🔒 [IBM OSPO Security Notification] — IBM/CodeEngine

@uwefassnacht

🔒 [IBM OSPO Security Notification] — IBM/CodeEngine

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.

Attention: @uwefassnacht @smoser-ibm @dimipankratz @jeremiaswerner @reggeenr

Dependabot Alerts

Severity	CVE/GHSA	Package	Affected	Patched	Deadline	Fix PR
🟠 high	CVE-2026-101907	axios	>= 1.17.0, < 1.20.0	1.20.0	2026-11-05	PR
🟠 high	CVE-2026-101903	axios	>= 1.16.1, < 1.20.0	1.20.0	2026-11-06	PR
🟠 high	CVE-2026-101909	axios	>= 1.15.1, < 1.20.0	1.20.0	2026-11-06	PR
🟠 high	CVE-2026-101905	axios	>= 1.15.2, < 1.20.0	1.20.0	2026-11-06	PR
🟠 high	CVE-2026-101906	axios	>= 1.15.0, < 1.20.0	1.20.0	2026-11-06	PR
🟠 high	GHSA-x5rw-q4pp-hg5g	devalue	>= 5.8.0, <= 5.9.2	5.9.3	2026-11-08	PR
🟡 medium	CVE-2026-69112	accelerate	<= 1.14.0	—	2026-12-30	—
🟡 medium	CVE-2026-101899	axios	>= 1.15.0, < 1.20.0	1.20.0	2027-01-05	PR
🟡 medium	CVE-2026-97688	urllib3	>= 2.6.2, < 2.8.0	2.8.0	2027-01-06	PR

Code Scanning Alerts

Severity	Rule	Tool	Deadline
🟠 high	go/clear-text-logging	CodeQL	2026-10-29
🟠 high	go/path-injection	CodeQL	2026-10-29
🟠 high	go/path-injection	CodeQL	2026-10-29
🟠 high	go/reflected-xss	CodeQL	2026-10-29
🟠 high	js/clear-text-logging	CodeQL	2026-10-29
🟠 high	js/clear-text-logging	CodeQL	2026-10-29
🟠 high	js/clear-text-logging	CodeQL	2026-10-29
🟠 high	js/clear-text-logging	CodeQL	2026-10-29
🟠 high	js/request-forgery	CodeQL	2026-10-29
🟠 high	java/spring-boot-exposed-actuators-config	CodeQL	2026-10-29
🟠 high	go/reflected-xss	CodeQL	2026-10-29
🟡 medium	go/weak-sensitive-data-hashing	CodeQL	2026-12-28
🟡 medium	go/allocation-size-overflow	CodeQL	2026-12-28
🟡 medium	go/allocation-size-overflow	CodeQL	2026-12-28
🟡 medium	js/tainted-format-string	CodeQL	2026-12-28
🟡 medium	js/tainted-format-string	CodeQL	2026-12-28
🟡 medium	js/missing-rate-limiting	CodeQL	2026-12-28

Secret Scanning Alerts

No open secret scanning alerts.

🔄 Dependabot Alert Changes

Resolved: CVE-2024-47764

🔄 Dependabot Alert Changes

Added: CVE-2024-47764 (low)

🔄 Code & Secret Scanning Alert Changes

Added: cs-47 (code-scanning, medium), cs-46 (code-scanning, medium), cs-45 (code-scanning, medium), cs-44 (code-scanning, high), cs-43 (code-scanning, high), cs-42 (code-scanning, high), cs-41 (code-scanning, high), cs-40 (code-scanning, medium), cs-39 (code-scanning, medium), cs-38 (code-scanning, high), cs-37 (code-scanning, high), cs-36 (code-scanning, high), cs-35 (code-scanning, high), cs-34 (code-scanning, medium), cs-33 (code-scanning, high), cs-32 (code-scanning, high), cs-3 (code-scanning, high)

🔄 Dependabot Alert Changes

Resolved: CVE-2024-47764, CVE-2026-69112

🔄 Dependabot Alert Changes

Added: CVE-2024-47764 (low), CVE-2026-69112 (medium)

🔄 Dependabot Alert Changes

Added: CVE-2026-101907 (high)

Resolved: CVE-2024-47764

🔄 Dependabot Alert Changes

Added: CVE-2026-101903 (high), CVE-2026-101909 (high), CVE-2026-101905 (high), CVE-2026-101906 (high), CVE-2026-101899 (medium)

🔄 Dependabot Alert Changes

Added: CVE-2026-97688 (medium)

🔄 Dependabot Alert Changes

Added: GHSA-x5rw-q4pp-hg5g (high)

Navigation Menu

Repository navigation

🔒 [IBM OSPO Security Notification] — IBM/CodeEngine #493