{ "recorded_at": "2026-10-12T12:13:12Z", "source": { "commit": "136be32dbb25de23ff55642947fd5ce4eb3a9f82", "base": "b22c16b5261624eb18a3f088dc39e735f56370e0" }, "tools": { "cargo": "cargo 1.92.0 (344c4567c 2025-10-21)", "cargo_audit": "cargo-audit-audit 0.22.2", "advisory_db_commit": "25a288f68f2d5ebe658b243a334110c7217a2569", "pip_audit": "pip-audit==2.10.1", "cyclonedx_validator": "cyclonedx-python-lib[json-validation]==11.6.0", "advisory_db_date": "2026-10-12T13:40:46+02:00", "advisory_count": 1299, "uv": "uv 0.12.3 (507230998 2026-08-07 aarch64-apple-darwin)", "cosign": "v3.1.3", "gh": "gh version 2.100.0 (2026-09-03)", "python": "3.13.9" }, "counts": { "packet_recorded_at": "2026-10-12T12:13:12Z", "packaged_commit": "136be32dbb25de23ff55642947fd5ce4eb3a9f82", "advisory_db_commit": "25a288f68f2d5ebe658b243a334110c7217a2569", "advisory_db_date": "2026-10-12T13:40:46+02:00", "open_critical_or_high_rows": 16, "open_critical_or_high_unique": 4, "open_by_scope": { "bundle_wheels": 12, "community_package_lock": 4, "root_workspace_lock": 0, "python_shipped_extras": 1, "published_release_sboms": 0 }, "critical_or_high_on_lockfiles_that_do_not_ship": 6, "lower_findings": 11, "unrated_vulnerabilities": 4, "rust_crates": 260, "rust_crates_runtime": 215, "root_lock_quick_xml_versions": [ "0.42.0" ] }, "cargo_locks": [ { "category": "workspace", "shipped": true, "reason": "Root workspace lock. `cargo build --locked -p wolf` and the engine wheels (maturin, workspace members) resolve from it.", "path": "Cargo.lock", "lockfile_sha256": "dd1d66b522e8064cd8a469df9a23da6a1a644ca0912ad8974a3ef83c581c987f", "crates": 558, "vulnerabilities": [], "warnings": [ { "id": "RUSTSEC-2025-0134", "kind": "unmaintained", "crate": "rustls-pemfile@2.2.0", "title": "rustls-pemfile is unmaintained", "cvss": null, "score": null, "severity": "unrated", "lock_category": "workspace", "shipped_lock": true, "lock": "Cargo.lock", "shipped": "lockfile_only" }, { "id": "RUSTSEC-2026-0190", "kind": "unsound", "crate": "anyhow@1.0.102", "title": "Unsoundness in `Error::downcast_mut()`", "cvss": null, "score": null, "severity": "unrated", "lock_category": "workspace", "shipped_lock": true, "lock": "Cargo.lock", "shipped": "lockfile_only" } ] }, { "category": "not_shipped", "shipped": false, "reason": "benchmark harness (publish = false)", "path": "benchmarks/portfolio/results/run-1/harness/ironcalc_worker/Cargo.lock", "lockfile_sha256": "bd5fa7e681ab513959578e0ad24d2223cee7e5c96385babf4c6ebfd6b636214b", "crates": 119, "vulnerabilities": [], "warnings": [] }, { "category": "not_shipped", "shipped": false, "reason": "optional OCR engine package with no crates.io dependencies", "path": "crates/wolf-ocr/Cargo.lock", "lockfile_sha256": "fc7c2dc5ecdf0aefe353f36293f4315971cfa814d353fee50806e2dbe65b56d6", "crates": 1, "vulnerabilities": [], "warnings": [] }, { "category": "not_shipped", "shipped": false, "reason": "cargo-fuzz targets over wolf's input kernels (publish = false)", "path": "crates/wolf/fuzz/Cargo.lock", "lockfile_sha256": "4d6391b37f7f5741457c3a7b867c15f3e82a526279085c84fa9ba260ecafaf95", "crates": 262, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-docx-writer/Cargo.lock", "lockfile_sha256": "a195d52279f881c08988bbd0ac87da3377de7f1565b87161c7c47afda4c905af", "crates": 112, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-ffi/Cargo.lock", "lockfile_sha256": "538e45a416b72bdba6aa71fc1a7b24d7487fa11eb7a2baa8a5b646d5513732c1", "crates": 36, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-layout-fields/Cargo.lock", "lockfile_sha256": "8f4fe1be6112758921f2577b477f73aaf091a253cca969a3e81a6c3957c50e3b", "crates": 95, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-layout-float/Cargo.lock", "lockfile_sha256": "5c348b57d35b8a97a226cb8e56c01adcb3b0087edeb76541fcb9f274c6f5169b", "crates": 95, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-layout-notes/Cargo.lock", "lockfile_sha256": "19069b624404fce4d5ef7b2109357ef0eb6aa4e544f1b6a2ecdff3c30d2744d0", "crates": 30, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-layout-page/Cargo.lock", "lockfile_sha256": "b16eebc621e63971307dfe60bf13bd82c66376976ec06b62a17360af5f3550b1", "crates": 107, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-layout-para/Cargo.lock", "lockfile_sha256": "7043f31e6be59e473fb39143f03134417e8fd5a6bed908bb40662572dc394d28", "crates": 50, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-layout-table/Cargo.lock", "lockfile_sha256": "3f0ad3772d291474ad64a49757600bc8ee36dd067b25c9a78c7189f46999cda8", "crates": 47, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-layout-tree/Cargo.lock", "lockfile_sha256": "181d5e242dd0856919457aede0f6ddae0cb23c9e551fe787d251ccaa4f6506a2", "crates": 13, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-legacy-doc/Cargo.lock", "lockfile_sha256": "5869b09c9b9b1fcd5badabcacdb6e9a97619e3a26e1d5100e121223a324297af", "crates": 110, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-legacy/Cargo.lock", "lockfile_sha256": "3728452d57262af79266c8d0cdcc422e3862f1ef7ebf173fab7eb3823b0887df", "crates": 112, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-model/Cargo.lock", "lockfile_sha256": "3da10df0edc5eba30ade662f49c15718f34d3f03f827e94d3625ed5149aefdf1", "crates": 95, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-odt-writer/Cargo.lock", "lockfile_sha256": "a0895abedea3840c24cdb2e5fabbee9538eb273e41f0ddb96ffabb23c2f966bd", "crates": 97, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-odt/Cargo.lock", "lockfile_sha256": "29ca2b7b6a4bc09408dc7afc81c54d3af056e3e77c9618d5a214ccc6e114d986", "crates": 96, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-render/Cargo.lock", "lockfile_sha256": "e84ec649cf7acc58840c4e61fae5c6841e62407ff12235f73222c7d2bb974324", "crates": 95, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfdocx/crates/wolfdocx-revisions/Cargo.lock", "lockfile_sha256": "4a5d716ac9e016ad81bfde1fa93bbe064ad2dad44885c9f455c61ebd026fb958", "crates": 16, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfpdf/crates/wolfpdf-ir/Cargo.lock", "lockfile_sha256": "3e29309ebc89959f95127412aad9e85e5afba853d53a12a8da0615c98cddb8c1", "crates": 68, "vulnerabilities": [], "warnings": [] }, { "category": "not_shipped", "shipped": false, "reason": "cargo-fuzz targets (excluded from the workspace)", "path": "engines/wolfpdf/crates/wolfpdf-ir/fuzz/Cargo.lock", "lockfile_sha256": "2f7e4ce6b526e90d7a121fca4809d8002affe9dcc118fcaec642b04296a67bce", "crates": 42, "vulnerabilities": [], "warnings": [] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfppt/crates/wolfppt-legacy/Cargo.lock", "lockfile_sha256": "95fe38e9d0fe4bc79a13cc725107a1c8b8920c99cbf24ebc43f5fa097b524a51", "crates": 107, "vulnerabilities": [], "warnings": [] }, { "category": "orphan_lock", "shipped": false, "reason": "no Cargo.toml beside it; no build reads