Known vulnerabilities in SBOM components (OSV)
Product: COOK version 2.0.0
Manufacturer: Bilal El Homsi
Generated: 2026-10-24 by cra-dossier 0.1.0 from the repository cook at commit cd17b114fbab
Regulation: Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024, http://data.europa.eu/eli/reg/2024/2847/oj
DRAFT generated from the repository for the manufacturer to review, complete and sign. This is not legal advice. This document makes no claim that the product conforms to Regulation (EU) 2024/2847 and no claim about CE marking; conformity is declared only by the manufacturer, on its sole responsibility, after completing the human items in the gap list.
Source: osv.dev batch query on 2026-10-23, 814 package URLs queried. Annex I, Part I, point (2)(a): made available without known exploitable vulnerabilities; Annex I, Part II, point (2): address and remediate without delay. A listed advisory is a known vulnerability in a component, not proof that it is exploitable in this product; the triage decision and its reason are recorded per row.
- Advisories: 59; affected components: 21.
- In components the SBOM marks as required (likely shipped in the product): 0. In components marked optional or excluded (typically build-time or development tooling, not shipped): 59. The scope column comes from the SBOM tool; confirm which components ship in the release build before deciding.
This public copy omits advisory summaries; the manufacturer’s copy carries them.
| Advisory | Severity | Component(s) | SBOM scope | Fixed in | Triage |
|---|---|---|---|---|---|
| GHSA-528h-pc64-c93x | MODERATE | stream-json@1.9.1 | optional | stream-json@3.5.0 | |
| GHSA-hqr4-qq8f-hg3x | MODERATE | stream-json@1.9.1 | optional | stream-json@3.6.0 | |
| GHSA-mjw6-4jj6-33hc | MODERATE | stream-json@1.9.1 | optional | stream-json@3.6.0 | |
| GHSA-w5hq-g745-h8pq | MODERATE | uuid@8.3.2, uuid@7.0.3 | optional | uuid@11.1.1, uuid@12.0.1, uuid@13.0.1 | |
| GHSA-4qx8-w7c3-pj3p | HIGH | toml@3.0.0 | optional | toml@5.0.1 | |
| GHSA-82x6-q7mm-w9cf | HIGH | toml@3.0.0 | optional | toml@4.2.0 | |
| GHSA-9j65-hcg3-gc64 | HIGH | toml@3.0.0 | optional | toml@5.0.1 | |
| GHSA-9qmh-m7c6-f92p | HIGH | toml@3.0.0 | optional | toml@5.0.1 | |
| GHSA-v5mp-jgw5-2x6j | HIGH | toml@3.0.0 | optional | toml@4.1.2 | |
| GHSA-3gc7-fjrx-p6mg | HIGH | bigint-buffer@1.1.5 | optional | ||
| GHSA-pqg4-j6r4-53mv | CRITICAL | shell-quote@1.10.0 | optional | shell-quote@1.11.0 | |
| GHSA-86w9-cpqp-85rv | HIGH | node-forge@1.4.0 | optional | ||
| GHSA-27p8-2357-5qqv | HIGH | @xmldom/xmldom@0.8.13, @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.8.15, @xmldom/xmldom@0.9.12 | |
| GHSA-4w3w-2rp5-g8jm | HIGH | @xmldom/xmldom@0.8.13, @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.9.11, @xmldom/xmldom@0.8.14 | |
| GHSA-6gmq-8vp8-gcm6 | MODERATE | @xmldom/xmldom@0.8.13, @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.8.15, @xmldom/xmldom@0.9.12 | |
| GHSA-6h8r-xr42-gp59 | MODERATE | @xmldom/xmldom@0.8.13, @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.8.15, @xmldom/xmldom@0.9.12 | |
| GHSA-8344-3jmq-59r6 | HIGH | @xmldom/xmldom@0.8.13, @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.8.15, @xmldom/xmldom@0.9.12 | |
| GHSA-93r5-fhx6-vmg9 | HIGH | @xmldom/xmldom@0.8.13, @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.8.15, @xmldom/xmldom@0.9.12 | |
| GHSA-965w-775f-mr7g | HIGH | @xmldom/xmldom@0.8.13, @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.8.15, @xmldom/xmldom@0.9.12 | |
| GHSA-c7q8-3ch8-vqpv | HIGH | @xmldom/xmldom@0.8.13, @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.8.15, @xmldom/xmldom@0.9.12 | |
| GHSA-w2rr-34g9-rvrj | HIGH | @xmldom/xmldom@0.8.13, @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.9.11, @xmldom/xmldom@0.8.14 | |
| GHSA-x4fp-j954-r2f4 | HIGH | @xmldom/xmldom@0.8.13 | optional | @xmldom/xmldom@0.8.15 | |
