Repository navigation
FAW-1229, FAW-1573: add missing vulnerability catalogue entries - #21
Merged
Merged
Conversation
Add twelve candidate entries with advisory references and remediation. Keep live-profile and provisional metadata confirmation as prerequisites for publishing the review draft. Related: FAW-1229 Related: FAW-1573 Co-authored-by: Olsi Gjeci <olsi.gjeci@snyk.io> Co-authored-by: FORGE <forge@snyk.io>
Use the live definition severity and CVSS fields for BOLA, backup file disclosure, markdown-it and highlight.js. Preserve the current library CWE convention and document its discrepancy with the two legacy production definitions for content review. Related: FAW-1229 Related: FAW-1573 Co-authored-by: Olsi Gjeci <olsi.gjeci@snyk.io> Co-authored-by: FORGE <forge@snyk.io>
pavkam
approved these changes
Nov 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Add public pages for 12 vulnerabilities missing from the catalogue: React2Shell, PHP2Shell, markdown-it, highlight.js, Swiper, Quill, MooTools, Marked, protobuf.js, Video.js, Backup file disclosure and Broken Object Level Authorization. Each entry includes metadata, remediation and advisory references.
A read-only production API check on October 30, 2026 confirmed all 12 in the built-in profiles and definitions visible to the authenticated account. BOLA is high/CVSS 3.1 8.1 and appears in API profiles; Backup disclosure is low/CVSS 3.0 5.3 and appears in web profiles. PHP2Shell appears in full/api_full. This does not establish availability in every account or region.
Notes for the reviewer
Validation: all 12 additions were independently reviewed and all 23 reference links returned HTTP 200. All 139 existing/new entries passed the website's actual list/sitemap/detail parsing and metadata rendering using local file transport, repeated after the live metadata corrections. GitHub transport and styling were mocked; deployed website rendering and cache refresh remain unverified.
After release, verify the public list, each new detail page, severity/PCI filtering and the vulnerability sitemap before closing the linked tickets.
Missed anything?
More information
Tracking: FAW-1706 coordinates catalogue coverage, rendering and public rollout. FAW-1707 tracks the separate existing website test/lint failures. FAW-1229 and FAW-1573 retain the eight library acceptance criteria.
Requested by Olsi Gjeci.
Production verification — November 2, 2026
Both PRs are approved and merged (website first). All 12 new entries are live in the public list, individual detail pages and 139-entry sitemap. Browser verification covered descriptions, remediation, reference links, CWE/CVSS metadata, UTF-8 punctuation, name/severity filters and PCI filtering, including both legacy and v4.0.1 mappings. Public markdown-it/highlight.js pages retain the approved CWE-1395 mapping.
FAW-1706, FAW-1229 and FAW-1573 are Done with production evidence. FAW-1707 remains open for the separate existing full-suite/lint failures. No backend-definition migration is claimed.
PHP2Shell · PHP search · vulnerability sitemap