it", "path": "engines/wolfrender/Cargo.lock", "lockfile_sha256": "032628e66f859d0360a313368abbf95cf9f48c7fdc6f8c5e278a636c49f1a77d", "crates": 167, "vulnerabilities": [], "warnings": [] }, { "category": "not_shipped", "shipped": false, "reason": "fixture generator, not part of the workspace and never built by cargo test", "path": "engines/wolfrender/crates/wolfrender-chart/tests/generator/Cargo.lock", "lockfile_sha256": "057c30df710481dbb1cb50c7b69c680725ebe7d074babe8599d3e564257bcd8e", "crates": 160, "vulnerabilities": [ { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfrender/crates/wolfrender-chart/tests/generator/Cargo.lock" }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfrender/crates/wolfrender-chart/tests/generator/Cargo.lock" } ], "warnings": [ { "id": "RUSTSEC-2026-0206", "kind": "unmaintained", "crate": "rustybuzz@0.20.1", "title": "`rustybuzz` is unmaintained", "cvss": null, "score": null, "severity": "unrated", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfrender/crates/wolfrender-chart/tests/generator/Cargo.lock" }, { "id": "RUSTSEC-2026-0192", "kind": "unmaintained", "crate": "ttf-parser@0.25.1", "title": "`ttf-parser` is unmaintained", "cvss": null, "score": null, "severity": "unrated", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfrender/crates/wolfrender-chart/tests/generator/Cargo.lock" } ] }, { "category": "superseded_by_workspace_lock", "shipped": false, "reason": "the crate is a root workspace member; cargo resolves it from the root Cargo.lock and ignores this file", "path": "engines/wolfxl/Cargo.lock", "lockfile_sha256": "aec89b04f7e5cda1f82ca05fce8f087cc68d18514ea9e42a367df22fb2e88339", "crates": 486, "vulnerabilities": [], "warnings": [ { "id": "RUSTSEC-2025-0134", "kind": "unmaintained", "crate": "rustls-pemfile@2.2.0", "title": "rustls-pemfile is unmaintained", "cvss": null, "score": null, "severity": "unrated", "lock_category": "superseded_by_workspace_lock", "shipped_lock": false, "lock": "engines/wolfxl/Cargo.lock" }, { "id": null, "kind": "yanked", "crate": "yoke-derive@0.8.3", "title": null, "cvss": null, "score": null, "severity": "unrated", "lock_category": "superseded_by_workspace_lock", "shipped_lock": false, "lock": "engines/wolfxl/Cargo.lock" } ] }, { "category": "not_shipped", "shipped": false, "reason": "benchmark harness pinned to a competitor, isolated from product resolution (publish = false)", "path": "engines/wolfxl/benchmarks/template_competitive/Cargo.lock", "lockfile_sha256": "4403d86839f18ca6bc8342b9e1e08f573ee2c9b51daa8ae4c617dc8803ca9054", "crates": 152, "vulnerabilities": [ { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfxl/benchmarks/template_competitive/Cargo.lock" }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfxl/benchmarks/template_competitive/Cargo.lock" }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.38.3", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfxl/benchmarks/template_competitive/Cargo.lock" }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.38.3", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfxl/benchmarks/template_competitive/Cargo.lock" } ], "warnings": [] }, { "category": "not_shipped", "shipped": false, "reason": "cargo-fuzz targets (excluded from the workspace)", "path": "engines/wolfxl/crates/wolfxl-crypto/fuzz/Cargo.lock", "lockfile_sha256": "0e9446a0d031b28a0d9ec0b7d171b03b1899b7129639c2f682f14d8bcb0adf65", "crates": 64, "vulnerabilities": [], "warnings": [] }, { "category": "not_shipped", "shipped": false, "reason": "excluded from the workspace; publish = false", "path": "engines/wolfxl/crates/wolfxl-data-python/Cargo.lock", "lockfile_sha256": "6071bb970ecb26cb54a81b08219183a585b8b00d533ded4078bc6bf51f93e0a3", "crates": 135, "vulnerabilities": [], "warnings": [] }, { "category": "community_package", "shipped": true, "reason": "Lock of the WolfXL Community package (`wolfxl` 2.0.9, MIT), the public pip-installable build. It is its own Cargo workspace and does not resolve from the root lock.", "path": "engines/wolfxl/oss/Cargo.lock", "lockfile_sha256": "9f2c21d24822f8887ba30516e64eeb26c58aadd5d3754afb28a77595dadc90c6", "crates": 166, "vulnerabilities": [ { "id": "RUSTSEC-2026-0176", "kind": "vulnerability", "crate": "pyo3@0.28.3", "title": "Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators", "patched": [ ">=0.29.0" ], "cvss": null, "score": null, "severity": "unrated", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "wolfxl@2.0.9" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "disposition": { "status": "unaccepted", "reason": "open on the Community package lock; no fix version adopted yet (patched: >=0.29.0)" }, "reachability": { "verdict": "not_reachable_in_source", "note": "Affects pyo3 `PyList`/`PyTuple` iterator `nth`/`nth_back` and `PyCFunction::new_closure`. The Community package source calls none of them (re-checked by the rescan script)." } }, { "id": "RUSTSEC-2026-0177", "kind": "vulnerability", "crate": "pyo3@0.28.3", "title": "Missing `Sync` bound on `PyCFunction::new_closure` closures", "patched": [ ">=0.29.0" ], "cvss": null, "score": null, "severity": "unrated", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "wolfxl@2.0.9" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "disposition": { "status": "unaccepted", "reason": "open on the Community package lock; no fix version adopted yet (patched: >=0.29.0)" }, "reachability": { "verdict": "not_reachable_in_source", "note": "Affects pyo3 `PyList`/`PyTuple` iterator `nth`/`nth_back` and `PyCFunction::new_closure`. The Community package source calls none of them (re-checked by the rescan script)." } }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "wolfxl-autofilter@2.0.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-pivot@2.0.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.0.9" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "reachability": { "verdict": "not_reachable_in_source", "pulled_by": [ "wolfxl-autofilter@2.0.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-pivot@2.0.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.0.9" ], "note": "Affects `NsReader` and `NamespaceResolver::push` only. The Community package source has 0 files using either; calamine-styles 0.1.0 source has 0 uses. A plain `Reader` does not resolve namespaces and is not affected. The dependency stays vulnerable, so the finding stays open until quick-xml >= 0.41.0." } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "wolfxl-autofilter@2.0.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-pivot@2.0.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.0.9" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "reachability": { "verdict": "reachable", "pulled_by": [ "wolfxl-autofilter@2.0.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-pivot@2.0.