https://vulnerability.circl.lu/sightings/feed 2026-07-25T06:54:49.346070+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/57a4bcf9-2552-4ce4-a745-8eec345bf0c7/export 2026-07-25T06:54:49.350210+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "57a4bcf9-2552-4ce4-a745-8eec345bf0c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-mh99-v99m-4gvg", "type": "seen", "source": "https://gist.github.com/BrendanPatric/94f86501f020c7775dbd8239cf371c2e", "content": "# Workflow Creator 1.2.1 Post-Advisory Security Notice\n\n## Status\n\nWorkflow Creator 1.2.1 is newly affected through its official Pi 0.81.1 host closure by `GHSA-mh99-v99m-4gvg` / `CVE-2026-14257`.\n\nThe exact independently reproduced host node is:\n\n```text\nnode_modules/@earendil-works/pi-coding-agent/node_modules/brace-expansion\nversion: 5.0.7\nfixed: 5.0.8\n```\n\nExact reachability verdict:\n\n```text\nreachable_with_untrusted_input\n```\n\n## User guidance\n\nThe unqualified canonical-default recommendation for 1.2.1 is withdrawn. Existing release bytes and tags remain unchanged for provenance and rollback integrity, but the release must not be described as clean or vulnerability-free.\n\nUntil a separately verified release uses an official Pi shrinkwrap installing `brace-expansion@5.0.8` or later, do not permit untrusted:\n\n- Pi package manifests or manifest glob entries;\n- Pi package-resource filter patterns;\n- Pi model-scope patterns;\n- extension- or tool-written configuration containing matching patterns.\n\nThis restriction is operational risk reduction, not a universal mitigation. Centralife project code does not intercept every Pi-owned package-manager, model-resolver, minimatch, and glob entry point.\n\n## Remediation\n\nMove to the first separately verified Workflow Creator release based on a compatible official Pi package whose clean isolated installation proves the nested dependency is `brace-expansion@5.0.8` or later.\n\nSee `STABLE-1.2.1-AUDIT.json` for exact source, package, Pi, shrinkwrap, installed-tree, call-site, and input-provenance bindings.\n\nThis notice grants no exception, promotion, installation, tag, push, or release authority.\n", "creation_timestamp": "2026-07-25T03:24:18.336021Z"} 2026-07-25T03:24:18.336021+00:00