Repository navigation
Conversation
github-actions
Bot
changed the base branch from
main
to
nazeeh111/advisory-improvement-10486
October 22, 2026 05:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The record for CVE-2026-103259 currently has
affected: [], so the npm package and affected/fixed releases are absent from its structured metadata. Add npmn8nwith the two ranges documented by the assigning CNA:<2.39.62.39.6>=2.40.0, <2.40.12.40.1The maintainer advisory identifies the package and both fixed releases. The CNA record explicitly gives
pkg:npm/n8nand these separate version intervals. Keeping the ranges separate preserves the fixed 2.39.6 branch and the affected 2.40.0 release. Theintroduced: "0"event represents the CNA's open lower bound; it is not a claim that the feature existed in the first release.Only
affectedchanges. The narrative, severity vectors, existing references, attribution and unreviewed status remain unchanged. The vendor/CNA score is CVSS v4 8.5; its v3.1 score is 7.6. No score change is proposed.Validation: the exact original and proposal pass the official OSV schema; 15 npm version-boundary cases cover fixed releases, the branch gap, prereleases and build metadata. A preservation check confirms that no other metadata changes, and the patch applies to the pinned original and reconstructs the proposal byte for byte. Exact advisory/CVE searches found no matching existing contribution at preparation time.
This corrects metadata for an already public vulnerability. It does not claim discovery, a product-code fix or runtime reproduction. Research and preparation were assisted by Codex.