\\n      \\\"range\\\": \\\"1.0.0 - 1.2.1\\\",\\n      \\\"nodes\\\": [\\n        \\\"node_modules/source-map-js\\\"\\n      ],\\n      \\\"fixAvailable\\\": true\\n    }\\n  },\\n  \\\"metadata\\\": {\\n    \\\"vulnerabilities\\\": {\\n      \\\"info\\\": 0,\\n      \\\"low\\\": 0,\\n      \\\"moderate\\\": 0,\\n      \\\"high\\\": 1,\\n      \\\"critical\\\": 0,\\n      \\\"total\\\": 1\\n    },\\n    \\\"dependencies\\\": {\\n      \\\"prod\\\": 115,\\n      \\\"dev\\\": 290,\\n      \\\"optional\\\": 79,\\n      \\\"peer\\\": 0,\\n      \\\"peerOptional\\\": 0,\\n      \\\"total\\\": 456\\n    }\\n  }\\n}\\n\",\n      \"stderr\": \"\"\n    },\n    {\n      \"phase\": \"repository-check\",\n      \"args\": [\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/bin/node\",\n        \"/work/tools/node-24.21.0/node-v24.21.0-darwin-arm64/lib/node_modules/npm/bin/npm-cli.js\",\n        \"run\",\n        \"check\"\n      ],\n      \"exit\": 1,\n      \"startedAt\": \"2026-10-15T05:40:35.200274+00:00\",\n      \"finishedAt\": \"2026-10-15T05:40:42.676111+00:00\",\n      \"stdout\": \"\\n> tasknode@0.1.0 check\\n> npm run check:fast && npm run test:unit && npm run test:integration && npm run test:smoke && npm run build && npm run bundle-budget-check && npm run test:e2e\\n\\n\\n> tasknode@0.1.0 check:fast\\n> npm run file-size-check && npm run format-check && npm run lint && npm run api-reference-check && npm run security\\n\\n\\n> tasknode@0.1.0 file-size-check\\n> node scripts/check-file-size.mjs\\n\\nfile size check ok: 0 active exceptions, no file over its configured limit\\n\\n> tasknode@0.1.0 format-check\\n> node scripts/format-check.mjs\\n\\nformat check ok\\n\\n> tasknode@0.1.0 lint\\n> eslint src server scripts shared\\n\\n\\n> tasknode@0.1.0 api-reference-check\\n> node scripts/generate-api-reference.mjs\\n\\nAPI reference ok: 185 policies match the generated inventory\\n\\n> tasknode@0.1.0 security\\n> npm audit --audit-level=high && npm run public-help-check && npm run route-auth-policy-smoke && npm run trusted-proxy-rate-limit-smoke && npm run account-data-lifecycle-smoke && npm run data-retention-smoke && npm run data-recovery-safety-smoke && npm run asset-provenance-check && npm run dependency-license-check\\n\\n# npm audit report\\n\\nsource-map-js  1.0.0 - 1.2.1\\nSeverity: high\\nsource-map-js allows event-loop denial of service through indexed source-map section offsets - https://github.com/advisories/GHSA-68fv-2mgg-jv7q\\nfix available via `npm audit fix`\\nnode_modules/source-map-js\\n\\n1 high severity vulnerability\\n\\nTo address all issues, run:\\n  npm audit fix\\n\",\n      \"stderr\": \"\"\n    }\n  ],\n  \"toolchain\": {\n    \"versions\": {\n      \"node\": \"v24.21.0\",\n      \"npm\": \"11.19.0\"\n    },\n    \"credentialConfiguration\": \"Distinct empty npm configs; no inherited provider/database/secret environment. Real HOME not changed.\",\n    \"nodeSha256\": \"e4b5a3af0e05c75de2eae013904145f40fe7fc2a6e6f17510128bf45cca4e79b\",\n    \"npmCliSha256\": \"8e5f6f3429f8cdbe693cdc29904e9d5a7b127a494bd15c804bd54c7403bfcbe7\"\n  },\n  \"scope\": \"Actual isolated macOS root candidate; no Linux/container/deployment/proof or full-check-green claim. Harness import failure retained; successful checks not repeated.\"\n}\n\n\nFresh2026-10-15 source/security basis: npm audit on exact main reports Sharp<0.35.5 and source-map-js<1.2.2 only; initial config failure occurred before audit and was corrected using distinct empty configs. React/ReactDOM19.2.6 and scheduler0.27.0 records are frozen unchanged. The current RSC advisories name react-server-dom-webpack/parcel/turbopack, absent from the selected root/runtime manifests/locks and app/server source scan. This is a scoped applicability finding, not general security equivalence or an assertion that React19.2.6 is latest.\n\nPrimary sources: https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3 ; https://github.com/react/react/security/advisories/GHSA-h3gv-c5rc-p453 ; https://github.com/react/react/security/advisories/GHSA-wx67-qw84-cm4g . React19.2.8 release lists RSC decoding performance changes: https://github.com/react/react/releases/tag/v19.2.8 . Root Sharp patched range0.35.5 is supported by https://github.com/advisories/GHSA-wq5f-xc86-pv6w . No exploit or private/live-account probe was run.\n\n\n{\n  \"observedAt\": \"2026-10-15T05:33:30.282149+00:00\",\n  \"source\": \"41bb94647cd2e6183d0cbe193b568d179c79a9b6\",\n  \"args\": [\n    \"/Library/Developer/CommandLineTools/usr/bin/git\",\n    \"grep\",\n    \"-n\",\n    \"-E\",\n    \"react-server-dom-|@vitejs/plugin-rsc\",\n    \"--\",\n    \"package.json\",\n    \"package-lock.json\",\n    \"runtime/*/package*.json\",\n    \"vite.config.