ETK-2026-2480Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2480",
  "cve_id": null,
  "display_id": "ETK-2026-2480",
  "ghsa_id": "GHSA-259h-c659-9x53",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Git allowlist bypass and policy override in cdxgen server",
  "summary": "cdxgen HTTP server deployments using affected @cdxgen/cdxgen or @cyclonedx/cdxgen releases can accept repository sources outside the configured Git host allowlist and allow request settings to weaken server policy. An unauthenticated client able to reach the server can trigger outbound connections and, when relevant build tools are permitted, cause cloned project build actions to run as the server user.",
  "mitigation": "Upgrade @cdxgen/cdxgen to 13.5.0 or later, or @cyclonedx/cdxgen to 12.8.7 or later. Until upgraded, restrict server access to trusted callers and filter policy-changing request parameters at a reverse proxy; remove unnecessary build tools from the allowed command list.",
  "vendor": "npm",
  "product": "npm:@cdxgen/cdxgen",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 13.0.0, < 13.5.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "13.5.0"
      ],
      "package_name": "@cdxgen/cdxgen",
      "purl": "pkg:npm/@cdxgen/cdxgen"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 12.8.7"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "12.8.7"
      ],
      "package_name": "@cyclonedx/cdxgen",
      "purl": "pkg:npm/@cyclonedx/cdxgen"
    }
  ],
  "cwes": [
    94
  ],
  "cvss_score": 9.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 24.76794675,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-20T15:42:43+00:00",
      "days": -2.144300551203704,
      "is_lower_bound": true,
      "measured_at": "2026-10-22T19:10:30.628518+00:00",
      "url": "https://github.com/cdxgen/cdxgen/security/advisories/GHSA-259h-c659-9x53"
    }
  }
}