residoo 0.23.0 → 0.23.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/cve.js +7 -1
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "residoo",
|
|
3
|
-
"version": "0.23.
|
|
3
|
+
"version": "0.23.1",
|
|
4
4
|
"description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "CloudRoam (https://cloudroam.io)",
|
package/src/cve.js
CHANGED
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
* the same "never a false all-clear" concern CONTRIBUTING.md states for
|
|
24
24
|
* source paths, applied to this table instead.
|
|
25
25
|
*
|
|
26
|
-
* DELIBERATELY SMALL, on purpose: this is ~
|
|
26
|
+
* DELIBERATELY SMALL, on purpose: this is ~27 entries across 11 packages,
|
|
27
27
|
* not a claim of exhaustive coverage the way Medusa's own "~200 CVEs" is.
|
|
28
28
|
* Every single entry here is individually traceable to a specific GHSA/
|
|
29
29
|
* CVE id and a real advisory -- the same "84 high-confidence rules beat a
|
|
@@ -146,6 +146,12 @@ const CVE_DATABASE = [
|
|
|
146
146
|
summary: "Path validation bypass via prefix matching and symlink handling.",
|
|
147
147
|
source: "GHSA (fetched via api.github.com/advisories)",
|
|
148
148
|
},
|
|
149
|
+
{
|
|
150
|
+
id: "CVE-2025-9611", ecosystem: "npm", package: "@playwright/mcp", severity: "high",
|
|
151
|
+
ranges: [{ maxExclusive: "0.0.40" }],
|
|
152
|
+
summary: "Vulnerable to a DNS rebinding attack, allowing an attacker access to all server tools.",
|
|
153
|
+
source: "GHSA (fetched via api.github.com/advisories)",
|
|
154
|
+
},
|
|
149
155
|
|
|
150
156
|
// ---- pip ----
|
|
151
157
|
{
|