*\",\n    \"src\",\n    \"server\"\n  ],\n  \"exit\": 1,\n  \"stdout\": \"\",\n  \"stderr\": \"\",\n  \"interpretation\": \"Exact RSC package/plugin names absent from selected production manifests/locks and app/server source paths when exit1. Scope evidence, not a blanket security-equivalence claim.\",\n  \"primaryAdvisories\": [\n    \"https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3\",\n    \"https://github.com/react/react/security/advisories/GHSA-h3gv-c5rc-p453\",\n    \"https://github.com/react/react/security/advisories/GHSA-wx67-qw84-cm4g\"\n  ]\n}\n", "url": "https://gist.github.com/citadelculture/ff69bfc5b660b3e22da69e16fc7660df"}, {"timestamp": "2026-10-15T11:08:00.409Z", "date_only": false, "value": "2026-10-15T11:08:00.409673Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxvwbs62472n", "record": "CVE-2026-96889", "field": "creation_timestamp", "uuid": "51b7ad4c-a8fa-4688-970a-934bcb6cd78b", "content": "Next.js\u306eSVG\u753b\u50cf\u51e6\u7406\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u6050\u308c\n\nVercel\u306f\u3001Next.js\u306b\u5bfe\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u66f4\u65b0\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u5b9a\u4f8b\u5916\u3067\u516c\u958b\u3057\u307e\u3057\u305f\u3002\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\uff08RCE\uff09\u306e\u6df1\u523b\u306a\u8106\u5f31\u60272\u4ef6\u3068\u3001\u91cd\u8981\u5ea6\u300c\u9ad8\u300d\u306e\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\uff08DoS\uff09\u306e\u8106\u5f31\u60271\u4ef6\u3092\u4fee\u6b63\u3057\u3066\u3044\u307e\u3059\u3002CyberSecurity Tools \u6df1\u523b\u306a\u8106\u5f31\u6027\u306e\u3046\u30611\u4ef6\u306f\u300cCVE-2026-96889\u300d\uff08GHSA-246", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxvwbs62472n"}, {"timestamp": "2026-10-15T13:24:37.220Z", "date_only": false, "value": "2026-10-15T13:24:37.220218Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mxw5w2fnjh2f", "record": "cve-2026-96889", "field": "creation_timestamp", "uuid": "0dd5bb24-7178-4e31-a35b-d1f54ee18516", "content": "Next.js emergency patch: two critical RCE flaws allow unauthenticated remote code\u00a0execution\n\nNext.js fixes two critical RCE vulnerabilities and a high-severity DoS flaw. Learn about CVE-2026-96889, affected\u2026\n\nhttps://thecybersecguru.com/exploits/nextjs-critical-rce-vulnerabilities-cve-2026-96889/", "url": "https://bsky.app/profile/thecybersecguru.com/post/3mxw5w2fnjh2f"}, {"timestamp": "2026-10-15T17:14:06Z", "date_only": false, "value": "2026-10-15T17:14:06Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2026:24117-1", "record": "SUSE-SU-2026:24117-1", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-15T17:14:06Z", "date_only": false, "value": "2026-10-15T17:14:06Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2026:24117-1", "record": "SUSE-SU-2026:24117-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-16T11:58:42Z", "date_only": false, "value": "2026-10-16T11:58:42Z", "kind": "milestone", "label": "Published", "source": "osv_openeuler \u00b7 OESA-2026-4262", "record": "OESA-2026-4262", "field": "published"}, {"timestamp": "2026-10-16T11:58:42Z", "date_only": false, "value": "2026-10-16T11:58:42Z", "kind": "other", "label": "Updated", "source": "osv_openeuler \u00b7 OESA-2026-4262", "record": "OESA-2026-4262", "field": "modified"}, {"timestamp": "2026-10-16T11:58:43Z", "date_only": false, "value": "2026-10-16T11:58:43Z", "kind": "milestone", "label": "Published", "source": "osv_openeuler \u00b7 OESA-2026-4263", "record": "OESA-2026-4263", "field": "published"}, {"timestamp": "2026-10-16T11:58:43Z", "date_only": false, "value": "2026-10-16T11:58:43Z", "kind": "other", "label": "Updated", "source": "osv_openeuler \u00b7 OESA-2026-4263", "record": "OESA-2026-4263", "field": "modified"}, {"timestamp": "2026-10-16T11:58:44Z", "date_only": false, "value": "2026-10-16T11:58:44Z", "kind": "milestone", "label": "Published", "source": "osv_openeuler \u00b7 OESA-2026-4264", "record": "OESA-2026-4264", "field": "published"}, {"timestamp": "2026-10-16T11:58:44Z", "date_only": false, "value": "2026-10-16T11:58:44Z", "kind": "milestone", "label": "Published", "source": "osv_openeuler \u00b7 OESA-2026-4265", "record": "OESA-2026-4265", "field": "published"}, {"timestamp": "2026-10-16T11:58:44Z", "date_only": false, "value": "2026-10-16T11:58:44Z", "kind": "other", "label": "Updated", "source": "osv_openeuler \u00b7 OESA-2026-4264", "record": "OESA-2026-4264", "field": "modified"}, {"timestamp": "2026-10-16T11:58:44Z", "date_only": false, "value": "2026-10-16T11:58:44Z", "kind": "other", "label": "Updated", "source": "osv_openeuler \u00b7 OESA-2026-4265", "record": "OESA-2026-4265", "field": "modified"}]}