{
 "arch": "arm64",
 "findings": [
  {
   "affects": [
    "sharp"
   ],
   "cvss": 8.9,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "0.35.4"
   ],
   "id": "GHSA-rgj7-g3m4-5g8c",
   "severity": "high",
   "title": "sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545",
   "url": "https://github.com/advisories/GHSA-rgj7-g3m4-5g8c"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 8.8,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.4"
   ],
   "id": "GHSA-r6q2-hw4h-h46w",
   "severity": "high",
   "title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS",
   "url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 8.2,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.7"
   ],
   "id": "GHSA-34x7-hfp2-rc4v",
   "severity": "high",
   "title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
   "url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 8.2,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.3"
   ],
   "id": "GHSA-8qq5-rm4j-mr97",
   "severity": "high",
   "title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization",
   "url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 8.2,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.11"
   ],
   "id": "GHSA-9ppj-qmqm-q256",
   "severity": "high",
   "title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
   "url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 8.2,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.10"
   ],
   "id": "GHSA-qffp-2rhf-9h96",
   "severity": "high",
   "title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
   "url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 7.5,
   "distro_severity": "critical",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.19"
   ],
   "id": "GHSA-23hp-3jrh-7fpw",
   "severity": "high",
   "title": "node-tar: Decompression/parse DoS via unlimited input",
   "url": "https://github.com/advisories/GHSA-23hp-3jrh-7fpw"
  },
  {
   "affects": [
    "js-yaml"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "4.3.2"
   ],
   "id": "GHSA-2883-xcg3-v3hh",
   "severity": "high",
   "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
   "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.18"
   ],
   "id": "GHSA-8x88-c5mf-7j5w",
   "severity": "high",
   "title": "node-tar: Negative tar entry size causes infinite loop in archive replace",
   "url": "https://github.com/advisories/GHSA-8x88-c5mf-7j5w"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.21"
   ],
   "id": "GHSA-r292-9mhp-454m",
   "severity": "high",
   "title": "node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection",
   "url": "https://github.com/advisories/GHSA-r292-9mhp-454m"
  },
  {
   "affects": [
    "adm-zip"
   ],
   "cvss": 7.5,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "0.6.0"
   ],
   "id": "GHSA-xcpc-8h2w-3j85",
   "severity": "high",
   "title": "adm-zip: Crafted ZIP file triggers 4GB memory allocation",
   "url": "https://github.com/advisories/GHSA-xcpc-8h2w-3j85"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 7.1,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.8"
   ],
   "id": "GHSA-83g3-92jg-28cx",
   "severity": "high",
   "title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction",
   "url": "https://github.com/advisories/GHSA-83g3-92jg-28cx"
  },
  {
   "affects": [
    "sharp"
   ],
   "cvss": 7.0,
   "distro_severity": "high",
   "fix_state": "fixed",
   "fixed_in": [
    "0.35.0"
   ],
   "id": "GHSA-f88m-g3jw-g9cj",
   "severity": "high",
   "title": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591",
   "url": "https://github.com/advisories/GHSA-f88m-g3jw-g9cj"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 6.9,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.16"
   ],
   "id": "GHSA-vmf3-w455-68vh",
   "severity": "medium",
   "title": "node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",
   "url": "https://github.com/advisories/GHSA-vmf3-w455-68vh"
  },
  {
   "affects": [
    "adm-zip"
   ],
   "cvss": 6.5,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "GHSA-vwc7-r8mq-g2x9",
   "severity": "medium",
   "title": "adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite",
   "url": "https://github.com/advisories/GHSA-vwc7-r8mq-g2x9"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.17"
   ],
   "id": "GHSA-gvwx-54wh-qm9j",
   "severity": "medium",
   "title": "node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records",
   "url": "https://github.com/advisories/GHSA-gvwx-54wh-qm9j"
  },
  {
   "affects": [
    "tar"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "7.5.18"
   ],
   "id": "GHSA-w8wr-v893-vjvp",
   "severity": "medium",
   "title": "node-tar: Process crash via PAX numeric path type confusion",
   "url": "https://github.com/advisories/GHSA-w8wr-v893-vjvp"
  }
 ],
 "findings_changed_at": "2026-09-16T13:22:27Z",
 "image": "omp",
 "inputs": {
  "sbom_sha256": "82c8cc568ba069bd80cb14a3d630b56646010bad10bf1565a62c83e352941869"
 },
 "platform_digest": "sha256:3d8281345e90d4186cd0a1336131d5c7f91fd94d4a69b07dfd758046aeb28214",
 "project": "omp",
 "receipt_sha256": "8dd0ea9c704c089aa7bf6bacd9c57d4126345763cc84fb0d0c20b35bbdba9148",
 "scanner": "grype",
 "severity_counts": {
  "critical": 0,
  "high": 13,
  "low": 0,
  "medium": 4,
  "unknown": 0
 },
 "suppressed": [],
 "version": "18.0.11",
 "vex_applied": [
  "omp-18.0.11-arm64.vex.json",
  "omp-18.0.11-arm64.ubuntu-vex.json"
 ]
}