GHSA-47W6-GWP4-W6VC高危已审查

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

OSV 1.4.0 · github-reviewed · 修改于 2026-08-14 02:16

发布时间

2026-07-25 05:49

GitHub 审查时间

2026-07-25 05:49

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/07/GHSA-47w6-gwp4-w6vc/GHSA-47w6-gwp4-w6vc.json

公告说明

Impact

Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes.

Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review

Patches

Workarounds

受影响的软件包

PyPI

vantage6

ECOSYSTEM

引入0最后受影响5.0.2

标识信息

别名 / CVE

CVE-2026-73652

CWE

CWE-863

软件生态

PyPI

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-47w6-gwp4-w6vc",
  "aliases": [
    "CVE-2026-73652"
  ],
  "details": "### Impact\nEdit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. \n\nWorst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review\n\n### Patches\nNo\n\n### Workarounds\nNo",
  "summary": "vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.0.2"
            }
          ]
        }
      ],
      "package": {
        "name": "vantage6",
        "ecosystem": "PyPI"
      }
    }
  ],
  "modified": "2026-08-13T18:16:03Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-07-24T21:49:36Z",
  "references": [
    {
      "url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-47w6-gwp4-w6vc",
      "type": "WEB"
    },
    {
      "url": "https://github.com/vantage6/vantage6",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-07-24T21:49:36Z"
  }
}