In limbo for 101 days

GHSA-7jp6-g653-29qh

MPXJ.Net on NuGet · published in joniles/mpxj

Fixed in 16.6.0. Dependabot, npm audit and OSV-Scanner won’t flag this yet. Find it in your project

Facts

Severity: Low · CVSS score 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected versions (MPXJ.Net): >= 7.3.0, < 16.6.0As entered by the maintainer. Not reviewed.
Fixed in (MPXJ.Net): 16.6.0
Affected versions (mpxj): >= 7.3.0, < 16.6.0As entered by the maintainer. Not reviewed.
Fixed in (mpxj): 16.6.0
Affected versions (mpxj): >= 7.3.0, < 16.6.0As entered by the maintainer. Not reviewed.
Fixed in (mpxj): 16.6.0
Affected versions (net.sf.mpxj): >= 7.3.0, < 16.6.0As entered by the maintainer. Not reviewed.
Fixed in (net.sf.mpxj): MPXJ.Net 16.6.0
Affected versions (net.sf.mpxj-for-csharp): >= 7.3.0, < 16.6.0As entered by the maintainer. Not reviewed.
Fixed in (net.sf.mpxj-for-csharp): MPXJ.Net 16.6.0
Affected versions (net.sf.mpxj-for-vb): >= 7.3.0, < 16.6.0As entered by the maintainer. Not reviewed.
Fixed in (net.sf.mpxj-for-vb): MPXJ.Net 16.6.0
Affected versions (net.sf.mpxj:mpxj): >= 7.3.0, < 16.6.0As entered by the maintainer. Not reviewed.
Fixed in (net.sf.mpxj:mpxj): 16.6.0
CVE: CVE-2026-103989 · reserved, record not publishedThe ID is public but empty: looking it up returns nothing. The CVE Program expects publication within 72 hours.
GitHub Advisory Database: Not reviewed
OSV.dev: Not present
Other CVEs pointing here: None found in the CVE List

Upgrade to 16.6.0 or later. Dependabot, npm audit and OSV-Scanner won’t flag this yet.

2026-08-03 18:01 UTC
Published by the maintainers
Cites CVE-2026-103989
2026-10-28 07:20 UTC
First seen by Limbowatch
CVE still reserved · not reviewed · not in OSV
Waiting
CVE record published
Waiting
Reviewed by GitHub
Waiting
In OSV; scanners can see it