| GHSA-6j4f-fj2g-mc7p | HIGH | brace-expansion@5.0.7 | optional | brace-expansion@5.0.10, brace-expansion@3.0.7, brace-expansion@2.1.5, brace-expansion@1.1.19 | |
| GHSA-mh99-v99m-4gvg | HIGH | brace-expansion@5.0.7 | optional | brace-expansion@5.0.8, brace-expansion@3.0.3, brace-expansion@2.1.3, brace-expansion@1.1.17 | |
| GHSA-q2hr-2g5m-vwhr | MODERATE | brace-expansion@5.0.7 | optional | brace-expansion@5.0.12, brace-expansion@3.0.9, brace-expansion@2.1.7, brace-expansion@1.1.21 | |
| GHSA-qhr7-859c-m2p7 | HIGH | brace-expansion@5.0.7 | optional | brace-expansion@5.0.11, brace-expansion@3.0.8, brace-expansion@2.1.6, brace-expansion@1.1.20 | |
| GHSA-rgw5-rvv9-x895 | HIGH | brace-expansion@5.0.7 | optional | brace-expansion@1.1.18, brace-expansion@2.1.4, brace-expansion@3.0.6, brace-expansion@5.0.9 | |
| GHSA-3px3-54cx-rmw9 | HIGH | @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.9.12 | |
| GHSA-6mj3-qw4j-hgrw | HIGH | @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.9.12 | |
| GHSA-g53g-w8rj-fmg7 | HIGH | @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.9.11 | |
| GHSA-vr34-hp96-76pp | HIGH | @xmldom/xmldom@0.9.10 | optional | @xmldom/xmldom@0.9.12 | |
| GHSA-mrhx-c7xc-m3w5 | HIGH | zod@3.25.76 | optional | zod@4.6.6 | |
| GHSA-wq5f-xc86-pv6w | HIGH | sharp@0.35.4 | optional | sharp@0.35.5 | |
| GHSA-2gqq-gqf2-x968 | LOW | undici@7.29.0 | optional | undici@7.29.1, undici@8.10.2 | |
| GHSA-2jfj-6hjv-fm6j | MODERATE | undici@7.29.0 | optional | undici@7.29.1, undici@8.10.2 | |
| GHSA-3wwx-pv8p-q78v | MODERATE | undici@7.29.0 | optional | undici@6.28.1, undici@7.29.1, undici@8.10.2 | |
| GHSA-3xpg-4rpp-hhhm | MODERATE | undici@7.29.0 | optional | undici@7.29.1, undici@8.10.2 | |
| GHSA-4qv8-2p9j-2685 | MODERATE | undici@7.29.0 | optional | undici@6.29.1, undici@7.30.1, undici@8.12.2 | |
| GHSA-8436-99hf-9mmv | LOW | undici@7.29.0 | optional | undici@7.29.1, undici@8.10.2 | |
| GHSA-f72v-6w45-q472 | MODERATE | undici@7.29.0 | optional | undici@7.30.1, undici@8.12.2 | |
| GHSA-pmjh-fq2x-6v4x | MODERATE | undici@7.29.0 | optional | undici@7.29.1, undici@8.10.2 | |
| GHSA-r53p-7pc4-xj5r | LOW | undici@7.29.0 | optional | undici@6.28.1, undici@7.29.1, undici@8.10.2 | |
| GHSA-rfgv-xxqx-mfg5 | HIGH | undici@7.29.0 | optional | undici@6.28.1, undici@7.29.1, undici@8.10.2 | |
| GHSA-rx4f-c7p8-82vq | MODERATE | undici@7.29.0 | optional | undici@7.29.1, undici@8.10.2 | |
| GHSA-w293-vg96-wgc3 | HIGH | undici@7.29.0 | optional | undici@7.29.1, undici@8.10.2 | |
| GHSA-xjj6-f33q-929c | HIGH | undici@7.29.0 | optional | undici@6.29.1, undici@7.30.1, undici@8.12.2 | |
| GHSA-73wf-gq98-2v4g | HIGH | browserslist@4.28.6 | optional | browserslist@4.28.7 | |
| GHSA-c83g-rgw3-j3cx | HIGH | browserslist@4.28.6 | optional | browserslist@4.28.7 | |
| GHSA-w5vr-8v7q-w6rv | MODERATE | baseline-browser-mapping@2.10.43 | optional | baseline-browser-mapping@2.11.0 | |
| GHSA-5p2g-fcmc-qvqq | HIGH | image-size@1.2.1 | optional | image-size@2.0.3 | |
| GHSA-w3rx-r6r6-pgpr | HIGH | image-size@1.2.1 | optional | image-size@2.0.3 | |
| GHSA-fxqj-rqcc-2cmp | MODERATE | postcss@8.5.17 | optional | postcss@8.5.23 | |
| GHSA-r28c-9q8g-f849 | HIGH | postcss@8.5.17 | optional | postcss@8.5.18 | |
| GHSA-28wg-ghj8-5hjv | HIGH | nanoid@3.3.15 | optional | nanoid@3.3.16, nanoid@5.1.16 | |
| GHSA-2v37-7h3g-55p8 | HIGH | nanoid@3.3.15 | optional | nanoid@3.3.18, nanoid@5.1.6 | |
| GHSA-68fv-2mgg-jv7q | HIGH | source-map-js@1.2.1 | optional | source-map-js@1.2.2 | |
| GHSA-2883-xcg3-v3hh | HIGH | js-yaml@4.3.0 | optional | js-yaml@4.3.2, js-yaml@3.15.2 | |
| GHSA-5p4m-2wfm-xmqj | HIGH | js-yaml@4.3.0 | optional | js-yaml@4.3.1, js-yaml@3.15.1 | |
| GHSA-vc2v-76pw-4v95 | HIGH | compression@1.8.1 | optional | compression@1.8.2 |
Triage columns to fill per advisory (Article 13(7) log): reachable in this product (yes/no/unknown), decision (upgrade / mitigate / accept), owner, date.