{"schemaVersion":3,"id":"CVE-2026-49982","aliases":["UBUNTU-CVE-2026-49982","CGA-296h-wx22-826r","CGA-34rg-6c5w-5769","CGA-48fw-4rjc-m5p4","CGA-6pxc-xr2h-hpjh","CGA-7jfg-5cm9-q4fv","CGA-8x29-374f-cpj3","CGA-9726-vwcp-rwpq","CGA-9wpc-5863-j695","CGA-ch38-3rxm-8hq6","CGA-gqhj-h386-9fcm","CGA-hw33-mrhw-98c7","CGA-m48x-v6xh-9xhg","CGA-m7xm-m386-h6pr","CGA-p5xw-cf65-r3mx","CGA-pq7c-jc5x-hx68","CGA-r57p-rrc3-2cr6","CGA-rcf5-gpg8-fp5p","CGA-vx82-qffm-4w2x","CGA-wxx3-788f-6cwp","GHSA-7c78-jf6q-g5cm","CGA-2hgw-77q8-m3h5","CGA-2j2m-6r86-7698","CGA-2vgv-2cc8-52m6","CGA-2w88-j88g-mgcx","CGA-367m-f24m-rxvq","CGA-45q7-36r5-67q7","CGA-49rq-mhqc-hxj2","CGA-4v8g-w39f-g65f","CGA-5cf5-7x5h-p3c8","CGA-5gwh-gq38-r2wc","CGA-5jff-x745-fjcx","CGA-5rjv-p29j-wpv2","CGA-6v37-h266-68cv","CGA-6xg9-27v6-jhv8","CGA-72pg-w2xm-pmj3","CGA-7g9x-mx72-jpw5","CGA-7qpr-gphj-x7mw","CGA-7ww7-4p2f-f474","CGA-98rg-5mr7-hpq9","CGA-9fvp-vwh6-pfxm","CGA-9qr7-9wrv-99gh","CGA-c3r6-55hr-q4fq","CGA-c635-4wq3-2gpf","CGA-cgv9-j4c6-jf2v","CGA-cv26-c9wp-cfqm","CGA-cxmm-3wrj-p64g","CGA-cxvr-5jr8-w6h7","CGA-f6jc-j8r2-p9p5","CGA-fr56-2r5p-fq2x","CGA-fv34-8p7f-2hxm","CGA-gjqr-gvv5-359q","CGA-gm67-h77p-gfwc","CGA-gp53-x65x-jxf6","CGA-h546-hj5w-g57f","CGA-hh5h-fjg9-fgp7","CGA-hq24-2wfj-54hv","CGA-j28g-52c6-m42w","CGA-j5g8-qfm5-v33m","CGA-jghh-5vm3-fwpx","CGA-jm9p-2r8q-q344","CGA-jpxj-6746-6vmw","CGA-mcg2-4pfc-5mm7","CGA-mfj7-3pg3-v376","CGA-mgq5-6v96-m59r","CGA-mm5f-gxqj-7v55","CGA-mrq4-2rqv-f73q","CGA-p879-6xwp-qrv7","CGA-p98p-64hr-5424","CGA-q2vq-wv48-wqxc","CGA-qxhp-43r2-pwv9","CGA-r2v4-rp6c-ppf6","CGA-r5h7-wj55-cwm5","CGA-rcpr-j593-qw4r","CGA-rfc9-4fxx-r3g2","CGA-rpfq-9jrq-vgjq","CGA-vhv9-39qw-76wp","CGA-vr93-wv3v-84px","CGA-vrgh-72cw-mwx8","CGA-vxg2-782c-r7hg","CGA-w656-5qfv-ww56","CGA-wgvc-gvqr-fr2j","CGA-wjrq-2pcj-cfvq","CGA-wq9h-9jp6-qpfq","CGA-x563-g4wq-2pxj","CGA-xfcq-f3w8-qxwj","CGA-xvp5-rjmx-9rxm"],"status":"published","duplicateOf":null,"title":null,"description":"tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside _generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. This vulnerability is fixed in 0.2.7.","dates":{"published":"2026-06-11T15:45:00.685Z","modified":"2026-06-11T18:24:22.459Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.2,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.2,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":8.2,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","exploitability":10,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":8.2,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","exploitability":10,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":8.2,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","exploitability":10,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":8.2,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","exploitability":10,"impact":7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.2,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.006,"percentile":0.47973,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.10400000000000001,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00496},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.006,"percentile":0.47973}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00496,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.006,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.006,"percentile":0.47973}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_RASZI_NODE-TMP","name":"Node Tmp","source":"github","url":"https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"},{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"chainguard","product":"arangodb-3.12","name":"arangodb-3.12","label":"arangodb-3.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/arangodb-3.12","purlType":"apk","versions":[{"text":"< 3.12.9.4-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.12.9.4-r25","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-2026.2","name":"authentik-2026.2","label":"authentik-2026.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-2026.2","purlType":"apk","versions":[{"text":"< 2026.2.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2026.2.5-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-2026.5","name":"authentik-2026.5","label":"authentik-2026.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-2026.5","purlType":"apk","versions":[{"text":"< 2026.5.3-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2026.5.3-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-fips-2026.5","name":"authentik-fips-2026.5","label":"authentik-fips-2026.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-fips-2026.5","purlType":"apk","versions":[{"text":"< 2026.5.3-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2026.5.3-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"lerna","name":"lerna","label":"lerna","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/lerna","purlType":"apk","versions":[{"text":"< 9.0.7-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.7-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-alerting-dashboards-plugin","name":"opensearch-dashboards-2-alerting-dashboards-plugin","label":"opensearch-dashboards-2-alerting-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-alerting-dashboards-plugin","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-anomaly-detection-dashboards-plugin","name":"opensearch-dashboards-2-anomaly-detection-dashboards-plugin","label":"opensearch-dashboards-2-anomaly-detection-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-anomaly-detection-dashboards-plugin","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-dashboards-maps","name":"opensearch-dashboards-2-dashboards-maps","label":"opensearch-dashboards-2-dashboards-maps","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-dashboards-maps","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-dashboards-notifications","name":"opensearch-dashboards-2-dashboards-notifications","label":"opensearch-dashboards-2-dashboards-notifications","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