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.0.9" ], "note": "Direct dependency of wolfxl-autofilter@2.0.0, wolfxl-core@0.8.0, wolfxl-merger@0.1.0, wolfxl-pivot@2.0.0, wolfxl-reader@0.1.0, wolfxl-rels@0.1.0, wolfxl-structural@0.1.0, wolfxl-writer@0.1.0, wolfxl@2.0.9. The affected API, `.attributes()` with the default duplicate check, runs on workbook parts the caller supplies in crates/wolfxl-reader/src/external_links.rs, src/wolfxl/sheet_patcher.rs, src/wolfxl/security.rs, src/wolfxl/calcchain.rs. The other call sites use `.with_checks(false)`, which the advisory excludes. A crafted start tag with very many attributes costs quadratic CPU on the parsing thread; the advisory records no memory or integrity impact. Fix: quick-xml >= 0.41.0." } }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "calamine-styles@0.1.0" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "reachability": { "verdict": "not_reachable_in_source", "pulled_by": [ "calamine-styles@0.1.0" ], "note": "Affects `NsReader` and `NamespaceResolver::push` only. The Community package source has 0 files using either; calamine-styles 0.1.0 source has 0 uses. A plain `Reader` does not resolve namespaces and is not affected. The dependency stays vulnerable, so the finding stays open until quick-xml >= 0.41.0." } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "calamine-styles@0.1.0" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "reachability": { "verdict": "reachable", "pulled_by": [ "calamine-styles@0.1.0" ], "note": "Pulled in by calamine-styles, the crates.io workbook reader that wolfxl-core, wolfxl-classify and wolfxl call. calamine-styles 0.1.0 source: 69 unchecked `.attributes()` call sites and 6 `try_get_attribute` calls (xlsx styles and workbook parsing, ODS). Reading a crafted workbook can spend quadratic CPU on one start tag. Fix: a calamine-styles release built on quick-xml >= 0.41.0; WolfXL cannot patch it in place." } } ], "warnings": [ { "id": "RUSTSEC-2026-0190", "kind": "unsound", "crate": "anyhow@1.0.102", "title": "Unsoundness in `Error::downcast_mut()`", "cvss": null, "score": null, "severity": "unrated", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "disposition": { "status": "unaccepted", "reason": "open on the Community package lock; no fix version adopted yet" } } ] } ], "python_locks": [ { "path": "engines/wolfdocx/uv.lock", "shipped": true, "shipped_extras": [ "complex-scripts", "encrypted", "signatures" ], "not_shipped_extras": [ "dev", "test" ], "runtime": { "audited": 19, "advisories": [], "skipped": [], "packages": 19 }, "extras": { "audited": 35, "advisories": [], "skipped": [], "packages": 35 }, "full": { "audited": 54, "advisories": [], "skipped": [], "packages": 54 } }, { "path": "engines/wolfppt/uv.lock", "shipped": true, "shipped_extras": [ "baseline", "encrypted", "render", "signatures" ], "not_shipped_extras": [ "dev", "test" ], "runtime": { "audited": 0, "advisories": [], "skipped": [], "packages": 0 }, "extras": { "audited": 9, "advisories": [], "skipped": [], "packages": 9 }, "full": { "audited": 34, "advisories": [], "skipped": [], "packages": 34 } }, { "path": "engines/wolfxl/oss/uv.lock", "shipped": true, "shipped_extras": [ "calc", "encrypted" ], "not_shipped_extras": [ "dev", "test" ], "runtime": { "audited": 1, "advisories": [], "skipped": [], "packages": 1 }, "extras": { "audited": 23, "advisories": [ { "id": "PYSEC-2026-3554", "aliases": [ "GHSA-m2h6-j472-rp4c", "CVE-2026-69248" ], "package": "cryptography@47.0.0", "fix_versions": [ "49.0.0" ], "cvss": null, "score": null, "severity": "unrated" }, { "id": "PYSEC-2026-3552", "aliases": [ "GHSA-g6cj-pr64-35w5", "CVE-2026-69247" ], "package": "cryptography@47.0.0", "fix_versions": [ "50.0.0" ], "cvss": null, "score": null, "severity": "unrated" }, { "id": "PYSEC-2026-3553", "aliases": [ "CVE-2026-69249", "GHSA-jwv3-5hgf-82ww" ], "package": "cryptography@47.0.0", "fix_versions": [ "49.0.0" ], "cvss": null, "score": null, "severity": "unrated" }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "package": "cryptography@47.0.0", "fix_versions": [ "48.0.1" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high" } ], "skipped": [], "packages": 23 }, "full": { "audited": 38, "advisories": [ { "id": "PYSEC-2026-3554", "aliases": [ "CVE-2026-69248", "GHSA-m2h6-j472-rp4c" ], "package": "cryptography@47.0.0", "fix_versions": [ "49.0.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra" }, { "id": "PYSEC-2026-3552", "aliases": [ "CVE-2026-69247", "GHSA-g6cj-pr64-35w5" ], "package": "cryptography@47.0.0", "fix_versions": [ "50.0.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra" }, { "id": "PYSEC-2026-3553", "aliases": [ "CVE-2026-69249", "GHSA-jwv3-5hgf-82ww" ], "package": "cryptography@47.0.0", "fix_versions": [ "49.0.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra" }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "package": "cryptography@47.0.0", "fix_versions": [ "48.0.1" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "shipped_extra", "reachability": { "verdict": "not_reachable_in_source", "pulled_by": [ "msoffcrypto-tool@5.4.2" ], "note": "cryptography 47.0.0 is pulled in by msoffcrypto-tool@5.4.2 through the optional `encrypted` extra of engines/wolfxl/oss/uv.lock. The advisory is about the OpenSSL statically linked into cryptography wheels before 48.0.1; the OpenSSL advisory of 9 June 2026 rates its high-severity issue as a use-after-free in PKCS7_verify (CVE-2026-45447; applications using the CMS APIs are not affected). msoffcrypto-tool's wheel has 0 PKCS#7 references and the package's own Python source has 0, so the PKCS7_verify path is not called. The dependency stays vulnerable and the optional extra is not installed by default. Fix: cryptography >= 48.0.1." } }, { "id": "PYSEC-2026-2249", "aliases": [ "GHSA-cfh3-3jmp-rvhc", "CVE-2026-25990", "BIT-pillow-2026-25990" ], "package": "pillow@11.3.0", "fix_versions": [ "12.1.1" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@11.3.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-2250", "aliases": [ "BIT-pillow-2026-40192", "CVE-2026-40192", "GHSA-whj4-6x5x-4v2j" ], "package": "pillow@11.3.0", "fix_versions": [ "12.2.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@11.3.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-165", "aliases": [ "GHSA-wjx4-4jcj-g98j", "BIT-pillow-2026-42308", "CVE-2026-42308" ], "package": "pillow@11.3.0", "fix_versions": [ "12.2.0" ], "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "score": 5.5, "severity": "medium", "scope": "development_or_test_only" }, { "id": "PYSEC-2026-2251", "aliases": [ "GHSA-5xmw-vc9v-4wf2", "CVE-2026-42309", "BIT-pillow-2026-42309" ], "package": "pillow@11.3.0", "fix_versions": [ "12.2.0" ], "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "score": 5.5, "severity": "medium", "scope": "development_or_test_only" }, { "id": "PYSEC-2026-2874", "aliases": [ "GHSA-r73j-pqj5-w3x7", "CVE-2026-42310", "BIT-pillow-2026-42310" ], "package": "pillow@11.3.0", "fix_versions": [ "12.2.0" ], "cvss": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "score": 5.5, "severity": "medium", "scope": "development_or_test_only" }, { "id": "PYSEC-2026-2252", "aliases": [ "CVE-2026-42311", "BIT-pillow-2026-42311", "GHSA-pwv6-vv43-88gr" ], "package": "pillow@11.3.0", "fix_versions": [ "12.2.0" ], "cvss": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "score": 7.8, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@11.3.