VDB

GHSA-rx8g-88g5-qh64

GHSA-rx8g-88g5-qh64 PUBLISHED CVSS 2.9000000953674316 LOW

min-document vulnerable to prototype pollution

Record from GitHub Advisory Database · Published September 24, 2025

min-document is fixed in 2.19.1 (npm)

min-document vulnerable to prototype pollution

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
min-documentnpm2.19.1
opensearch-dashboards-3-fipsChainguard3.5.0-r0
opensearch-dashboards-2Wolfi2.19.4-r15
opensearch-dashboards-2-fipsChainguard2.19.4-r11
foxx-cliChainguard2.1.1-r3
gitlab-rails-ce-fips-19.2Chainguard19.2.6-r2
opensearch-dashboards-3Wolfi3.5.0-r0
gitlab-rails-ce-18.11Chainguard18.11.13-r0
commercial-gitlab-rails-ee-fips-19.2Chainguard19.2.7-r1
gitlab-rails-ce-fips-19.0Chainguard19.0.9-r3
gitlab-rails-ce-19.1Chainguard19.1.7-r7
arangodb-3.11Chainguard3.11.14.5-r32

14 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0
2.9000000953674316
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

VendorProductVersions
chainguardopensearch-dashboards-3-fips0
wolfiopensearch-dashboards-20
chainguardopensearch-dashboards-2-fips0
chainguardfoxx-cli0
chainguardgitlab-rails-ce-fips-19.20
wolfiopensearch-dashboards-30
chainguardgitlab-rails-ce-18.110
npmmin-document0
chainguardcommercial-gitlab-rails-ee-fips-19.20
chainguardgitlab-rails-ce-fips-19.00
chainguardgitlab-rails-ce-19.10
chainguardarangodb-3.110
chainguardgitlab-rails-ce-19.20
chainguardgrafana-image-renderer0
chainguardopensearch-dashboards-20
chainguardgitlab-rails-ce-fips-18.100
chainguardgitlab-rails-ce-fips-18.110
chainguardopensearch-dashboards-30
chainguardcommercial-gitlab-rails-ee-19.20
chainguardgitlab-rails-ce-19.30

…and 6 more

Timeline

  • Sep 24, 2025 CVE Published
  • Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-rx8g-88g5-qh64
vulnetix vdb fixes GHSA-rx8g-88g5-qh64

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-rx8g-88g5-qh64/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›