1.7 KiB
bentopdf — triage (group C, 2026-10-27)
Pin: ghcr.io/alam00000/bentopdf:v2.8.6 (static nginx bundle, all PDF work in the browser). No gate field, no login. The Cloudflare CORS-proxy worker (cloudflare/cors-proxy-worker.js) is a separate Worker deployed to Cloudflare; it is not in our image and our compose sets no VITE_CORS_PROXY_URL.
Notices (3 + 2 release hits)
- GHSA-wh78-rcw2-hhg9 (medium): NOT-A-FINDING — SSRF in the Cloudflare CORS-proxy Worker; we neither ship nor deploy it.
- GHSA-5xjf-rr5x-pcfj (medium): NOT-A-FINDING — same Worker.
- GHSA-cx8x-7rrr-r9x8 (low): REAL (
<= v2.8.6). An imported workflow file's TSA URL gets the SHA-256 of the user's PDF (client-side). No login; needs the user to import an attacker's workflow file and run it. Fixed in v2.8.7 (release note lists it; the advisory itself names no patched version). - release:v2.8.7: REAL security release (the three above).
- release:v2.8.10: REAL security release — GHSA-v77x-cvmx-ggp4, GHSA-qch9-77q9-j7p6 "affecting all versions up to v2.8.9"; advisories still private (404 on 2026-10-27); severity/component unknown. Worst real: unknown (embargoed) / low known.
Fix
Smallest: v2.8.10 (covers cx8x + both embargoed). TARGET: v2.8.10 (ghcr tag v2.8.10 exists; also a plain 2.8.10). Same main: yes. Breaking (read v2.8.7..v2.8.10): none found. v2.8.8 big feature release (PDF text editor, Kura, Hyper Compress) — no config/env/port change stated; v2.8.9 timestamp CORS-proxy fallback only on official domains. Lane: SECURITY_FIX.
Classifier note
Worker advisories (package "cors-proxy-worker.js") should not be flagged for the container image; cx8x shows "no fixed version" but v2.8.7's release note names it.