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-2253", "aliases": [ "CVE-2026-54059", "BIT-pillow-2026-54059", "GHSA-8v84-f9pq-wr9x" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@11.3.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-2255", "aliases": [ "GHSA-45hq-cxwh-f6vc", "BIT-pillow-2026-55379", "CVE-2026-55379" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@11.3.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-2257", "aliases": [ "GHSA-4x4j-2g7c-83w6", "CVE-2026-55798" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "score": 4.5, "severity": "medium", "scope": "development_or_test_only" }, { "id": "PYSEC-2026-2256", "aliases": [ "BIT-pillow-2026-55380", "CVE-2026-55380", "GHSA-phj9-mv4w-65pm" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@11.3.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-2254", "aliases": [ "GHSA-5x94-69rx-g8h2", "CVE-2026-54060", "BIT-pillow-2026-54060" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@11.3.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-3453", "aliases": [ "CVE-2026-59205", "GHSA-9hw9-ch79-4vh6", "BIT-pillow-2026-59205" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@11.3.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-3451", "aliases": [ "BIT-pillow-2026-59199", "GHSA-6r8x-57c9-28j4", "CVE-2026-59199" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@11.3.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-3493", "aliases": [ "GHSA-62p4-gmf7-7g93", "CVE-2026-54058", "BIT-pillow-2026-54058" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "development_or_test_only" }, { "id": "PYSEC-2026-3454", "aliases": [ "CVE-2026-59197", "GHSA-xj96-63gp-2gmr", "BIT-pillow-2026-59197" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "score": 8.2, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@11.3.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-3494", "aliases": [ "BIT-pillow-2026-59198", "CVE-2026-59198", "GHSA-fj7v-r99m-22gq" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L", "score": 6.5, "severity": "medium", "scope": "development_or_test_only" }, { "id": "PYSEC-2026-3495", "aliases": [ "CVE-2026-59200", "GHSA-jjj6-mw9f-p565", "BIT-pillow-2026-59200" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@11.3.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-3496", "aliases": [ "BIT-pillow-2026-59204", "GHSA-vjc4-5qp5-m44j", "CVE-2026-59204" ], "package": "pillow@11.3.0", "fix_versions": [ "12.3.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "development_or_test_only" }, { "id": "PYSEC-2026-1845", "aliases": [ "CVE-2025-71176", "GHSA-6w46-j5rx-g56g" ], "package": "pytest@8.4.2", "fix_versions": [ "9.0.3" ], "cvss": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "score": 6.8, "severity": "medium", "scope": "development_or_test_only" }, { "id": "PYSEC-2026-2253", "aliases": [ "BIT-pillow-2026-54059", "CVE-2026-54059", "GHSA-8v84-f9pq-wr9x" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@12.2.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-2255", "aliases": [ "CVE-2026-55379", "BIT-pillow-2026-55379", "GHSA-45hq-cxwh-f6vc" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@12.2.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-2257", "aliases": [ "GHSA-4x4j-2g7c-83w6", "CVE-2026-55798" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "score": 4.5, "severity": "medium", "scope": "development_or_test_only" }, { "id": "PYSEC-2026-2256", "aliases": [ "BIT-pillow-2026-55380", "CVE-2026-55380", "GHSA-phj9-mv4w-65pm" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@12.2.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-2254", "aliases": [ "GHSA-5x94-69rx-g8h2", "BIT-pillow-2026-54060", "CVE-2026-54060" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@12.2.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-3453", "aliases": [ "BIT-pillow-2026-59205", "CVE-2026-59205", "GHSA-9hw9-ch79-4vh6" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@12.2.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-3451", "aliases": [ "GHSA-6r8x-57c9-28j4", "BIT-pillow-2026-59199", "CVE-2026-59199" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@12.2.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-3452", "aliases": [ "GHSA-pg7v-jwj7-p798", "CVE-2026-59203", "BIT-pillow-2026-59203" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@12.2.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-3493", "aliases": [ "BIT-pillow-2026-54058", "CVE-2026-54058", "GHSA-62p4-gmf7-7g93" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "development_or_test_only" }, { "id": "PYSEC-2026-3454", "aliases": [ "GHSA-xj96-63gp-2gmr", "CVE-2026-59197", "BIT-pillow-2026-59197" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "score": 8.2, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@12.2.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-3494", "aliases": [ "GHSA-fj7v-r99m-22gq", "BIT-pillow-2026-59198", "CVE-2026-59198" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L", "score": 6.5, "severity": "medium", "scope": "development_or_test_only" }, { "id": "PYSEC-2026-3495", "aliases": [ "CVE-2026-59200", "GHSA-jjj6-mw9f-p565", "BIT-pillow-2026-59200" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "development_or_test_only", "reachability": { "verdict": "not_shipped", "note": "pillow@12.2.0 resolves only through the dev/test dependency groups of engines/wolfxl/oss/uv.lock, which a user install does not pull." } }, { "id": "PYSEC-2026-3496", "aliases": [ "BIT-pillow-2026-59204", "GHSA-vjc4-5qp5-m44j", "CVE-2026-59204" ], "package": "pillow@12.2.0", "fix_versions": [ "12.3.