Approved changes feed: RSS · Atom
cpe:2.3:a:jo-jo98:ciguard:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Jo Jo98 (4db435f4-a85c-557c-bb4f-569e0d774e03) |
|---|---|
| Product | Ciguard (4ce05d26-c29d-5747-98d4-5b07893d7a59) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44220 |
vulnerable | 2026-06-08 08:03:18.139091 |
ciguard: discover_pipeline_files follows symlinks out of scan root
LOW (3.2)
ciguard is a static security auditor for CI/CD pipelines. From 0.8.0 to 0.8.1 , the discover_pipeline_files() function in src/ciguard/discovery.py walks a directory tree following symlinks, with cycle protection via tracking visited resolved paths. An attacker who can plant a symlink in a directory the user (or AI agent) scans can cause discovery to walk into the symlink target and return paths to pipeline-shaped files outside the requested root. This vulnerability is fixed in 0.8.2.
Published: 2026-05-12T19:37:21.704Z
Updated: 2026-05-13T15:37:35.696Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44219 |
vulnerable | 2026-06-08 08:03:18.138749 |
ciguard: SCA HTTP client reads response body without size cap
LOW (3.7)
ciguard is a static security auditor for CI/CD pipelines. From 0.6.0 to 0.8.1, both SCA HTTP clients (src/ciguard/analyzer/sca/osv.py and src/ciguard/analyzer/sca/endoflife.py) call payload = json.loads(resp.read().decode('utf-8')) without a maximum-bytes cap. A hostile or compromised endoflife.date / OSV.dev (or a successful TLS MITM) could return a multi-GB response, exhausting the ciguard process's memory. This vulnerability is fixed in 0.8.2.
Published: 2026-05-12T19:40:28.848Z
Updated: 2026-05-13T14:20:04.224Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44218 |
vulnerable | 2026-06-08 08:03:18.138406 |
ciguard: Container image runs as root (no USER directive)
LOW (3)
ciguard is a static security auditor for CI/CD pipelines. From 0.1.0 to 0.8.1, the published ghcr.io/jo-jo98/ciguard container image inherits the default root user because the Dockerfile lacks a USER directive. This vulnerability is fixed in 0.8.2.
Published: 2026-05-12T19:39:16.632Z
Updated: 2026-05-14T12:30:51.422Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.