GHSA-vpq2-c234-7xj6: @tootallnate/once fixed in 3.0.1 and 2.0.1

GHSA-vpq2-c234-7xj6 PUBLISHED CVSS 3.299999952316284 LOW

@tootallnate/once vulnerable to Incorrect Control Flow Scoping

Record from GitHub Advisory Database · Published March 3, 2026

@tootallnate/once is fixed in 3.0.1 and 2.0.1 (npm)

@tootallnate/once vulnerable to Incorrect Control Flow Scoping

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
@tootallnate/once	npm	3.0.1, 2.0.1
gemini-cli	Chainguard	0.43.0-r0
langfuse-2	Chainguard	2.95.12-r29
kibana-9.3	Chainguard	9.3.5-r0
sqlpad	Wolfi	7.5.7-r28
kibana-9.0	Chainguard	9.0.8-r26
argo-workflows-4.0	Wolfi	4.0.4-r6
redisinsight	Chainguard	3.4.1-r0
argo-workflows-3.6	Chainguard	3.6.19-r6
opensearch-dashboards-2	Wolfi	2.19.4-r15
kibana-9.1	Chainguard	9.1.10-r30
langfuse-fips-2	Chainguard	2.95.12-r31

39 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

3.299999952316284

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Vendor	Product	Versions
chainguard	gemini-cli	0
chainguard	langfuse-2	0
chainguard	kibana-9.3	0
wolfi	sqlpad	0
chainguard	kibana-9.0	0
wolfi	argo-workflows-4.0	0
chainguard	redisinsight	0
chainguard	argo-workflows-3.6	0
wolfi	opensearch-dashboards-2	0
chainguard	kibana-9.1	0
chainguard	langfuse-fips-2	0
wolfi	argo-workflows-3.7	0
wolfi	langfuse-3	0
chainguard	argo-workflows-4.0	0
chainguard	tileserver-gl-fips	0
chainguard	gitlab-rails-ce-19.3	0
wolfi	vitess-23	0
chainguard	gitlab-rails-ce-19.1	0
chainguard	wazuh-dashboard	0
chainguard	opensearch-dashboards-2	0

…and 31 more

Timeline

Mar 3, 2026 CVE Published
Apr 30, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-vpq2-c234-7xj6
vulnetix vdb fixes GHSA-vpq2-c234-7xj6

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-vpq2-c234-7xj6/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →