# Vulnerabilities accepted for the release image scan, with an expiry review note each.

# Everything else — anything in the application's own dependency tree, and every OS package —

# still blocks promotion (see the image-scan job in .github/workflows/release.yml).

# CVE-2026-14257 and CVE-2026-69152 — brace-expansion ReDoS, and the follow-up that bypasses the

# first one's mitigation. Fixed upstream in 5.0.8 and 5.0.9 respectively.

#

# The only copies left in the image are the ones bundled inside the npm CLI

# (/usr/local/lib/node_modules/npm/node_modules/brace-expansion, currently 5.0.7). npm is never on

# the request path: the entrypoint runs `node dist/main`, and npm is present only for the

# documented operator runbooks (`docker exec openwa npm run cli …`). Reaching this code requires an

# operator to run an npm command with an attacker-chosen glob inside the container.

#

# npm 12 — the newest release, already installed by the Dockerfile — still bundles 5.0.7, so there

# is currently no npm version that clears either finding. Drop both entries once npm ships a bundle

# with brace-expansion >= 5.0.9.

#

# These are ID-level ignores, so they would also silence the same CVEs in the APPLICATION tree,

# which this file otherwise refuses to do. What keeps that honest is the root `overrides` entry

# pinning brace-expansion to ^5.0.9: npm cannot resolve the application tree below the fixed

# version, so there is no app-tree finding for these ids to hide. Raise that floor alongside any

# future brace-expansion advisory rather than widening this list.

CVE-2026-14257

CVE-2026-69152

# CVE-2026-69192 — ip-address SSRF-adjacent parsing flaw, fixed upstream in 10.3.1.

#

# Same shape as the two above: the only copy in the image is the one bundled inside the npm CLI

# (/usr/local/lib/node_modules/npm/node_modules/ip-address, 10.2.0 in npm 12.0.2 — the newest

# release, and what the Dockerfile installs). npm is not on the request path, so reaching it means

# an operator running an npm command inside the container.

#

# The application tree is independently above the fix: package-lock.json resolves the sole

# node_modules/ip-address at 10.4.0, and the root `overrides` entry pins `ip-address` to ^10.4.0 so

# it cannot regress below it — the same invariant the brace-expansion note describes, which is what

# keeps an ID-level ignore honest. Drop this entry once npm ships a bundle with ip-address >= 10.3.1.

CVE-2026-69192

# Chromium: no entry, and the two architectures are not scanned alike.

#

# arm64 installs Debian's `chromium` and `chromium-sandbox` (Dockerfile, TARGETARCH branch) by choice;

# Chrome for Testing publishes linux-arm64 builds only from 153 on, and the image has not moved arm64 to

# one. Those are dpkg packages, so the scan sees them and a fixable HIGH/CRITICAL fails it.

# `ignore-unfixed` still hides every chromium CVE Debian has not fixed yet, so a passing arm64 scan

# does not mean the browser has no open advisories. Measured on 2026-09-15 against

# ghcr.io/rmyndharis/openwa:main (arm64, the release flags minus `ignore-unfixed`): `chromium`,

# `chromium-common` and `chromium-sandbox` each carry 2 CRITICAL and 15 HIGH advisories in state

# "affected", i.e. Debian has published no fix. That exposure is accepted for the release: the

# alternative is moving arm64 off the Debian package to Chrome for Testing, which publishes

# linux-arm64 builds from 153 on. Re-measure with

# `trivy image --severity CRITICAL,HIGH --platform linux/arm64 ghcr.io/rmyndharis/openwa:<tag>`

# when deciding whether the number still fits. The eleven chromium CVEs this file used to accept

# (between CVE-2026-76033 and CVE-2026-76047) were fixed in 151.0.7922.169, and bookworm-security has

# shipped newer chromium builds since.

#

# amd64 downloads a Chrome for Testing binary into /opt/puppeteer. No dpkg package owns it and no

# lockfile names it, so neither the OS nor the library scanner can see it: a clean amd64 scan says

# nothing about the browser. Its version is the pin in the Dockerfile, and no scan will flag that pin

# as outdated.

# CVE-2026-73566 — node-tar denial of service via a crafted long-path archive entry, fixed

# upstream in 7.5.21.

#

# Same shape as the entries above: the only copy in the image is the one bundled inside the npm CLI

# (/usr/local/lib/node_modules/npm/node_modules/tar, 7.5.19 in the npm release the Dockerfile

# installs). The application tree carries no tar at all, and npm is not on the request path — the

# entrypoint runs `node dist/main`, so reaching this code means an operator running an npm command

# against an attacker-chosen archive inside the container.

#

# Drop this entry once npm ships a bundle with tar >= 7.5.21. As with brace-expansion above, the

# root `overrides` entry pins `tar` to ^7.5.21 so this ID-level ignore cannot hide an app-tree

# finding: npm cannot resolve the application tree below the fixed version.

CVE-2026-73566