Likely permanent: GitHub doesn’t review this ecosystem
GHSA-f8fr-mccc-xvcx
ghcr.io/nerves-hub/nerves-hub on oci · published in nerves-hub/nerves_hub_web
Facts
- Severity
- Critical · CVSS score 9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Affected versions (ghcr.io/nerves-hub/nerves-hub)
- >= 1.0.0As entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it
- Fixed in (ghcr.io/nerves-hub/nerves-hub)
- >= 2.4.0
- Affected versions (https://github.com/nerves-hub/nerves_hub_web.git)
- adaeefdb7a835525482588f43332ef988cc448c7As entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it
- Fixed in (https://github.com/nerves-hub/nerves_hub_web.git)
- 1f69c9d595684a4650c3ac702f3dc7c5bcd7526c
- Affected versions (nerves_hub)
- >= 1.0.0As entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it
- Fixed in (nerves_hub)
- >= 2.4.0
- CVE
- CVE-2026-28806 · published
- GitHub Advisory Database
- Not reviewed
- OSV.dev
- Not present
- Other CVEs pointing here
- None found in the CVE List
If you use ghcr.io/nerves-hub/nerves-hub >= 1.0.0
Upgrade to 2.4.0 or later. Dependabot, npm audit and OSV-Scanner probably never will.
Timeline
2026-03-10 07:59 UTC
Published by the maintainers
Cites CVE-2026-28806
2026-10-31 12:46 UTC
First seen by Limbowatch
not reviewed · not in OSV
Not expected
Reviewed by GitHub
GitHub doesn’t review this ecosystem
Machine-readable record: feed/GHSA-f8fr-mccc-xvcx.json