-dashboards-notifications","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-dashboards-observability","name":"opensearch-dashboards-2-dashboards-observability","label":"opensearch-dashboards-2-dashboards-observability","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-dashboards-observability","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-dashboards-query-workbench","name":"opensearch-dashboards-2-dashboards-query-workbench","label":"opensearch-dashboards-2-dashboards-query-workbench","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-dashboards-query-workbench","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-dashboards-reporting","name":"opensearch-dashboards-2-dashboards-reporting","label":"opensearch-dashboards-2-dashboards-reporting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-dashboards-reporting","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-dashboards-search-relevance","name":"opensearch-dashboards-2-dashboards-search-relevance","label":"opensearch-dashboards-2-dashboards-search-relevance","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-dashboards-search-relevance","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-dashboards-visualizations","name":"opensearch-dashboards-2-dashboards-visualizations","label":"opensearch-dashboards-2-dashboards-visualizations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-dashboards-visualizations","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-alerting-dashboards-plugin","name":"opensearch-dashboards-2-fips-alerting-dashboards-plugin","label":"opensearch-dashboards-2-fips-alerting-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-alerting-dashboards-plugin","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin","name":"opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin","label":"opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-dashboards-maps","name":"opensearch-dashboards-2-fips-dashboards-maps","label":"opensearch-dashboards-2-fips-dashboards-maps","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-dashboards-maps","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-dashboards-notifications","name":"opensearch-dashboards-2-fips-dashboards-notifications","label":"opensearch-dashboards-2-fips-dashboards-notifications","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-dashboards-notifications","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-dashboards-observability","name":"opensearch-dashboards-2-fips-dashboards-observability","label":"opensearch-dashboards-2-fips-dashboards-observability","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-dashboards-observability","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-dashboards-query-workbench","name":"opensearch-dashboards-2-fips-dashboards-query-workbench","label":"opensearch-dashboards-2-fips-dashboards-query-workbench","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-dashboards-query-workbench","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-dashboards-reporting","name":"opensearch-dashboards-2-fips-dashboards-reporting","label":"opensearch-dashboards-2-fips-dashboards-reporting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-dashboards-reporting","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-dashboards-search-relevance","name":"opensearch-dashboards-2-fips-dashboards-search-relevance","label":"opensearch-dashboards-2-fips-dashboards-search-relevance","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-dashboards-search-relevance","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-dashboards-visualizations","name":"opensearch-dashboards-2-fips-dashboards-visualizations","label":"opensearch-dashboards-2-fips-dashboards-visualizations","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-dashboards-visualizations","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-index-management-dashboards-plugin","name":"opensearch-dashboards-2-fips-index-management-dashboards-plugin","label":"opensearch-dashboards-2-fips-index-management-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-index-management-dashboards-plugin","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-ml-commons-dashboards","name":"opensearch-dashboards-2-fips-ml-commons-dashboards","label":"opensearch-dashboards-2-fips-ml-commons-dashboards","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-ml-commons-dashboards","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-security-analytics-dashboards-plugin","name":"opensearch-dashboards-2-fips-security-analytics-dashboards-plugin","label":"opensearch-dashboards-2-fips-security-analytics-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-security-analytics-dashboards-plugin","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-fips-security-dashboards-plugin","name":"opensearch-dashboards-2-fips-security-dashboards-plugin","label":"opensearch-dashboards-2-fips-security-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-fips-security-dashboards-plugin","purlType":"apk","versions":[{"text":"< 2.19.5-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-index-management-dashboards-plugin","name":"opensearch-dashboards-2-index-management-dashboards-plugin","label":"opensearch-dashboards-2-index-management-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-index-management-dashboards-plugin","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-ml-commons-dashboards","name":"opensearch-dashboards-2-ml-commons-dashboards","label":"opensearch-dashboards-2-ml-commons-dashboards","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-ml-commons-dashboards","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-security-analytics-dashboards-plugin","name":"opensearch-dashboards-2-security-analytics-dashboards-plugin","label":"opensearch-dashboards-2-security-analytics-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-security-analytics-dashboards-plugin","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-2-security-dashboards-plugin","name":"opensearch-dashboards-2-security-dashboards-plugin","label":"opensearch-dashboards-2-security-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-2-security-dashboards-plugin","purlType":"apk","versions":[{"text":"< 2.19.5-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.5-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-3-dashboards-reporting","name":"opensearch-dashboards-3-dashboards-reporting","label":"opensearch-dashboards-3-dashboards-reporting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-3-dashboards-reporting","purlType":"apk","versions":[{"text":"< 3.7.