From a9773215ee5d9180d03a3be790b47dab4c58614d Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Tue, 18 Aug 2026 14:00:21 +1000 Subject: [PATCH] UID2-7707: suppress CVE-2026-73650 in .trivyignore (exp 2026-11-18) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit unknown package is present but not reachable from this service — see UID2-7707 for the impact assessment. Reachability alone determines suppress-vs-fix. --- .trivyignore | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.trivyignore b/.trivyignore index d24b50e..6f0f8fd 100644 --- a/.trivyignore +++ b/.trivyignore @@ -51,3 +51,15 @@ CVE-2026-67213 exp:2026-11-11 # path # See: UID2-7659 GHSA-5p4m-2wfm-xmqj exp:2026-11-11 + +# CVE-2026-73650 — svgo (HIGH). +# Not exploitable here: svgo appears only in the two scanned react-client-side lockfiles +# (javascript-sdk & google-secure-signals): svgo@3.3.3 (@svgr/plugin-svgo dep), postcss-svgo's +# svgo@2.8.1, and svgo@1.3.2 bundled in react-scripts@5/@svgr/webpack@5.5.0. No src/ file +# imports svgo or calls optimize() (grep in both src trees returned nothing). Dockerfile runs +# `npm run build` (CRA) then `npm start` -> server.js is plain express serving the static +# build; svgo runs only at CRA build time on the app's own trusted SVG assets, never against +# untrusted request input. removeScripts/removeScriptElement plugin is disabled by default and +# not configured. +# See: UID2-7707 +CVE-2026-73650 exp:2026-11-18