VulnerabilityAwaiting Analysis

CVE-2026-82838

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content.

MEDIUM 6.4EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

CVSS 4.0: 6.4 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.23% probability · 14th percentile
CISA KEV: Not listed
Weakness: CWE-80
Source: 655498c3-6ec5-4f0b-aea6-853b334d05a6

References

https://github.com/venueless/venueless/security/advisories/GHSA-38wh-hqvm-xgfc

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.