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-3-fips-dashboards-reporting","name":"opensearch-dashboards-3-fips-dashboards-reporting","label":"opensearch-dashboards-3-fips-dashboards-reporting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-3-fips-dashboards-reporting","purlType":"apk","versions":[{"text":"< 3.7.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"prism","name":"prism","label":"prism","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/prism","purlType":"apk","versions":[{"text":"< 5.15.11-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.15.11-r3","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"chainguard","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.246.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.246.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"saf","name":"saf","label":"saf","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-24","name":"vitess-24","label":"vitess-24","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-24","purlType":"apk","versions":[{"text":"< 24.0.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.1-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-24-compat","name":"vitess-24-compat","label":"vitess-24-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-24-compat","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-reporting","name":"wazuh-dashboard-dashboards-reporting","label":"wazuh-dashboard-dashboards-reporting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-reporting-fips","name":"wazuh-dashboard-dashboards-reporting-fips","label":"wazuh-dashboard-dashboards-reporting-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting-fips","purlType":"apk","versions":[{"text":"< 4.14.5-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.14.5-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"lerna","name":"lerna","label":"lerna","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/lerna","purlType":"apk","versions":[{"text":"< 9.0.7-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.7-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"opensearch-dashboards-3-dashboards-reporting","name":"opensearch-dashboards-3-dashboards-reporting","label":"opensearch-dashboards-3-dashboards-reporting","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/opensearch-dashboards-3-dashboards-reporting","purlType":"apk","versions":[{"text":"< 3.7.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.7.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"prism","name":"prism","label":"prism","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/prism","purlType":"apk","versions":[{"text":"< 5.15.11-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.15.11-r3","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"wolfi","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.246.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.246.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"saf","name":"saf","label":"saf","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-24","name":"vitess-24","label":"vitess-24","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-24","purlType":"apk","versions":[{"text":"< 24.0.1-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.1-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-24-compat","name":"vitess-24-compat","label":"vitess-24-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-24-compat","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-tmp","name":"node-tmp","label":"node-tmp","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-tmp","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"Npm","product":"tmp","name":"tmp","label":"tmp","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/tmp","purlType":"npm","versions":[{"text":"≥ 0.2.6, < 0.2.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.2.6, < 0.2.7","eol":null,"hubHref":null},{"vendor":"raszi","product":"node-tmp","name":"node-tmp","label":"node-tmp","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"0.2.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"0.2.6","eol":null,"hubHref":"/vendor/raszi/node-tmp"},{"vendor":"raszi","product":"tmp","name":"tmp","label":"tmp","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"0.2.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"0.2.6","eol":null,"hubHref":"/vendor/raszi/tmp"}],"affectedCount":51,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cm","label":"github.com/raszi/node-tmp/security/advisories/GHSA-7c78-jf6q-g5cm","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Mitigation","Vendor Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-49982","label":"ubuntu.com/security/CVE-2026-49982","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49982","label":"www.cve.org/CVERecord?id=CVE-2026-49982","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49982.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49982.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49982","label":"nvd.nist.gov/vuln/detail/CVE-2026-49982","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/raszi/node-tmp","label":"github.com/raszi/node-tmp","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-6J9P-77C7-V873"]},"timeline":[{"kind":"published","date":"2026-06-11T15:45:00.685Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-11T18:24:22.459Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":43,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T04:46:51.696Z","stale":false,"partial":false}}