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "development_or_test_only" } ], "skipped": [], "packages": 38 } }, { "path": "engines/wolfxl/uv.lock", "shipped": true, "shipped_extras": [ "analytics", "calc", "encrypted", "mcp", "pdf", "signing", "wom" ], "not_shipped_extras": [ "dev", "test" ], "runtime": { "audited": 3, "advisories": [], "skipped": [], "packages": 3 }, "extras": { "audited": 52, "advisories": [ { "id": "PYSEC-2026-4154", "aliases": [ "CVE-2026-102995", "GHSA-fp3h-c4fm-7vvf" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.18.1" ], "cvss": null, "score": null, "severity": "unrated" }, { "id": "PYSEC-2026-4160", "aliases": [ "GHSA-w23x-9jrw-r45c", "CVE-2026-103000" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.19.0" ], "cvss": null, "score": null, "severity": "unrated" }, { "id": "PYSEC-2026-4159", "aliases": [ "CVE-2026-102999", "GHSA-v247-6f48-mgcj" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.19.0" ], "cvss": null, "score": null, "severity": "unrated" }, { "id": "PYSEC-2026-4156", "aliases": [ "CVE-2026-102997", "GHSA-jw7q-gvrg-4vj3" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.18.1" ], "cvss": null, "score": null, "severity": "unrated" }, { "id": "PYSEC-2026-4155", "aliases": [ "GHSA-g9cg-prrw-2r8q", "CVE-2026-102996" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.18.1" ], "cvss": null, "score": null, "severity": "unrated" }, { "id": "PYSEC-2026-4157", "aliases": [ "CVE-2026-102998", "GHSA-php9-fj8v-98fj" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.19.0" ], "cvss": null, "score": null, "severity": "unrated" } ], "skipped": [], "packages": 52 }, "full": { "audited": 71, "advisories": [ { "id": "PYSEC-2026-4154", "aliases": [ "CVE-2026-102995", "GHSA-fp3h-c4fm-7vvf" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.18.1" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra" }, { "id": "PYSEC-2026-4160", "aliases": [ "CVE-2026-103000", "GHSA-w23x-9jrw-r45c" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.19.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra" }, { "id": "PYSEC-2026-4159", "aliases": [ "GHSA-v247-6f48-mgcj", "CVE-2026-102999" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.19.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra" }, { "id": "PYSEC-2026-4156", "aliases": [ "CVE-2026-102997", "GHSA-jw7q-gvrg-4vj3" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.18.1" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra" }, { "id": "PYSEC-2026-4155", "aliases": [ "GHSA-g9cg-prrw-2r8q", "CVE-2026-102996" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.18.1" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra" }, { "id": "PYSEC-2026-4157", "aliases": [ "CVE-2026-102998", "GHSA-php9-fj8v-98fj" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.19.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra" } ], "skipped": [], "packages": 71 } }, { "path": "scripts/harness/sb2/uv.lock", "shipped": false, "shipped_extras": [], "not_shipped_extras": [ "dev", "test" ], "runtime": { "audited": 2, "advisories": [], "skipped": [], "packages": 2 }, "full": { "audited": 8, "advisories": [], "skipped": [], "packages": 8 } }, { "path": "uv.lock", "shipped": true, "shipped_extras": [ "fidelity", "mcp", "probe" ], "not_shipped_extras": [ "dev", "test" ], "runtime": { "audited": 7, "advisories": [], "skipped": [], "packages": 7 }, "extras": { "audited": 42, "advisories": [], "skipped": [], "packages": 42 }, "full": { "audited": 58, "advisories": [], "skipped": [], "packages": 58 } } ], "open_critical_or_high": [ { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfppt-0.1.0-cp313-cp313-macosx_11_0_arm64.whl", "reachability": { "verdict": "not_indicated", "pulled_by": [ "wolfppt-core@0.1.0" ], "note": "Pulled in by wolfppt-core@0.1.0 in the wolfppt wheel's SBOM. Affects `NsReader` only. The native module has no `reader/ns_reader.rs` panic location for quick-xml 0.38.4; that is an indicator, not proof, and the wheel's source was not re-read. Stays open until the wheel is rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfppt-0.1.0-cp313-cp313-macosx_11_0_arm64.whl", "reachability": { "verdict": "reachable", "pulled_by": [ "wolfppt-core@0.1.0" ], "note": "Pulled in by wolfppt-core@0.1.0 in the wolfppt wheel's SBOM. The native module carries quick-xml 0.38.4 attribute-iterator code (panic locations found), the affected API, and the wheel parses user-supplied OOXML with it. Built from engine commits earlier than this tree, so the call sites were not re-read. Cleared by a wheel rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-macosx_11_0_arm64.whl", "reachability": { "verdict": "not_indicated", "pulled_by": [ "wolfxl-autofilter@2.1.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-package@0.1.0", "wolfxl-patch@0.1.0", "wolfxl-pivot@2.1.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-template@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.1.0" ], "note": "Pulled in by wolfxl-autofilter@2.1.0, wolfxl-core@0.8.0, wolfxl-merger@0.1.0, wolfxl-package@0.1.0, wolfxl-patch@0.1.0, wolfxl-pivot@2.1.0, wolfxl-reader@0.1.0, wolfxl-rels@0.1.0, wolfxl-structural@0.1.0, wolfxl-template@0.1.0, wolfxl-writer@0.1.0, wolfxl@2.1.0 in the wolfxl wheel's SBOM. Affects `NsReader` only. The native module has no `reader/ns_reader.rs` panic location for quick-xml 0.37.5; that is an indicator, not proof, and the wheel's source was not re-read. Stays open until the wheel is rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-macosx_11_0_arm64.whl", "reachability": { "verdict": "reachable", "pulled_by": [ "wolfxl-autofilter@2.1.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-package@0.1.0", "wolfxl-patch@0.1.0", "wolfxl-pivot@2.1.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-template@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.1.0" ], "note": "Pulled in by wolfxl-autofilter@2.1.0, wolfxl-core@0.8.0, wolfxl-merger@0.1.0, wolfxl-package@0.1.0, wolfxl-patch@0.1.0, wolfxl-pivot@2.1.0, wolfxl-reader@0.1.0, wolfxl-rels@0.1.0, wolfxl-structural@0.1.0, wolfxl-template@0.1.0, wolfxl-writer@0.1.0, wolfxl@2.1.0 in the wolfxl wheel's SBOM. The native module carries quick-xml 0.37.5 attribute-iterator code (panic locations found), the affected API, and the wheel parses user-supplied OOXML with it. Built from engine commits earlier than this tree, so the call sites were not re-read. Cleared by a wheel rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-macosx_11_0_arm64.whl", "reachability": { "verdict": "not_indicated", "pulled_by": [ "calamine-styles@0.1.0" ], "note": "Pulled in by calamine-styles@0.1.0 in the wolfxl wheel's SBOM. Affects `NsReader` only. The native module has no `reader/ns_reader.rs` panic location for quick-xml 0.38.4; that is an indicator, not proof, and the wheel's source was not re-read. Stays open until the wheel is rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-macosx_11_0_arm64.whl", "reachability": { "verdict": "reachable", "pulled_by": [ "calamine-styles@0.1.0" ], "note": "Pulled in by calamine-styles@0.1.0 in the wolfxl wheel's SBOM. The native module carries quick-xml 0.38.4 attribute-iterator code (panic locations found), the affected API, and the wheel parses user-supplied OOXML with it. Built from engine commits earlier than this tree, so the call sites were not re-read. Cleared by a wheel rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfppt-0.1.0-cp313-cp313-linux_x86_64.whl", "reachability": { "verdict": "not_indicated", "pulled_by": [ "wolfppt-core@0.1.0" ], "note": "Pulled in by wolfppt-core@0.1.0 in the wolfppt wheel's SBOM. Affects `NsReader` only. The native module has no `reader/ns_reader.rs` panic location for quick-xml 0.38.4; that is an indicator, not proof, and the wheel's source was not re-read. Stays open until the wheel is rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfppt-0.1.0-cp313-cp313-linux_x86_64.whl", "reachability": { "verdict": "reachable", "pulled_by": [ "wolfppt-core@0.1.0" ], "note": "Pulled in by wolfppt-core@0.1.0 in the wolfppt wheel's SBOM. The native module carries quick-xml 0.38.4 attribute-iterator code (panic locations found), the affected API, and the wheel parses user-supplied OOXML with it. Built from engine commits earlier than this tree, so the call sites were not re-read. Cleared by a wheel rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-linux_x86_64.whl", "reachability": { "verdict": "not_indicated", "pulled_by": [ "wolfxl-autofilter@2.1.