GHSA-73rr-hh4g-fpgx: diff fixed in 8.0.3, 5.2.2, 4.0.4 and 1 more

GHSA-73rr-hh4g-fpgx PUBLISHED CVSS 2.700000047683716 LOW

Duplicate

Record from GitHub Advisory Database · Published January 14, 2026

diff is fixed in 8.0.3, 5.2.2, 4.0.4 and 1 more (npm)

Duplicate

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
diff	npm	8.0.3, 5.2.2, 4.0.4, 3.5.1
vitess-22	Chainguard	22.0.3-r0
graalvm-24	Chainguard	24.0.2-r8
npm	Wolfi	11.8.0-r0
thingsboard-fips	Chainguard	4.3.1.3-r1
renovate	Wolfi	43.2.4-r0
npm	Chainguard	11.8.0-r0
thingsboard	Chainguard	4.3.1.3-r1
grafana-12.1	Wolfi	12.1.6-r0
sqlpad	Chainguard	7.5.7-r28
vitess-23	Wolfi	23.0.1-r0
ts-patch	Wolfi	4.0.1-r0

33 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0

2.700000047683716

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

Affected products

Vendor	Product	Versions
chainguard	vitess-22	0
chainguard	graalvm-24	0
wolfi	npm	0
chainguard	thingsboard-fips	0
wolfi	renovate	0
chainguard	npm	0
chainguard	thingsboard	0
chainguard	commercial-gitlab-rails-ee-fips-19.3	*
chainguard	gitlab-rails-ce-fips-18.8	*
wolfi	grafana-12.1	0
chainguard	sqlpad	0
chainguard	gitlab-rails-ce-18.8	*
chainguard	gitlab-rails-ce-fips-18.9	*
wolfi	vitess-23	0
wolfi	ts-patch	0
chainguard	grafana-fips-12.1	0
chainguard	gitlab-rails-ce-fips-19.0	*
chainguard	gitlab-rails-ce-18.6	*
chainguard	langfuse-fips-3	0
chainguard	prism	0

…and 54 more

Timeline

Jan 14, 2026 CVE Published
Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-73rr-hh4g-fpgx
vulnetix vdb fixes GHSA-73rr-hh4g-fpgx

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-73rr-hh4g-fpgx/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →