ETK-2026-2519Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2519",
  "cve_id": null,
  "display_id": "ETK-2026-2519",
  "ghsa_id": "GHSA-j6pr-xwxg-vcxj",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Uninitialized index access in turbohtml JavaScript minifier",
  "summary": "turbohtml versions before 1.14.0 are affected when using its JavaScript minifier, including HTML processing with JavaScript minification enabled. An attacker who can supply JavaScript or HTML for minification may crash the process and, in some cases, cause incorrect minified output.",
  "mitigation": "Upgrade turbohtml to version 1.14.0 or later. Until upgrading, do not minify untrusted JavaScript and disable JavaScript minification for untrusted HTML.",
  "vendor": "pip",
  "product": "pip:turbohtml",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.0.0, <= 1.13.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "1.14.0"
      ],
      "package_name": "turbohtml",
      "purl": "pkg:pypi/turbohtml"
    }
  ],
  "cwes": [
    125
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 9.455022683333333,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-10-22T23:36:04.661729+00:00",
      "days": -0.03203017561342593,
      "is_lower_bound": true,
      "measured_at": "2026-10-23T00:22:12.132408+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-09T21:12:00+00:00",
      "days": -13.132084130810185,
      "is_lower_bound": true,
      "measured_at": "2026-10-23T00:22:12.132408+00:00",
      "url": "https://github.com/tox-dev/turbohtml/security/advisories/GHSA-j6pr-xwxg-vcxj"
    },
    "trigger_signal": {
      "at": "2026-10-09T21:12:00+00:00",
      "days": -13.132084130810185,
      "is_lower_bound": true,
      "measured_at": "2026-10-23T00:22:12.132408+00:00",
      "url": "https://github.com/tox-dev/turbohtml/security/advisories/GHSA-j6pr-xwxg-vcxj"
    }
  }
}