[security][CVE-2026-44705] tmp #18

New issue

Open

opened 2026-06-02 13:19:14 +00:00 by dirtydishes · 0 comments

dirtydishes commented

2026-06-02 13:19:14 +00:00

Owner

Summary

New unaddressed high-severity CVE in the locked dependency graph: tmp@0.2.5 via @electron-forge/cli -> @inquirer/prompts -> @inquirer/editor -> external-editor -> tmp.

CVE: CVE-2026-44705 (GHSA-ph9p-34f9-6g65)
Severity: High (CVSS 7.7 on GitHub Advisory)
Affected in-repo version: tmp@0.2.5 in bun.lock
Scope: build/packaging dependency for apps/desktop rather than deployed web/API runtime, but still present in the repo lockfile and relevant to local/CI packaging workflows

Impact

The advisory describes path traversal when untrusted data reaches tmp prefix, postfix, or dir options. In this repo the vulnerable package is not in the production service runtime; it is pulled in by the Electron Forge toolchain. The practical risk is highest in local packaging or CI environments that invoke the Forge CLI on attacker-influenced inputs or plugins.

Remediation

Upgrade the dependency chain so the lock resolves to tmp@0.2.6 or later
Likely path: bump the Electron Forge / Inquirer chain and refresh bun.lock
If immediate upgrade is blocked, avoid passing untrusted values into any tmp usage in packaging helpers and treat packaging jobs as sensitive CI workloads

Evidence

bun audit --json reports the advisory
bun why tmp resolves the path through @electron-forge/cli

Counters

unaddressed critical CVEs: 0
unaddressed medium/low CVEs: 0
unaddressed total CVEs: 1

Sources

## Summary New unaddressed high-severity CVE in the locked dependency graph: `tmp@0.2.5` via `@electron-forge/cli` -> `@inquirer/prompts` -> `@inquirer/editor` -> `external-editor` -> `tmp`. - CVE: `CVE-2026-44705` (`GHSA-ph9p-34f9-6g65`) - Severity: High (`CVSS 7.7` on GitHub Advisory) - Affected in-repo version: `tmp@0.2.5` in `bun.lock` - Scope: build/packaging dependency for `apps/desktop` rather than deployed web/API runtime, but still present in the repo lockfile and relevant to local/CI packaging workflows ## Impact The advisory describes path traversal when untrusted data reaches `tmp` `prefix`, `postfix`, or `dir` options. In this repo the vulnerable package is not in the production service runtime; it is pulled in by the Electron Forge toolchain. The practical risk is highest in local packaging or CI environments that invoke the Forge CLI on attacker-influenced inputs or plugins. ## Remediation - Upgrade the dependency chain so the lock resolves to `tmp@0.2.6` or later - Likely path: bump the Electron Forge / Inquirer chain and refresh `bun.lock` - If immediate upgrade is blocked, avoid passing untrusted values into any `tmp` usage in packaging helpers and treat packaging jobs as sensitive CI workloads ## Evidence - `bun audit --json` reports the advisory - `bun why tmp` resolves the path through `@electron-forge/cli` ## Counters - unaddressed critical CVEs: 0 - unaddressed medium/low CVEs: 0 - unaddressed total CVEs: 1 ## Sources - https://github.com/advisories/GHSA-ph9p-34f9-6g65 - https://nvd.nist.gov/vuln/detail/CVE-2026-44705

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: dirtydishes/islandflow#18

No description provided.

Rows
Columns