https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T21:52:15.749019+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/fkie_cve-2022-39390 fkie_cve-2022-39390 2026-10-16T21:52:15.896987+00:00

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-36534. Reason: This candidate is a reservation duplicate of CVE-2020-36534. Notes: All CVE users should reference CVE-2020-36534 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

 https://cve.radiocsirt.org/vuln/ghsa-r4jg-5v89-9v62 Withdrawn: GHSA-r4jg-5v89-9v62 — Withdrawn: Octocat.js vulnerable to code injection 2026-10-16T21:52:15.897040+00:00

Withdrawn by the publisher.

Affected: npm: octocat.js

## Withdrawn

This advisory has been withdrawn because it is a test.

## Original Description

### Impact Users can include their own images for accessories via provided URLs. These URLs are not validated and can result in execution of injected code.

### Patches This vulnerability was fixed in version 1.2 of octocat.js

### Workarounds Directly exposing rendered images to a website can introduce the vulnerability to users. To avoid, writing an image to disk then using that image in an image element in HTML mitigates the risk.

### References To render the file correctly, see documentation at `readme.md`

### For more information If you have any questions or comments about this advisory: * Open an issue in [the octo.js repository](http://github.com/octocademy/octocat.js/issues)

 https://cve.radiocsirt.org/vuln/gsd-2022-39390 gsd-2022-39390 2026-10-16T21:52:15.897076+00:00 gsd-2022-39390