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-package@0.1.0", "wolfxl-patch@0.1.0", "wolfxl-pivot@2.1.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-template@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.1.0" ], "note": "Pulled in by wolfxl-autofilter@2.1.0, wolfxl-core@0.8.0, wolfxl-merger@0.1.0, wolfxl-package@0.1.0, wolfxl-patch@0.1.0, wolfxl-pivot@2.1.0, wolfxl-reader@0.1.0, wolfxl-rels@0.1.0, wolfxl-structural@0.1.0, wolfxl-template@0.1.0, wolfxl-writer@0.1.0, wolfxl@2.1.0 in the wolfxl wheel's SBOM. Affects `NsReader` only. The native module has no `reader/ns_reader.rs` panic location for quick-xml 0.37.5; that is an indicator, not proof, and the wheel's source was not re-read. Stays open until the wheel is rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-linux_x86_64.whl", "reachability": { "verdict": "reachable", "pulled_by": [ "wolfxl-autofilter@2.1.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-package@0.1.0", "wolfxl-patch@0.1.0", "wolfxl-pivot@2.1.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-template@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.1.0" ], "note": "Pulled in by wolfxl-autofilter@2.1.0, wolfxl-core@0.8.0, wolfxl-merger@0.1.0, wolfxl-package@0.1.0, wolfxl-patch@0.1.0, wolfxl-pivot@2.1.0, wolfxl-reader@0.1.0, wolfxl-rels@0.1.0, wolfxl-structural@0.1.0, wolfxl-template@0.1.0, wolfxl-writer@0.1.0, wolfxl@2.1.0 in the wolfxl wheel's SBOM. The native module carries quick-xml 0.37.5 attribute-iterator code (panic locations found), the affected API, and the wheel parses user-supplied OOXML with it. Built from engine commits earlier than this tree, so the call sites were not re-read. Cleared by a wheel rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-linux_x86_64.whl", "reachability": { "verdict": "not_indicated", "pulled_by": [ "calamine-styles@0.1.0" ], "note": "Pulled in by calamine-styles@0.1.0 in the wolfxl wheel's SBOM. Affects `NsReader` only. The native module has no `reader/ns_reader.rs` panic location for quick-xml 0.38.4; that is an indicator, not proof, and the wheel's source was not re-read. Stays open until the wheel is rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-linux_x86_64.whl", "reachability": { "verdict": "reachable", "pulled_by": [ "calamine-styles@0.1.0" ], "note": "Pulled in by calamine-styles@0.1.0 in the wolfxl wheel's SBOM. The native module carries quick-xml 0.38.4 attribute-iterator code (panic locations found), the affected API, and the wheel parses user-supplied OOXML with it. Built from engine commits earlier than this tree, so the call sites were not re-read. Cleared by a wheel rebuilt from the workspace lock (quick-xml 0.42.0)." } }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "wolfxl-autofilter@2.0.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-pivot@2.0.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.0.9" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "reachability": { "verdict": "not_reachable_in_source", "pulled_by": [ "wolfxl-autofilter@2.0.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-pivot@2.0.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.0.9" ], "note": "Affects `NsReader` and `NamespaceResolver::push` only. The Community package source has 0 files using either; calamine-styles 0.1.0 source has 0 uses. A plain `Reader` does not resolve namespaces and is not affected. The dependency stays vulnerable, so the finding stays open until quick-xml >= 0.41.0." } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "wolfxl-autofilter@2.0.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-pivot@2.0.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.0.9" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "reachability": { "verdict": "reachable", "pulled_by": [ "wolfxl-autofilter@2.0.0", "wolfxl-core@0.8.0", "wolfxl-merger@0.1.0", "wolfxl-pivot@2.0.0", "wolfxl-reader@0.1.0", "wolfxl-rels@0.1.0", "wolfxl-structural@0.1.0", "wolfxl-writer@0.1.0", "wolfxl@2.0.9" ], "note": "Direct dependency of wolfxl-autofilter@2.0.0, wolfxl-core@0.8.0, wolfxl-merger@0.1.0, wolfxl-pivot@2.0.0, wolfxl-reader@0.1.0, wolfxl-rels@0.1.0, wolfxl-structural@0.1.0, wolfxl-writer@0.1.0, wolfxl@2.0.9. The affected API, `.attributes()` with the default duplicate check, runs on workbook parts the caller supplies in crates/wolfxl-reader/src/external_links.rs, src/wolfxl/sheet_patcher.rs, src/wolfxl/security.rs, src/wolfxl/calcchain.rs. The other call sites use `.with_checks(false)`, which the advisory excludes. A crafted start tag with very many attributes costs quadratic CPU on the parsing thread; the advisory records no memory or integrity impact. Fix: quick-xml >= 0.41.0." } }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "calamine-styles@0.1.0" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "reachability": { "verdict": "not_reachable_in_source", "pulled_by": [ "calamine-styles@0.1.0" ], "note": "Affects `NsReader` and `NamespaceResolver::push` only. The Community package source has 0 files using either; calamine-styles 0.1.0 source has 0 uses. A plain `Reader` does not resolve namespaces and is not affected. The dependency stays vulnerable, so the finding stays open until quick-xml >= 0.41.0." } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.38.4", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "calamine-styles@0.1.0" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "reachability": { "verdict": "reachable", "pulled_by": [ "calamine-styles@0.1.0" ], "note": "Pulled in by calamine-styles, the crates.io workbook reader that wolfxl-core, wolfxl-classify and wolfxl call. calamine-styles 0.1.0 source: 69 unchecked `.attributes()` call sites and 6 `try_get_attribute` calls (xlsx styles and workbook parsing, ODS). Reading a crafted workbook can spend quadratic CPU on one start tag. Fix: a calamine-styles release built on quick-xml >= 0.41.0; WolfXL cannot patch it in place." } } ], "open_critical_or_high_python": [ { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "package": "cryptography@47.0.0", "fix_versions": [ "48.0.1" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "shipped_extra", "reachability": { "verdict": "not_reachable_in_source", "pulled_by": [ "msoffcrypto-tool@5.4.2" ], "note": "cryptography 47.0.0 is pulled in by msoffcrypto-tool@5.4.2 through the optional `encrypted` extra of engines/wolfxl/oss/uv.lock. The advisory is about the OpenSSL statically linked into cryptography wheels before 48.0.1; the OpenSSL advisory of 9 June 2026 rates its high-severity issue as a use-after-free in PKCS7_verify (CVE-2026-45447; applications using the CMS APIs are not affected). msoffcrypto-tool's wheel has 0 PKCS#7 references and the package's own Python source has 0, so the PKCS7_verify path is not called. The dependency stays vulnerable and the optional extra is not installed by default. Fix: cryptography >= 48.0.1." }, "lock": "engines/wolfxl/oss/uv.lock" } ], "python_shipped_extra_findings": [ { "id": "PYSEC-2026-3554", "aliases": [ "CVE-2026-69248", "GHSA-m2h6-j472-rp4c" ], "package": "cryptography@47.0.0", "fix_versions": [ "49.0.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra", "lock": "engines/wolfxl/oss/uv.lock" }, { "id": "PYSEC-2026-3552", "aliases": [ "CVE-2026-69247", "GHSA-g6cj-pr64-35w5" ], "package": "cryptography@47.0.0", "fix_versions": [ "50.0.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra", "lock": "engines/wolfxl/oss/uv.lock" }, { "id": "PYSEC-2026-3553", "aliases": [ "CVE-2026-69249", "GHSA-jwv3-5hgf-82ww" ], "package": "cryptography@47.0.0", "fix_versions": [ "49.0.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra", "lock": "engines/wolfxl/oss/uv.lock" }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "package": "cryptography@47.0.0", "fix_versions": [ "48.0.1" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "scope": "shipped_extra", "reachability": { "verdict": "not_reachable_in_source", "pulled_by": [ "msoffcrypto-tool@5.4.2" ], "note": "cryptography 47.0.0 is pulled in by msoffcrypto-tool@5.4.2 through the optional `encrypted` extra of engines/wolfxl/oss/uv.lock. The advisory is about the OpenSSL statically linked into cryptography wheels before 48.0.1; the OpenSSL advisory of 9 June 2026 rates its high-severity issue as a use-after-free in PKCS7_verify (CVE-2026-45447; applications using the CMS APIs are not affected). msoffcrypto-tool's wheel has 0 PKCS#7 references and the package's own Python source has 0, so the PKCS7_verify path is not called. The dependency stays vulnerable and the optional extra is not installed by default. Fix: cryptography >= 48.0.1." }, "lock": "engines/wolfxl/oss/uv.lock" }, { "id": "PYSEC-2026-4154", "aliases": [ "CVE-2026-102995", "GHSA-fp3h-c4fm-7vvf" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.18.1" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra", "lock": "engines/wolfxl/uv.lock" }, { "id": "PYSEC-2026-4160", "aliases": [ "CVE-2026-103000", "GHSA-w23x-9jrw-r45c" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.19.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra", "lock": "engines/wolfxl/uv.lock" }, { "id": "PYSEC-2026-4159", "aliases": [ "GHSA-v247-6f48-mgcj", "CVE-2026-102999" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.19.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra", "lock": "engines/wolfxl/uv.lock" }, { "id": "PYSEC-2026-4156", "aliases": [ "CVE-2026-102997", "GHSA-jw7q-gvrg-4vj3" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.18.1" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra", "lock": "engines/wolfxl/uv.lock" }, { "id": "PYSEC-2026-4155", "aliases": [ "GHSA-g9cg-prrw-2r8q", "CVE-2026-102996" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.18.1" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra", "lock": "engines/wolfxl/uv.lock" }, { "id": "PYSEC-2026-4157", "aliases": [ "CVE-2026-102998", "GHSA-php9-fj8v-98fj" ], "package": "pypdf@6.18.0", "fix_versions": [ "6.19.0" ], "cvss": null, "score": null, "severity": "unrated", "scope": "shipped_extra", "lock": "engines/wolfxl/uv.lock" } ], "open_critical_or_high_not_shipped": [ { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfrender/crates/wolfrender-chart/tests/generator/Cargo.lock", "reachability": { "verdict": "not_shipped", "note": "Lock category not_shipped: fixture generator, not part of the workspace and never built by cargo test" } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfrender/crates/wolfrender-chart/tests/generator/Cargo.lock", "reachability": { "verdict": "not_shipped", "note": "Lock category not_shipped: fixture generator, not part of the workspace and never built by cargo test" } }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfxl/benchmarks/template_competitive/Cargo.lock", "reachability": { "verdict": "not_shipped", "note": "Lock category not_shipped: benchmark harness pinned to a competitor, isolated from product resolution (publish = false)" } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.37.5", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfxl/benchmarks/template_competitive/Cargo.lock", "reachability": { "verdict": "not_shipped", "note": "Lock category not_shipped: benchmark harness pinned to a competitor, isolated from product resolution (publish = false)" } }, { "id": "RUSTSEC-2026-0195", "kind": "vulnerability", "crate": "quick-xml@0.38.3", "title": "Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfxl/benchmarks/template_competitive/Cargo.lock", "reachability": { "verdict": "not_shipped", "note": "Lock category not_shipped: benchmark harness pinned to a competitor, isolated from product resolution (publish = false)" } }, { "id": "RUSTSEC-2026-0194", "kind": "vulnerability", "crate": "quick-xml@0.38.3", "title": "Quadratic run time when checking a start tag for duplicate attribute names", "patched": [ ">=0.41.0" ], "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score": 7.5, "severity": "high", "lock_category": "not_shipped", "shipped_lock": false, "lock": "engines/wolfxl/benchmarks/template_competitive/Cargo.lock", "reachability": { "verdict": "not_shipped", "note": "Lock category not_shipped: benchmark harness pinned to a competitor, isolated from product resolution (publish = false)" } } ], "lower_findings": [ { "id": "RUSTSEC-2025-0134", "kind": "unmaintained", "crate": "rustls-pemfile@2.2.0", "title": "rustls-pemfile is unmaintained", "cvss": null, "score": null, "severity": "unrated", "shipped": "lockfile_only", "scope": "wolf Cargo.lock", "disposition": { "status": "not_shipped", "reason": "in Cargo.lock but linked into no configuration" } }, { "id": "RUSTSEC-2026-0190", "kind": "unsound", "crate": "anyhow@1.0.102", "title": "Unsoundness in `Error::downcast_mut()`", "cvss": null, "score": null, "severity": "unrated", "shipped": "lockfile_only", "scope": "wolf Cargo.lock", "disposition": { "status": "not_shipped", "reason": "in Cargo.lock but linked into no configuration" } }, { "id": "RUSTSEC-2026-0204", "kind": "vulnerability", "crate": "crossbeam-epoch@0.9.18", "title": "Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid", "patched": [ ">=0.9.20" ], "cvss": null, "score": null, "severity": "unrated", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-macosx_11_0_arm64.whl", "disposition": { "status": "unaccepted" } }, { "id": "RUSTSEC-2026-0192", "kind": "unmaintained", "crate": "ttf-parser@0.25.1", "title": "`ttf-parser` is unmaintained", "cvss": null, "score": null, "severity": "unrated", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-macosx_11_0_arm64.whl", "disposition": { "status": "accepted_pending", "item": "ltg-ns-h6t-wolfrender-drop-ttf-parser", "reason": "unmaintained notice, no vulnerability; WolfRender drops ttf-parser and rustybuzz in ltg-ns-h6t" } }, { "id": "RUSTSEC-2026-0190", "kind": "unsound", "crate": "anyhow@1.0.102", "title": "Unsoundness in `Error::downcast_mut()`", "cvss": null, "score": null, "severity": "unrated", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-macosx_11_0_arm64.whl", "disposition": { "status": "unaccepted" } }, { "id": "RUSTSEC-2026-0204", "kind": "vulnerability", "crate": "crossbeam-epoch@0.9.18", "title": "Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid", "patched": [ ">=0.9.20" ], "cvss": null, "score": null, "severity": "unrated", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-linux_x86_64.whl", "disposition": { "status": "unaccepted" } }, { "id": "RUSTSEC-2026-0192", "kind": "unmaintained", "crate": "ttf-parser@0.25.1", "title": "`ttf-parser` is unmaintained", "cvss": null, "score": null, "severity": "unrated", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-linux_x86_64.whl", "disposition": { "status": "accepted_pending", "item": "ltg-ns-h6t-wolfrender-drop-ttf-parser", "reason": "unmaintained notice, no vulnerability; WolfRender drops ttf-parser and rustybuzz in ltg-ns-h6t" } }, { "id": "RUSTSEC-2026-0190", "kind": "unsound", "crate": "anyhow@1.0.102", "title": "Unsoundness in `Error::downcast_mut()`", "cvss": null, "score": null, "severity": "unrated", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-linux_x86_64.whl", "disposition": { "status": "unaccepted" } }, { "id": "RUSTSEC-2026-0176", "kind": "vulnerability", "crate": "pyo3@0.28.3", "title": "Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators", "patched": [ ">=0.29.0" ], "cvss": null, "score": null, "severity": "unrated", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "wolfxl@2.0.9" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "disposition": { "status": "unaccepted", "reason": "open on the Community package lock; no fix version adopted yet (patched: >=0.29.0)" }, "reachability": { "verdict": "not_reachable_in_source", "note": "Affects pyo3 `PyList`/`PyTuple` iterator `nth`/`nth_back` and `PyCFunction::new_closure`. The Community package source calls none of them (re-checked by the rescan script)." } }, { "id": "RUSTSEC-2026-0177", "kind": "vulnerability", "crate": "pyo3@0.28.3", "title": "Missing `Sync` bound on `PyCFunction::new_closure` closures", "patched": [ ">=0.29.0" ], "cvss": null, "score": null, "severity": "unrated", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "wolfxl@2.0.9" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "disposition": { "status": "unaccepted", "reason": "open on the Community package lock; no fix version adopted yet (patched: >=0.29.0)" }, "reachability": { "verdict": "not_reachable_in_source", "note": "Affects pyo3 `PyList`/`PyTuple` iterator `nth`/`nth_back` and `PyCFunction::new_closure`. The Community package source calls none of them (re-checked by the rescan script)." } }, { "id": "RUSTSEC-2026-0190", "kind": "unsound", "crate": "anyhow@1.0.102", "title": "Unsoundness in `Error::downcast_mut()`", "cvss": null, "score": null, "severity": "unrated", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "disposition": { "status": "unaccepted", "reason": "open on the Community package lock; no fix version adopted yet" } } ], "unrated_vulnerabilities": [ { "id": "RUSTSEC-2026-0204", "kind": "vulnerability", "crate": "crossbeam-epoch@0.9.18", "title": "Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid", "patched": [ ">=0.9.20" ], "cvss": null, "score": null, "severity": "unrated", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-macosx_11_0_arm64.whl" }, { "id": "RUSTSEC-2026-0204", "kind": "vulnerability", "crate": "crossbeam-epoch@0.9.18", "title": "Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid", "patched": [ ">=0.9.20" ], "cvss": null, "score": null, "severity": "unrated", "shipped": "wheel_sbom", "scope": "wolfxl-2.1.0-cp313-cp313-linux_x86_64.whl" }, { "id": "RUSTSEC-2026-0176", "kind": "vulnerability", "crate": "pyo3@0.28.3", "title": "Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators", "patched": [ ">=0.29.0" ], "cvss": null, "score": null, "severity": "unrated", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "wolfxl@2.0.9" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "disposition": { "status": "unaccepted", "reason": "open on the Community package lock; no fix version adopted yet (patched: >=0.29.0)" }, "reachability": { "verdict": "not_reachable_in_source", "note": "Affects pyo3 `PyList`/`PyTuple` iterator `nth`/`nth_back` and `PyCFunction::new_closure`. The Community package source calls none of them (re-checked by the rescan script)." } }, { "id": "RUSTSEC-2026-0177", "kind": "vulnerability", "crate": "pyo3@0.28.3", "title": "Missing `Sync` bound on `PyCFunction::new_closure` closures", "patched": [ ">=0.29.0" ], "cvss": null, "score": null, "severity": "unrated", "lock_category": "community_package", "shipped_lock": true, "lock": "engines/wolfxl/oss/Cargo.lock", "pulled_by": [ "wolfxl@2.0.9" ], "shipped": "community_package_lock", "scope": "engines/wolfxl/oss/Cargo.lock", "disposition": { "status": "unaccepted", "reason": "open on the Community package lock; no fix version adopted yet (patched: >=0.29.0)" }, "reachability": { "verdict": "not_reachable_in_source", "note": "Affects pyo3 `PyList`/`PyTuple` iterator `nth`/`nth_back` and `PyCFunction::new_closure`. The Community package source calls none of them (re-checked by the rescan script)." } } ], "never_suppressed": "Every finding above is kept, including those on lockfiles that do not ship.", "sources": [ { "commit": "9803ec5d63b29f1f6e5f42dc95f2789c7fe348a0", "path": "evidence/ltg-gtm-a3-security-packet-rescan.json", "sha256": "de0dfa13ee24a378b245aa73afb13a3aa3ed4ecdb901a6ef1be6bc2b57554389" }, { "commit": "9803ec5d63b29f1f6e5f42dc95f2789c7fe348a0", "path": "evidence/ltg-ns-s1-security-packet.json", "sha256": "148e2fb0cf4f32ca6b7cc07f4ce8976475054c7bfa5ec382bc712f9aea5ec97a" } ] }